google-iam-credentials 1.2.0 → 1.4.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/AUTHENTICATION.md +72 -101
- data/README.md +2 -2
- data/lib/google/iam/credentials/version.rb +1 -1
- data/lib/google/iam/credentials.rb +1 -1
- metadata +6 -118
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: de24435c696a9e890ebbf6299fea9e22c3b119a8ec8ed04debb9f07f16d59b01
|
4
|
+
data.tar.gz: 84e621e7957d94c7b542b2551ceb8b0779066d1e3419303bcea0a6dcc2d97a76
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: ed44f64bf1c1fd78d5cce3dc0c622e9db1fdbcb3c95f96ea6894534a88b163d08b6438d51cfd1be00e49686317f991d34c3a2e4c153e737932f087f59d2f2272
|
7
|
+
data.tar.gz: ada482afbe607092ce8c45a8991031ca64017a9dda8c537a1da8b05a415cd0a7e8cf083c7ec7e1d8c1494b8337f1f826622e73fb41b6d09ab225eb3a70636217
|
data/AUTHENTICATION.md
CHANGED
@@ -1,151 +1,122 @@
|
|
1
1
|
# Authentication
|
2
2
|
|
3
|
-
|
4
|
-
[
|
5
|
-
|
6
|
-
[Google Cloud Platform environments](#google-cloud-platform-environments) the
|
7
|
-
credentials will be discovered automatically. When running on other
|
8
|
-
environments, the Service Account credentials can be specified by providing the
|
9
|
-
path to the
|
10
|
-
[JSON keyfile](https://cloud.google.com/iam/docs/managing-service-account-keys)
|
11
|
-
for the account (or the JSON itself) in
|
12
|
-
[environment variables](#environment-variables). Additionally, Cloud SDK
|
13
|
-
credentials can also be discovered automatically, but this is only recommended
|
14
|
-
during development.
|
3
|
+
The recommended way to authenticate to the google-iam-credentials library is to use
|
4
|
+
[Application Default Credentials (ADC)](https://cloud.google.com/docs/authentication/application-default-credentials).
|
5
|
+
To review all of your authentication options, see [Credentials lookup](#credential-lookup).
|
15
6
|
|
16
7
|
## Quickstart
|
17
8
|
|
18
|
-
|
19
|
-
|
9
|
+
The following example shows how to set up authentication for a local development
|
10
|
+
environment with your user credentials.
|
20
11
|
|
21
|
-
|
22
|
-
|
23
|
-
```
|
24
|
-
|
25
|
-
3. Initialize the client.
|
12
|
+
**NOTE:** This method is _not_ recommended for running in production. User credentials
|
13
|
+
should be used only during development.
|
26
14
|
|
27
|
-
|
28
|
-
|
15
|
+
1. [Download and install the Google Cloud CLI](https://cloud.google.com/sdk).
|
16
|
+
2. Set up a local ADC file with your user credentials:
|
29
17
|
|
30
|
-
|
18
|
+
```sh
|
19
|
+
gcloud auth application-default login
|
31
20
|
```
|
32
21
|
|
33
|
-
|
34
|
-
|
35
|
-
The google-iam-credentials library aims to make authentication
|
36
|
-
as simple as possible, and provides several mechanisms to configure your system
|
37
|
-
without requiring **Service Account Credentials** directly in code.
|
38
|
-
|
39
|
-
**Credentials** are discovered in the following order:
|
40
|
-
|
41
|
-
1. Specify credentials in method arguments
|
42
|
-
2. Specify credentials in configuration
|
43
|
-
3. Discover credentials path in environment variables
|
44
|
-
4. Discover credentials JSON in environment variables
|
45
|
-
5. Discover credentials file in the Cloud SDK's path
|
46
|
-
6. Discover GCP credentials
|
47
|
-
|
48
|
-
### Google Cloud Platform environments
|
22
|
+
3. Write code as if already authenticated.
|
49
23
|
|
50
|
-
|
51
|
-
|
52
|
-
Functions (GCF) and Cloud Run, **Credentials** are discovered automatically.
|
53
|
-
Code should be written as if already authenticated.
|
24
|
+
For more information about setting up authentication for a local development environment, see
|
25
|
+
[Set up Application Default Credentials](https://cloud.google.com/docs/authentication/provide-credentials-adc#local-dev).
|
54
26
|
|
55
|
-
|
27
|
+
## Credential Lookup
|
56
28
|
|
57
|
-
The
|
58
|
-
|
59
|
-
|
60
|
-
|
61
|
-
**Credentials JSON** file can be stored in the environment variable, or the
|
62
|
-
**Credentials JSON** itself can be stored for environments such as Docker
|
63
|
-
containers where writing files is difficult or not encouraged.
|
29
|
+
The google-iam-credentials library provides several mechanisms to configure your system.
|
30
|
+
Generally, using Application Default Credentials to facilitate automatic
|
31
|
+
credentials discovery is the easist method. But if you need to explicitly specify
|
32
|
+
credentials, there are several methods available to you.
|
64
33
|
|
65
|
-
|
66
|
-
checks for credentials are configured on the service Credentials class (such as
|
67
|
-
`::Google::Iam::Credentials::V1::IAMCredentials::Credentials`):
|
34
|
+
Credentials are accepted in the following ways, in the following order or precedence:
|
68
35
|
|
69
|
-
|
70
|
-
|
71
|
-
|
72
|
-
|
73
|
-
|
36
|
+
1. Credentials specified in method arguments
|
37
|
+
2. Credentials specified in configuration
|
38
|
+
3. Credentials pointed to or included in environment variables
|
39
|
+
4. Credentials found in local ADC file
|
40
|
+
5. Credentials returned by the metadata server for the attached service account (GCP)
|
74
41
|
|
75
|
-
|
76
|
-
require "google/iam/credentials"
|
77
|
-
|
78
|
-
ENV["IAM_CREDENTIALS_CREDENTIALS"] = "path/to/keyfile.json"
|
42
|
+
### Configuration
|
79
43
|
|
80
|
-
client
|
81
|
-
|
44
|
+
You can configure a path to a JSON credentials file, either for an individual client object or
|
45
|
+
globally, for all client objects. The JSON file can contain credentials created for
|
46
|
+
[workload identity federation](https://cloud.google.com/iam/docs/workload-identity-federation),
|
47
|
+
[workforce identity federation](https://cloud.google.com/iam/docs/workforce-identity-federation), or a
|
48
|
+
[service account key](https://cloud.google.com/docs/authentication/provide-credentials-adc#local-key).
|
82
49
|
|
83
|
-
|
50
|
+
Note: Service account keys are a security risk if not managed correctly. You should
|
51
|
+
[choose a more secure alternative to service account keys](https://cloud.google.com/docs/authentication#auth-decision-tree)
|
52
|
+
whenever possible.
|
84
53
|
|
85
|
-
|
86
|
-
it in an environment variable. Either on an individual client initialization:
|
54
|
+
To configure a credentials file for an individual client initialization:
|
87
55
|
|
88
56
|
```ruby
|
89
57
|
require "google/iam/credentials"
|
90
58
|
|
91
59
|
client = Google::Iam::Credentials.iam_credentials do |config|
|
92
|
-
config.credentials = "path/to/
|
60
|
+
config.credentials = "path/to/credentialfile.json"
|
93
61
|
end
|
94
62
|
```
|
95
63
|
|
96
|
-
|
64
|
+
To configure a credentials file globally for all clients:
|
97
65
|
|
98
66
|
```ruby
|
99
67
|
require "google/iam/credentials"
|
100
68
|
|
101
69
|
Google::Iam::Credentials.configure do |config|
|
102
|
-
config.credentials = "path/to/
|
70
|
+
config.credentials = "path/to/credentialfile.json"
|
103
71
|
end
|
104
72
|
|
105
73
|
client = Google::Iam::Credentials.iam_credentials
|
106
74
|
```
|
107
75
|
|
108
|
-
###
|
76
|
+
### Environment Variables
|
109
77
|
|
110
|
-
|
111
|
-
|
112
|
-
|
78
|
+
You can also use an environment variable to provide a JSON credentials file.
|
79
|
+
The environment variable can contain a path to the credentials file or, for
|
80
|
+
environments such as Docker containers where writing files is not encouraged,
|
81
|
+
you can include the credentials file itself.
|
113
82
|
|
114
|
-
|
83
|
+
The JSON file can contain credentials created for
|
84
|
+
[workload identity federation](https://cloud.google.com/iam/docs/workload-identity-federation),
|
85
|
+
[workforce identity federation](https://cloud.google.com/iam/docs/workforce-identity-federation), or a
|
86
|
+
[service account key](https://cloud.google.com/docs/authentication/provide-credentials-adc#local-key).
|
115
87
|
|
116
|
-
|
117
|
-
|
118
|
-
|
88
|
+
Note: Service account keys are a security risk if not managed correctly. You should
|
89
|
+
[choose a more secure alternative to service account keys](https://cloud.google.com/docs/authentication#auth-decision-tree)
|
90
|
+
whenever possible.
|
91
|
+
|
92
|
+
The environment variables that google-iam-credentials
|
93
|
+
checks for credentials are:
|
119
94
|
|
120
|
-
|
121
|
-
*
|
95
|
+
* `GOOGLE_CLOUD_CREDENTIALS` - Path to JSON file, or JSON contents
|
96
|
+
* `GOOGLE_APPLICATION_CREDENTIALS` - Path to JSON file
|
122
97
|
|
123
|
-
|
98
|
+
```ruby
|
99
|
+
require "google/iam/credentials"
|
124
100
|
|
125
|
-
|
126
|
-
connect to the APIs. You will use the **JSON key file** to
|
127
|
-
connect to most services with google-iam-credentials.
|
101
|
+
ENV["GOOGLE_APPLICATION_CREDENTIALS"] = "path/to/credentialfile.json"
|
128
102
|
|
129
|
-
|
130
|
-
|
131
|
-
need a Google Developers service account.
|
103
|
+
client = Google::Iam::Credentials.iam_credentials
|
104
|
+
```
|
132
105
|
|
133
|
-
|
134
|
-
2. Create a new project or click on an existing project.
|
135
|
-
3. Activate the menu in the upper left and select **APIs & Services**. From
|
136
|
-
here, you will enable the APIs that your application requires.
|
106
|
+
### Local ADC file
|
137
107
|
|
138
|
-
|
108
|
+
You can set up a local ADC file with your user credentials for authentication during
|
109
|
+
development. If credentials are not provided in code or in environment variables,
|
110
|
+
then the local ADC credentials are discovered.
|
139
111
|
|
140
|
-
|
112
|
+
Follow the steps in [Quickstart](#quickstart) to set up a local ADC file.
|
141
113
|
|
142
|
-
|
143
|
-
"Service account" to be guided through downloading a new JSON key file.
|
114
|
+
### Google Cloud Platform environments
|
144
115
|
|
145
|
-
|
146
|
-
|
147
|
-
|
148
|
-
|
116
|
+
When running on Google Cloud Platform (GCP), including Google Compute Engine
|
117
|
+
(GCE), Google Kubernetes Engine (GKE), Google App Engine (GAE), Google Cloud
|
118
|
+
Functions (GCF) and Cloud Run, credentials are retrieved from the attached
|
119
|
+
service account automatically. Code should be written as if already authenticated.
|
149
120
|
|
150
|
-
|
151
|
-
|
121
|
+
For more information, see
|
122
|
+
[Set up ADC for Google Cloud services](https://cloud.google.com/docs/authentication/provide-credentials-adc#attached-sa).
|
data/README.md
CHANGED
@@ -16,7 +16,7 @@ for this library, google-iam-credentials, to see the convenience methods for
|
|
16
16
|
constructing client objects. Reference documentation for the client objects
|
17
17
|
themselves can be found in the client library documentation for the versioned
|
18
18
|
client gems:
|
19
|
-
[google-iam-credentials-v1](https://
|
19
|
+
[google-iam-credentials-v1](https://cloud.google.com/ruby/docs/reference/google-iam-credentials-v1/latest).
|
20
20
|
|
21
21
|
See also the [Product Documentation](https://cloud.google.com/iam)
|
22
22
|
for more usage information.
|
@@ -36,7 +36,7 @@ In order to use this library, you first need to go through the following steps:
|
|
36
36
|
|
37
37
|
## Supported Ruby Versions
|
38
38
|
|
39
|
-
This library is supported on Ruby 2.
|
39
|
+
This library is supported on Ruby 2.7+.
|
40
40
|
|
41
41
|
Google provides official support for Ruby versions that are actively supported
|
42
42
|
by Ruby Core—that is, Ruby versions that are either in normal maintenance or
|
@@ -31,7 +31,7 @@ module Google
|
|
31
31
|
# Create a new client object for IAMCredentials.
|
32
32
|
#
|
33
33
|
# By default, this returns an instance of
|
34
|
-
# [Google::Iam::Credentials::V1::IAMCredentials::Client](https://
|
34
|
+
# [Google::Iam::Credentials::V1::IAMCredentials::Client](https://cloud.google.com/ruby/docs/reference/google-iam-credentials-v1/latest/Google-Iam-Credentials-V1-IAMCredentials-Client)
|
35
35
|
# for a gRPC client for version V1 of the API.
|
36
36
|
# However, you can specify a different API version by passing it in the
|
37
37
|
# `version` parameter. If the IAMCredentials service is
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: google-iam-credentials
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 1.
|
4
|
+
version: 1.4.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Google LLC
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date:
|
11
|
+
date: 2024-02-26 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: google-cloud-core
|
@@ -30,7 +30,7 @@ dependencies:
|
|
30
30
|
requirements:
|
31
31
|
- - ">="
|
32
32
|
- !ruby/object:Gem::Version
|
33
|
-
version: '0.
|
33
|
+
version: '0.8'
|
34
34
|
- - "<"
|
35
35
|
- !ruby/object:Gem::Version
|
36
36
|
version: 2.a
|
@@ -40,122 +40,10 @@ dependencies:
|
|
40
40
|
requirements:
|
41
41
|
- - ">="
|
42
42
|
- !ruby/object:Gem::Version
|
43
|
-
version: '0.
|
43
|
+
version: '0.8'
|
44
44
|
- - "<"
|
45
45
|
- !ruby/object:Gem::Version
|
46
46
|
version: 2.a
|
47
|
-
- !ruby/object:Gem::Dependency
|
48
|
-
name: google-style
|
49
|
-
requirement: !ruby/object:Gem::Requirement
|
50
|
-
requirements:
|
51
|
-
- - "~>"
|
52
|
-
- !ruby/object:Gem::Version
|
53
|
-
version: 1.26.1
|
54
|
-
type: :development
|
55
|
-
prerelease: false
|
56
|
-
version_requirements: !ruby/object:Gem::Requirement
|
57
|
-
requirements:
|
58
|
-
- - "~>"
|
59
|
-
- !ruby/object:Gem::Version
|
60
|
-
version: 1.26.1
|
61
|
-
- !ruby/object:Gem::Dependency
|
62
|
-
name: minitest
|
63
|
-
requirement: !ruby/object:Gem::Requirement
|
64
|
-
requirements:
|
65
|
-
- - "~>"
|
66
|
-
- !ruby/object:Gem::Version
|
67
|
-
version: '5.16'
|
68
|
-
type: :development
|
69
|
-
prerelease: false
|
70
|
-
version_requirements: !ruby/object:Gem::Requirement
|
71
|
-
requirements:
|
72
|
-
- - "~>"
|
73
|
-
- !ruby/object:Gem::Version
|
74
|
-
version: '5.16'
|
75
|
-
- !ruby/object:Gem::Dependency
|
76
|
-
name: minitest-focus
|
77
|
-
requirement: !ruby/object:Gem::Requirement
|
78
|
-
requirements:
|
79
|
-
- - "~>"
|
80
|
-
- !ruby/object:Gem::Version
|
81
|
-
version: '1.1'
|
82
|
-
type: :development
|
83
|
-
prerelease: false
|
84
|
-
version_requirements: !ruby/object:Gem::Requirement
|
85
|
-
requirements:
|
86
|
-
- - "~>"
|
87
|
-
- !ruby/object:Gem::Version
|
88
|
-
version: '1.1'
|
89
|
-
- !ruby/object:Gem::Dependency
|
90
|
-
name: minitest-rg
|
91
|
-
requirement: !ruby/object:Gem::Requirement
|
92
|
-
requirements:
|
93
|
-
- - "~>"
|
94
|
-
- !ruby/object:Gem::Version
|
95
|
-
version: '5.2'
|
96
|
-
type: :development
|
97
|
-
prerelease: false
|
98
|
-
version_requirements: !ruby/object:Gem::Requirement
|
99
|
-
requirements:
|
100
|
-
- - "~>"
|
101
|
-
- !ruby/object:Gem::Version
|
102
|
-
version: '5.2'
|
103
|
-
- !ruby/object:Gem::Dependency
|
104
|
-
name: rake
|
105
|
-
requirement: !ruby/object:Gem::Requirement
|
106
|
-
requirements:
|
107
|
-
- - ">="
|
108
|
-
- !ruby/object:Gem::Version
|
109
|
-
version: '13.0'
|
110
|
-
type: :development
|
111
|
-
prerelease: false
|
112
|
-
version_requirements: !ruby/object:Gem::Requirement
|
113
|
-
requirements:
|
114
|
-
- - ">="
|
115
|
-
- !ruby/object:Gem::Version
|
116
|
-
version: '13.0'
|
117
|
-
- !ruby/object:Gem::Dependency
|
118
|
-
name: redcarpet
|
119
|
-
requirement: !ruby/object:Gem::Requirement
|
120
|
-
requirements:
|
121
|
-
- - "~>"
|
122
|
-
- !ruby/object:Gem::Version
|
123
|
-
version: '3.0'
|
124
|
-
type: :development
|
125
|
-
prerelease: false
|
126
|
-
version_requirements: !ruby/object:Gem::Requirement
|
127
|
-
requirements:
|
128
|
-
- - "~>"
|
129
|
-
- !ruby/object:Gem::Version
|
130
|
-
version: '3.0'
|
131
|
-
- !ruby/object:Gem::Dependency
|
132
|
-
name: simplecov
|
133
|
-
requirement: !ruby/object:Gem::Requirement
|
134
|
-
requirements:
|
135
|
-
- - "~>"
|
136
|
-
- !ruby/object:Gem::Version
|
137
|
-
version: '0.9'
|
138
|
-
type: :development
|
139
|
-
prerelease: false
|
140
|
-
version_requirements: !ruby/object:Gem::Requirement
|
141
|
-
requirements:
|
142
|
-
- - "~>"
|
143
|
-
- !ruby/object:Gem::Version
|
144
|
-
version: '0.9'
|
145
|
-
- !ruby/object:Gem::Dependency
|
146
|
-
name: yard
|
147
|
-
requirement: !ruby/object:Gem::Requirement
|
148
|
-
requirements:
|
149
|
-
- - "~>"
|
150
|
-
- !ruby/object:Gem::Version
|
151
|
-
version: '0.9'
|
152
|
-
type: :development
|
153
|
-
prerelease: false
|
154
|
-
version_requirements: !ruby/object:Gem::Requirement
|
155
|
-
requirements:
|
156
|
-
- - "~>"
|
157
|
-
- !ruby/object:Gem::Version
|
158
|
-
version: '0.9'
|
159
47
|
description: The Service Account Credentials API creates short-lived credentials for
|
160
48
|
Identity and Access Management (IAM) service accounts. You can also use this API
|
161
49
|
to sign JSON Web Tokens (JWTs), as well as blobs of binary data that contain other
|
@@ -184,14 +72,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
|
|
184
72
|
requirements:
|
185
73
|
- - ">="
|
186
74
|
- !ruby/object:Gem::Version
|
187
|
-
version: '2.
|
75
|
+
version: '2.7'
|
188
76
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
189
77
|
requirements:
|
190
78
|
- - ">="
|
191
79
|
- !ruby/object:Gem::Version
|
192
80
|
version: '0'
|
193
81
|
requirements: []
|
194
|
-
rubygems_version: 3.
|
82
|
+
rubygems_version: 3.5.6
|
195
83
|
signing_key:
|
196
84
|
specification_version: 4
|
197
85
|
summary: API Client library for the IAM Service Account Credentials API
|