Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 1 | # Copyright 2015 Google Inc. |
| 2 | # |
| 3 | # Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | # you may not use this file except in compliance with the License. |
| 5 | # You may obtain a copy of the License at |
| 6 | # |
| 7 | # http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | # |
| 9 | # Unless required by applicable law or agreed to in writing, software |
| 10 | # distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | # See the License for the specific language governing permissions and |
| 13 | # limitations under the License. |
| 14 | |
| 15 | """Application default credentials. |
| 16 | |
| 17 | Implements application default credentials and project ID detection. |
| 18 | """ |
| 19 | |
| 20 | import io |
| 21 | import json |
| 22 | import logging |
| 23 | import os |
| 24 | |
Danny Hermes | 895e369 | 2017-11-09 11:35:57 -0800 | [diff] [blame^] | 25 | import six |
| 26 | |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 27 | from google.auth import environment_vars |
| 28 | from google.auth import exceptions |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 29 | import google.auth.transport._http_client |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 30 | |
| 31 | _LOGGER = logging.getLogger(__name__) |
| 32 | |
| 33 | # Valid types accepted for file-based credentials. |
| 34 | _AUTHORIZED_USER_TYPE = 'authorized_user' |
| 35 | _SERVICE_ACCOUNT_TYPE = 'service_account' |
| 36 | _VALID_TYPES = (_AUTHORIZED_USER_TYPE, _SERVICE_ACCOUNT_TYPE) |
| 37 | |
| 38 | # Help message when no credentials can be found. |
| 39 | _HELP_MESSAGE = """ |
| 40 | Could not automatically determine credentials. Please set {env} or |
| 41 | explicitly create credential and re-run the application. For more |
| 42 | information, please see |
| 43 | https://developers.google.com/accounts/docs/application-default-credentials. |
| 44 | """.format(env=environment_vars.CREDENTIALS).strip() |
| 45 | |
| 46 | |
| 47 | def _load_credentials_from_file(filename): |
| 48 | """Loads credentials from a file. |
| 49 | |
| 50 | The credentials file must be a service account key or stored authorized |
| 51 | user credentials. |
| 52 | |
| 53 | Args: |
| 54 | filename (str): The full path to the credentials file. |
| 55 | |
| 56 | Returns: |
| 57 | Tuple[google.auth.credentials.Credentials, Optional[str]]: Loaded |
| 58 | credentials and the project ID. Authorized user credentials do not |
| 59 | have the project ID information. |
| 60 | |
| 61 | Raises: |
| 62 | google.auth.exceptions.DefaultCredentialsError: if the file is in the |
weitaiting | 6e86c93 | 2017-08-12 03:26:59 +0800 | [diff] [blame] | 63 | wrong format or is missing. |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 64 | """ |
weitaiting | 6e86c93 | 2017-08-12 03:26:59 +0800 | [diff] [blame] | 65 | if not os.path.exists(filename): |
| 66 | raise exceptions.DefaultCredentialsError( |
| 67 | 'File {} was not found.'.format(filename)) |
| 68 | |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 69 | with io.open(filename, 'r') as file_obj: |
| 70 | try: |
| 71 | info = json.load(file_obj) |
Danny Hermes | 895e369 | 2017-11-09 11:35:57 -0800 | [diff] [blame^] | 72 | except ValueError as caught_exc: |
| 73 | new_exc = exceptions.DefaultCredentialsError( |
| 74 | 'File {} is not a valid json file.'.format(filename)) |
| 75 | six.raise_from(new_exc, caught_exc) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 76 | |
| 77 | # The type key should indicate that the file is either a service account |
| 78 | # credentials file or an authorized user credentials file. |
| 79 | credential_type = info.get('type') |
| 80 | |
| 81 | if credential_type == _AUTHORIZED_USER_TYPE: |
Jon Wayne Parrott | 6dca98c | 2016-12-01 15:34:59 -0800 | [diff] [blame] | 82 | from google.auth import _cloud_sdk |
| 83 | |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 84 | try: |
| 85 | credentials = _cloud_sdk.load_authorized_user_credentials(info) |
Danny Hermes | 895e369 | 2017-11-09 11:35:57 -0800 | [diff] [blame^] | 86 | except ValueError as caught_exc: |
| 87 | new_exc = exceptions.DefaultCredentialsError( |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 88 | 'Failed to load authorized user credentials from {}'.format( |
Danny Hermes | 895e369 | 2017-11-09 11:35:57 -0800 | [diff] [blame^] | 89 | filename)) |
| 90 | six.raise_from(new_exc, caught_exc) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 91 | # Authorized user credentials do not contain the project ID. |
| 92 | return credentials, None |
| 93 | |
| 94 | elif credential_type == _SERVICE_ACCOUNT_TYPE: |
Jon Wayne Parrott | 6dca98c | 2016-12-01 15:34:59 -0800 | [diff] [blame] | 95 | from google.oauth2 import service_account |
| 96 | |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 97 | try: |
| 98 | credentials = ( |
| 99 | service_account.Credentials.from_service_account_info(info)) |
Danny Hermes | 895e369 | 2017-11-09 11:35:57 -0800 | [diff] [blame^] | 100 | except ValueError as caught_exc: |
| 101 | new_exc = exceptions.DefaultCredentialsError( |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 102 | 'Failed to load service account credentials from {}'.format( |
Danny Hermes | 895e369 | 2017-11-09 11:35:57 -0800 | [diff] [blame^] | 103 | filename)) |
| 104 | six.raise_from(new_exc, caught_exc) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 105 | return credentials, info.get('project_id') |
| 106 | |
| 107 | else: |
| 108 | raise exceptions.DefaultCredentialsError( |
| 109 | 'The file {file} does not have a valid type. ' |
| 110 | 'Type is {type}, expected one of {valid_types}.'.format( |
| 111 | file=filename, type=credential_type, valid_types=_VALID_TYPES)) |
| 112 | |
| 113 | |
| 114 | def _get_gcloud_sdk_credentials(): |
| 115 | """Gets the credentials and project ID from the Cloud SDK.""" |
Jon Wayne Parrott | 6dca98c | 2016-12-01 15:34:59 -0800 | [diff] [blame] | 116 | from google.auth import _cloud_sdk |
| 117 | |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 118 | # Check if application default credentials exist. |
| 119 | credentials_filename = ( |
| 120 | _cloud_sdk.get_application_default_credentials_path()) |
| 121 | |
| 122 | if not os.path.isfile(credentials_filename): |
| 123 | return None, None |
| 124 | |
| 125 | credentials, project_id = _load_credentials_from_file( |
| 126 | credentials_filename) |
| 127 | |
| 128 | if not project_id: |
| 129 | project_id = _cloud_sdk.get_project_id() |
| 130 | |
| 131 | if not project_id: |
| 132 | _LOGGER.warning( |
| 133 | 'No project ID could be determined from the Cloud SDK ' |
| 134 | 'configuration. Consider running `gcloud config set project` or ' |
| 135 | 'setting the %s environment variable', environment_vars.PROJECT) |
| 136 | |
| 137 | return credentials, project_id |
| 138 | |
| 139 | |
| 140 | def _get_explicit_environ_credentials(): |
| 141 | """Gets credentials from the GOOGLE_APPLICATION_CREDENTIALS environment |
| 142 | variable.""" |
| 143 | explicit_file = os.environ.get(environment_vars.CREDENTIALS) |
| 144 | |
| 145 | if explicit_file is not None: |
| 146 | credentials, project_id = _load_credentials_from_file( |
| 147 | os.environ[environment_vars.CREDENTIALS]) |
| 148 | |
| 149 | if not project_id: |
| 150 | _LOGGER.warning( |
| 151 | 'No project ID could be determined from the credentials at %s ' |
| 152 | 'Consider setting the %s environment variable', |
| 153 | environment_vars.CREDENTIALS, environment_vars.PROJECT) |
| 154 | |
| 155 | return credentials, project_id |
| 156 | |
| 157 | else: |
| 158 | return None, None |
| 159 | |
| 160 | |
| 161 | def _get_gae_credentials(): |
| 162 | """Gets Google App Engine App Identity credentials and project ID.""" |
Jon Wayne Parrott | 6dca98c | 2016-12-01 15:34:59 -0800 | [diff] [blame] | 163 | from google.auth import app_engine |
| 164 | |
Jon Wayne Parrott | 2148fde | 2016-10-24 13:44:25 -0700 | [diff] [blame] | 165 | try: |
| 166 | credentials = app_engine.Credentials() |
| 167 | project_id = app_engine.get_project_id() |
| 168 | return credentials, project_id |
| 169 | except EnvironmentError: |
| 170 | return None, None |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 171 | |
| 172 | |
| 173 | def _get_gce_credentials(request=None): |
| 174 | """Gets credentials and project ID from the GCE Metadata Service.""" |
| 175 | # Ping requires a transport, but we want application default credentials |
| 176 | # to require no arguments. So, we'll use the _http_client transport which |
| 177 | # uses http.client. This is only acceptable because the metadata server |
| 178 | # doesn't do SSL and never requires proxies. |
Jon Wayne Parrott | 6dca98c | 2016-12-01 15:34:59 -0800 | [diff] [blame] | 179 | from google.auth import compute_engine |
| 180 | from google.auth.compute_engine import _metadata |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 181 | |
| 182 | if request is None: |
| 183 | request = google.auth.transport._http_client.Request() |
| 184 | |
| 185 | if _metadata.ping(request=request): |
| 186 | # Get the project ID. |
| 187 | try: |
Jon Wayne Parrott | 5b03ba1 | 2016-10-24 13:51:26 -0700 | [diff] [blame] | 188 | project_id = _metadata.get_project_id(request=request) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 189 | except exceptions.TransportError: |
| 190 | _LOGGER.warning( |
| 191 | 'No project ID could be determined from the Compute Engine ' |
| 192 | 'metadata service. Consider setting the %s environment ' |
| 193 | 'variable.', environment_vars.PROJECT) |
| 194 | project_id = None |
| 195 | |
| 196 | return compute_engine.Credentials(), project_id |
| 197 | else: |
| 198 | return None, None |
| 199 | |
| 200 | |
Jon Wayne Parrott | 8a7e506 | 2016-11-07 16:45:17 -0800 | [diff] [blame] | 201 | def default(scopes=None, request=None): |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 202 | """Gets the default credentials for the current environment. |
| 203 | |
| 204 | `Application Default Credentials`_ provides an easy way to obtain |
| 205 | credentials to call Google APIs for server-to-server or local applications. |
| 206 | This function acquires credentials from the environment in the following |
| 207 | order: |
| 208 | |
| 209 | 1. If the environment variable ``GOOGLE_APPLICATION_CREDENTIALS`` is set |
| 210 | to the path of a valid service account JSON private key file, then it is |
| 211 | loaded and returned. The project ID returned is the project ID defined |
| 212 | in the service account file if available (some older files do not |
| 213 | contain project ID information). |
| 214 | 2. If the `Google Cloud SDK`_ is installed and has application default |
| 215 | credentials set they are loaded and returned. |
| 216 | |
| 217 | To enable application default credentials with the Cloud SDK run:: |
| 218 | |
| 219 | gcloud auth application-default login |
| 220 | |
| 221 | If the Cloud SDK has an active project, the project ID is returned. The |
| 222 | active project can be set using:: |
| 223 | |
| 224 | gcloud config set project |
| 225 | |
| 226 | 3. If the application is running in the `App Engine standard environment`_ |
| 227 | then the credentials and project ID from the `App Identity Service`_ |
| 228 | are used. |
| 229 | 4. If the application is running in `Compute Engine`_ or the |
| 230 | `App Engine flexible environment`_ then the credentials and project ID |
| 231 | are obtained from the `Metadata Service`_. |
| 232 | 5. If no credentials are found, |
| 233 | :class:`~google.auth.exceptions.DefaultCredentialsError` will be raised. |
| 234 | |
| 235 | .. _Application Default Credentials: https://developers.google.com\ |
| 236 | /identity/protocols/application-default-credentials |
| 237 | .. _Google Cloud SDK: https://cloud.google.com/sdk |
| 238 | .. _App Engine standard environment: https://cloud.google.com/appengine |
| 239 | .. _App Identity Service: https://cloud.google.com/appengine/docs/python\ |
| 240 | /appidentity/ |
| 241 | .. _Compute Engine: https://cloud.google.com/compute |
| 242 | .. _App Engine flexible environment: https://cloud.google.com\ |
| 243 | /appengine/flexible |
| 244 | .. _Metadata Service: https://cloud.google.com/compute/docs\ |
| 245 | /storing-retrieving-metadata |
| 246 | |
| 247 | Example:: |
| 248 | |
| 249 | import google.auth |
| 250 | |
| 251 | credentials, project_id = google.auth.default() |
| 252 | |
| 253 | Args: |
Jon Wayne Parrott | 8a7e506 | 2016-11-07 16:45:17 -0800 | [diff] [blame] | 254 | scopes (Sequence[str]): The list of scopes for the credentials. If |
| 255 | specified, the credentials will automatically be scoped if |
| 256 | necessary. |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 257 | request (google.auth.transport.Request): An object used to make |
| 258 | HTTP requests. This is used to detect whether the application |
| 259 | is running on Compute Engine. If not specified, then it will |
| 260 | use the standard library http client to make requests. |
| 261 | |
| 262 | Returns: |
| 263 | Tuple[~google.auth.credentials.Credentials, Optional[str]]: |
| 264 | the current environment's credentials and project ID. Project ID |
| 265 | may be None, which indicates that the Project ID could not be |
| 266 | ascertained from the environment. |
| 267 | |
| 268 | Raises: |
| 269 | ~google.auth.exceptions.DefaultCredentialsError: |
| 270 | If no credentials were found, or if the credentials found were |
| 271 | invalid. |
| 272 | """ |
Jon Wayne Parrott | 6dca98c | 2016-12-01 15:34:59 -0800 | [diff] [blame] | 273 | from google.auth.credentials import with_scopes_if_required |
| 274 | |
Jon Wayne Parrott | ce37cba | 2016-11-07 16:41:42 -0800 | [diff] [blame] | 275 | explicit_project_id = os.environ.get( |
| 276 | environment_vars.PROJECT, |
| 277 | os.environ.get(environment_vars.LEGACY_PROJECT)) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 278 | |
| 279 | checkers = ( |
| 280 | _get_explicit_environ_credentials, |
| 281 | _get_gcloud_sdk_credentials, |
| 282 | _get_gae_credentials, |
| 283 | lambda: _get_gce_credentials(request)) |
| 284 | |
| 285 | for checker in checkers: |
| 286 | credentials, project_id = checker() |
| 287 | if credentials is not None: |
Jon Wayne Parrott | 6dca98c | 2016-12-01 15:34:59 -0800 | [diff] [blame] | 288 | credentials = with_scopes_if_required(credentials, scopes) |
Jon Wayne Parrott | aadb3de | 2016-10-19 09:34:05 -0700 | [diff] [blame] | 289 | return credentials, explicit_project_id or project_id |
| 290 | |
| 291 | raise exceptions.DefaultCredentialsError(_HELP_MESSAGE) |