blob: 06f52bbd83beb9dfaf1397fd03819db1f46dbb47 [file] [log] [blame]
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -07001# Copyright 2015 Google Inc.
2#
3# Licensed under the Apache License, Version 2.0 (the "License");
4# you may not use this file except in compliance with the License.
5# You may obtain a copy of the License at
6#
7# http://www.apache.org/licenses/LICENSE-2.0
8#
9# Unless required by applicable law or agreed to in writing, software
10# distributed under the License is distributed on an "AS IS" BASIS,
11# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12# See the License for the specific language governing permissions and
13# limitations under the License.
14
15"""Application default credentials.
16
17Implements application default credentials and project ID detection.
18"""
19
20import io
21import json
22import logging
23import os
24
Danny Hermes895e3692017-11-09 11:35:57 -080025import six
26
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -070027from google.auth import environment_vars
28from google.auth import exceptions
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -070029import google.auth.transport._http_client
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -070030
31_LOGGER = logging.getLogger(__name__)
32
33# Valid types accepted for file-based credentials.
34_AUTHORIZED_USER_TYPE = 'authorized_user'
35_SERVICE_ACCOUNT_TYPE = 'service_account'
36_VALID_TYPES = (_AUTHORIZED_USER_TYPE, _SERVICE_ACCOUNT_TYPE)
37
38# Help message when no credentials can be found.
39_HELP_MESSAGE = """
40Could not automatically determine credentials. Please set {env} or
41explicitly create credential and re-run the application. For more
42information, please see
43https://developers.google.com/accounts/docs/application-default-credentials.
44""".format(env=environment_vars.CREDENTIALS).strip()
45
46
47def _load_credentials_from_file(filename):
48 """Loads credentials from a file.
49
50 The credentials file must be a service account key or stored authorized
51 user credentials.
52
53 Args:
54 filename (str): The full path to the credentials file.
55
56 Returns:
57 Tuple[google.auth.credentials.Credentials, Optional[str]]: Loaded
58 credentials and the project ID. Authorized user credentials do not
59 have the project ID information.
60
61 Raises:
62 google.auth.exceptions.DefaultCredentialsError: if the file is in the
weitaiting6e86c932017-08-12 03:26:59 +080063 wrong format or is missing.
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -070064 """
weitaiting6e86c932017-08-12 03:26:59 +080065 if not os.path.exists(filename):
66 raise exceptions.DefaultCredentialsError(
67 'File {} was not found.'.format(filename))
68
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -070069 with io.open(filename, 'r') as file_obj:
70 try:
71 info = json.load(file_obj)
Danny Hermes895e3692017-11-09 11:35:57 -080072 except ValueError as caught_exc:
73 new_exc = exceptions.DefaultCredentialsError(
74 'File {} is not a valid json file.'.format(filename))
75 six.raise_from(new_exc, caught_exc)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -070076
77 # The type key should indicate that the file is either a service account
78 # credentials file or an authorized user credentials file.
79 credential_type = info.get('type')
80
81 if credential_type == _AUTHORIZED_USER_TYPE:
Jon Wayne Parrott6dca98c2016-12-01 15:34:59 -080082 from google.auth import _cloud_sdk
83
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -070084 try:
85 credentials = _cloud_sdk.load_authorized_user_credentials(info)
Danny Hermes895e3692017-11-09 11:35:57 -080086 except ValueError as caught_exc:
87 new_exc = exceptions.DefaultCredentialsError(
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -070088 'Failed to load authorized user credentials from {}'.format(
Danny Hermes895e3692017-11-09 11:35:57 -080089 filename))
90 six.raise_from(new_exc, caught_exc)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -070091 # Authorized user credentials do not contain the project ID.
92 return credentials, None
93
94 elif credential_type == _SERVICE_ACCOUNT_TYPE:
Jon Wayne Parrott6dca98c2016-12-01 15:34:59 -080095 from google.oauth2 import service_account
96
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -070097 try:
98 credentials = (
99 service_account.Credentials.from_service_account_info(info))
Danny Hermes895e3692017-11-09 11:35:57 -0800100 except ValueError as caught_exc:
101 new_exc = exceptions.DefaultCredentialsError(
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700102 'Failed to load service account credentials from {}'.format(
Danny Hermes895e3692017-11-09 11:35:57 -0800103 filename))
104 six.raise_from(new_exc, caught_exc)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700105 return credentials, info.get('project_id')
106
107 else:
108 raise exceptions.DefaultCredentialsError(
109 'The file {file} does not have a valid type. '
110 'Type is {type}, expected one of {valid_types}.'.format(
111 file=filename, type=credential_type, valid_types=_VALID_TYPES))
112
113
114def _get_gcloud_sdk_credentials():
115 """Gets the credentials and project ID from the Cloud SDK."""
Jon Wayne Parrott6dca98c2016-12-01 15:34:59 -0800116 from google.auth import _cloud_sdk
117
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700118 # Check if application default credentials exist.
119 credentials_filename = (
120 _cloud_sdk.get_application_default_credentials_path())
121
122 if not os.path.isfile(credentials_filename):
123 return None, None
124
125 credentials, project_id = _load_credentials_from_file(
126 credentials_filename)
127
128 if not project_id:
129 project_id = _cloud_sdk.get_project_id()
130
131 if not project_id:
132 _LOGGER.warning(
133 'No project ID could be determined from the Cloud SDK '
134 'configuration. Consider running `gcloud config set project` or '
135 'setting the %s environment variable', environment_vars.PROJECT)
136
137 return credentials, project_id
138
139
140def _get_explicit_environ_credentials():
141 """Gets credentials from the GOOGLE_APPLICATION_CREDENTIALS environment
142 variable."""
143 explicit_file = os.environ.get(environment_vars.CREDENTIALS)
144
145 if explicit_file is not None:
146 credentials, project_id = _load_credentials_from_file(
147 os.environ[environment_vars.CREDENTIALS])
148
149 if not project_id:
150 _LOGGER.warning(
151 'No project ID could be determined from the credentials at %s '
152 'Consider setting the %s environment variable',
153 environment_vars.CREDENTIALS, environment_vars.PROJECT)
154
155 return credentials, project_id
156
157 else:
158 return None, None
159
160
161def _get_gae_credentials():
162 """Gets Google App Engine App Identity credentials and project ID."""
Jon Wayne Parrott6dca98c2016-12-01 15:34:59 -0800163 from google.auth import app_engine
164
Jon Wayne Parrott2148fde2016-10-24 13:44:25 -0700165 try:
166 credentials = app_engine.Credentials()
167 project_id = app_engine.get_project_id()
168 return credentials, project_id
169 except EnvironmentError:
170 return None, None
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700171
172
173def _get_gce_credentials(request=None):
174 """Gets credentials and project ID from the GCE Metadata Service."""
175 # Ping requires a transport, but we want application default credentials
176 # to require no arguments. So, we'll use the _http_client transport which
177 # uses http.client. This is only acceptable because the metadata server
178 # doesn't do SSL and never requires proxies.
Jon Wayne Parrott6dca98c2016-12-01 15:34:59 -0800179 from google.auth import compute_engine
180 from google.auth.compute_engine import _metadata
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700181
182 if request is None:
183 request = google.auth.transport._http_client.Request()
184
185 if _metadata.ping(request=request):
186 # Get the project ID.
187 try:
Jon Wayne Parrott5b03ba12016-10-24 13:51:26 -0700188 project_id = _metadata.get_project_id(request=request)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700189 except exceptions.TransportError:
190 _LOGGER.warning(
191 'No project ID could be determined from the Compute Engine '
192 'metadata service. Consider setting the %s environment '
193 'variable.', environment_vars.PROJECT)
194 project_id = None
195
196 return compute_engine.Credentials(), project_id
197 else:
198 return None, None
199
200
Jon Wayne Parrott8a7e5062016-11-07 16:45:17 -0800201def default(scopes=None, request=None):
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700202 """Gets the default credentials for the current environment.
203
204 `Application Default Credentials`_ provides an easy way to obtain
205 credentials to call Google APIs for server-to-server or local applications.
206 This function acquires credentials from the environment in the following
207 order:
208
209 1. If the environment variable ``GOOGLE_APPLICATION_CREDENTIALS`` is set
210 to the path of a valid service account JSON private key file, then it is
211 loaded and returned. The project ID returned is the project ID defined
212 in the service account file if available (some older files do not
213 contain project ID information).
214 2. If the `Google Cloud SDK`_ is installed and has application default
215 credentials set they are loaded and returned.
216
217 To enable application default credentials with the Cloud SDK run::
218
219 gcloud auth application-default login
220
221 If the Cloud SDK has an active project, the project ID is returned. The
222 active project can be set using::
223
224 gcloud config set project
225
226 3. If the application is running in the `App Engine standard environment`_
227 then the credentials and project ID from the `App Identity Service`_
228 are used.
229 4. If the application is running in `Compute Engine`_ or the
230 `App Engine flexible environment`_ then the credentials and project ID
231 are obtained from the `Metadata Service`_.
232 5. If no credentials are found,
233 :class:`~google.auth.exceptions.DefaultCredentialsError` will be raised.
234
235 .. _Application Default Credentials: https://developers.google.com\
236 /identity/protocols/application-default-credentials
237 .. _Google Cloud SDK: https://cloud.google.com/sdk
238 .. _App Engine standard environment: https://cloud.google.com/appengine
239 .. _App Identity Service: https://cloud.google.com/appengine/docs/python\
240 /appidentity/
241 .. _Compute Engine: https://cloud.google.com/compute
242 .. _App Engine flexible environment: https://cloud.google.com\
243 /appengine/flexible
244 .. _Metadata Service: https://cloud.google.com/compute/docs\
245 /storing-retrieving-metadata
246
247 Example::
248
249 import google.auth
250
251 credentials, project_id = google.auth.default()
252
253 Args:
Jon Wayne Parrott8a7e5062016-11-07 16:45:17 -0800254 scopes (Sequence[str]): The list of scopes for the credentials. If
255 specified, the credentials will automatically be scoped if
256 necessary.
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700257 request (google.auth.transport.Request): An object used to make
258 HTTP requests. This is used to detect whether the application
259 is running on Compute Engine. If not specified, then it will
260 use the standard library http client to make requests.
261
262 Returns:
263 Tuple[~google.auth.credentials.Credentials, Optional[str]]:
264 the current environment's credentials and project ID. Project ID
265 may be None, which indicates that the Project ID could not be
266 ascertained from the environment.
267
268 Raises:
269 ~google.auth.exceptions.DefaultCredentialsError:
270 If no credentials were found, or if the credentials found were
271 invalid.
272 """
Jon Wayne Parrott6dca98c2016-12-01 15:34:59 -0800273 from google.auth.credentials import with_scopes_if_required
274
Jon Wayne Parrottce37cba2016-11-07 16:41:42 -0800275 explicit_project_id = os.environ.get(
276 environment_vars.PROJECT,
277 os.environ.get(environment_vars.LEGACY_PROJECT))
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700278
279 checkers = (
280 _get_explicit_environ_credentials,
281 _get_gcloud_sdk_credentials,
282 _get_gae_credentials,
283 lambda: _get_gce_credentials(request))
284
285 for checker in checkers:
286 credentials, project_id = checker()
287 if credentials is not None:
Jon Wayne Parrott6dca98c2016-12-01 15:34:59 -0800288 credentials = with_scopes_if_required(credentials, scopes)
Jon Wayne Parrottaadb3de2016-10-19 09:34:05 -0700289 return credentials, explicit_project_id or project_id
290
291 raise exceptions.DefaultCredentialsError(_HELP_MESSAGE)