blob: e298fb15547ba3fd1d53617da2f393894688b810 [file] [log] [blame]
Jon Wayne Parrotta896d2a2016-11-02 23:42:51 -07001# Copyright 2016 Google Inc.
2#
3# Licensed under the Apache License, Version 2.0 (the "License");
4# you may not use this file except in compliance with the License.
5# You may obtain a copy of the License at
6#
7# http://www.apache.org/licenses/LICENSE-2.0
8#
9# Unless required by applicable law or agreed to in writing, software
10# distributed under the License is distributed on an "AS IS" BASIS,
11# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12# See the License for the specific language governing permissions and
13# limitations under the License.
14
15"""Helpers for transitioning from oauth2client to google-auth.
16
17.. warning::
18 This module is private as it is intended to assist first-party downstream
19 clients with the transition from oauth2client to google-auth.
20"""
21
22from __future__ import absolute_import
23
24from google.auth import _helpers
25import google.auth.app_engine
26import google.oauth2.credentials
27import google.oauth2.service_account
28
Danny Hermes895e3692017-11-09 11:35:57 -080029import six
Jon Wayne Parrotta896d2a2016-11-02 23:42:51 -070030try:
31 import oauth2client.client
32 import oauth2client.contrib.gce
33 import oauth2client.service_account
Danny Hermes895e3692017-11-09 11:35:57 -080034except ImportError as caught_exc:
35 new_exc = ImportError('oauth2client is not installed.')
36 six.raise_from(new_exc, caught_exc)
Jon Wayne Parrotta896d2a2016-11-02 23:42:51 -070037
38try:
39 import oauth2client.contrib.appengine
40 _HAS_APPENGINE = True
41except ImportError:
42 _HAS_APPENGINE = False
43
44
45_CONVERT_ERROR_TMPL = (
46 'Unable to convert {} to a google-auth credentials class.')
47
48
49def _convert_oauth2_credentials(credentials):
50 """Converts to :class:`google.oauth2.credentials.Credentials`.
51
52 Args:
53 credentials (Union[oauth2client.client.OAuth2Credentials,
54 oauth2client.client.GoogleCredentials]): The credentials to
55 convert.
56
57 Returns:
58 google.oauth2.credentials.Credentials: The converted credentials.
59 """
60 new_credentials = google.oauth2.credentials.Credentials(
61 token=credentials.access_token,
62 refresh_token=credentials.refresh_token,
63 token_uri=credentials.token_uri,
64 client_id=credentials.client_id,
65 client_secret=credentials.client_secret,
66 scopes=credentials.scopes)
67
68 new_credentials._expires = credentials.token_expiry
69
70 return new_credentials
71
72
73def _convert_service_account_credentials(credentials):
74 """Converts to :class:`google.oauth2.service_account.Credentials`.
75
76 Args:
77 credentials (Union[
78 oauth2client.service_account.ServiceAccountCredentials,
79 oauth2client.service_account._JWTAccessCredentials]): The
80 credentials to convert.
81
82 Returns:
83 google.oauth2.service_account.Credentials: The converted credentials.
84 """
85 info = credentials.serialization_data.copy()
86 info['token_uri'] = credentials.token_uri
87 return google.oauth2.service_account.Credentials.from_service_account_info(
88 info)
89
90
91def _convert_gce_app_assertion_credentials(credentials):
92 """Converts to :class:`google.auth.compute_engine.Credentials`.
93
94 Args:
95 credentials (oauth2client.contrib.gce.AppAssertionCredentials): The
96 credentials to convert.
97
98 Returns:
99 google.oauth2.service_account.Credentials: The converted credentials.
100 """
101 return google.auth.compute_engine.Credentials(
102 service_account_email=credentials.service_account_email)
103
104
105def _convert_appengine_app_assertion_credentials(credentials):
106 """Converts to :class:`google.auth.app_engine.Credentials`.
107
108 Args:
109 credentials (oauth2client.contrib.app_engine.AppAssertionCredentials):
110 The credentials to convert.
111
112 Returns:
113 google.oauth2.service_account.Credentials: The converted credentials.
114 """
115 # pylint: disable=invalid-name
116 return google.auth.app_engine.Credentials(
117 scopes=_helpers.string_to_scopes(credentials.scope),
118 service_account_id=credentials.service_account_id)
119
120
121_CLASS_CONVERSION_MAP = {
122 oauth2client.client.OAuth2Credentials: _convert_oauth2_credentials,
123 oauth2client.client.GoogleCredentials: _convert_oauth2_credentials,
124 oauth2client.service_account.ServiceAccountCredentials:
125 _convert_service_account_credentials,
126 oauth2client.service_account._JWTAccessCredentials:
127 _convert_service_account_credentials,
128 oauth2client.contrib.gce.AppAssertionCredentials:
129 _convert_gce_app_assertion_credentials,
130}
131
132if _HAS_APPENGINE:
133 _CLASS_CONVERSION_MAP[
134 oauth2client.contrib.appengine.AppAssertionCredentials] = (
135 _convert_appengine_app_assertion_credentials)
136
137
138def convert(credentials):
139 """Convert oauth2client credentials to google-auth credentials.
140
141 This class converts:
142
143 - :class:`oauth2client.client.OAuth2Credentials` to
144 :class:`google.oauth2.credentials.Credentials`.
145 - :class:`oauth2client.client.GoogleCredentials` to
146 :class:`google.oauth2.credentials.Credentials`.
147 - :class:`oauth2client.service_account.ServiceAccountCredentials` to
148 :class:`google.oauth2.service_account.Credentials`.
149 - :class:`oauth2client.service_account._JWTAccessCredentials` to
150 :class:`google.oauth2.service_account.Credentials`.
151 - :class:`oauth2client.contrib.gce.AppAssertionCredentials` to
152 :class:`google.auth.compute_engine.Credentials`.
153 - :class:`oauth2client.contrib.appengine.AppAssertionCredentials` to
154 :class:`google.auth.app_engine.Credentials`.
155
156 Returns:
157 google.auth.credentials.Credentials: The converted credentials.
158
159 Raises:
160 ValueError: If the credentials could not be converted.
161 """
162
163 credentials_class = type(credentials)
164
165 try:
166 return _CLASS_CONVERSION_MAP[credentials_class](credentials)
Danny Hermes895e3692017-11-09 11:35:57 -0800167 except KeyError as caught_exc:
168 new_exc = ValueError(_CONVERT_ERROR_TMPL.format(credentials_class))
169 six.raise_from(new_exc, caught_exc)