googleauth 1.15.1 → 1.16.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4b360d5a61b05e86f04c2eab04af61b421ffc5c2e1f6833741d59d9c96d94a19
-  data.tar.gz: 8727a84fa541a8e6a2abeb0544d4608d32d1e205a0d9371e695b079fb8d3fa0a
+  metadata.gz: 4cadf68940056f975d386c6cb0cc55b4e1dcebb72a0313a5a5b58347994fa9dd
+  data.tar.gz: cad38a2d2014e88abda0e63092786302294c2e963a4e4fca56a681ec7f84f08b
 SHA512:
-  metadata.gz: 262a5af69278586d4a13e8776b7fd5c627591aa8434585ea3a80f6e24035e4c78498f02f236fb84b63b7c59ef23e4021f2f21aa5dcf49c5bf46a9a9bb80b66c9
-  data.tar.gz: 9356b779fbb2340328a55850ce434957715d50accb842d24a4233bdb7ce532b49c564d63a068c087439e9cd75d9dc3bfff7b17205cb30f811ddb0d3b0567e101
+  metadata.gz: 195efa15c10d767d5ab032291d1c341e760e9bbf326f025f705595e09e6f122f18d582a185ca6c1604a710b8facc11b37cb02e04664b4ba2488b8a85e2318f47
+  data.tar.gz: ce881af766994bd312208a9531da24a92efa6f3311abae02cda4f7c1b1d303f54d765b571574745d0cc61cd35e8cc9ceccfdc39a8d9d5368dad6e18f6dbcbd3d

data/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Release History
 
+### 1.16.0 (2025-11-21)
+
+#### Features
+
+* Add ADC support for impersonated credentials ([#547](https://github.com/googleapis/google-auth-library-ruby/issues/547)) 
+#### Bug Fixes
+
+* Include security warning in ExternalAccount and ImpersonatedServiceAccount credentials ([#551](https://github.com/googleapis/google-auth-library-ruby/issues/551)) 
+
 ### 1.15.1 (2025-10-14)
 
 #### Bug Fixes

data/Credentials.md

@@ -66,7 +66,7 @@ that exposes common initialization functionality, such as creating credentials f
    - Allows a GCP principal identified by a set of source credentials to impersonate a service account
    - Useful for delegation of authority and managing permissions across service accounts
    - Source credentials must have the Service Account Token Creator role on the target
-   - This credential type does not have a supported JSON form
+   - This credential type supports JSON configuration. The JSON form of this credential type has a `"type"` field with the value `"impersonated_service_account"`.
 
 ## User Authentication
 

data/README.md

@@ -292,5 +292,4 @@ hesitate to
 about the client or APIs on [StackOverflow](http://stackoverflow.com).
 
 [application default credentials]: https://cloud.google.com/docs/authentication/provide-credentials-adc
-[contributing]: https://github.com/googleapis/google-auth-library-ruby/tree/main/.github/CONTRIBUTING.md
 [license]: https://github.com/googleapis/google-auth-library-ruby/tree/main/LICENSE

data/lib/googleauth/default_credentials.rb

@@ -21,6 +21,7 @@ require "googleauth/external_account"
 require "googleauth/service_account"
 require "googleauth/service_account_jwt_header"
 require "googleauth/user_refresh"
+require "googleauth/impersonated_service_account"
 
 module Google
   # Module Auth provides classes that provide Google-specific authorization
@@ -114,6 +115,8 @@ module Google
                 UserRefreshCredentials
               when ExternalAccount::Credentials::CREDENTIAL_TYPE_NAME
                 ExternalAccount::Credentials
+              when ImpersonatedServiceAccountCredentials::CREDENTIAL_TYPE_NAME
+                ImpersonatedServiceAccountCredentials
               else
                 raise InitializationError, "credentials type '#{type}' is not supported"
               end

data/lib/googleauth/external_account.rb

@@ -40,6 +40,15 @@ module Google
 
         # Create a ExternalAccount::Credentials
         #
+        # @note Warning:
+        # This method does not validate the credential configuration. A security
+        # risk occurs when a credential configuration configured with malicious urls
+        # is used.
+        # When the credential configuration is accepted from an
+        # untrusted source, you should validate it before using with this method.
+        # See https://cloud.google.com/docs/authentication/external/externally-sourced-credentials
+        # for more details.
+        #
         # @param options [Hash] Options for creating credentials
         # @option options [IO] :json_key_io (required) An IO object containing the JSON key
         # @option options [String,Array,nil] :scope The scope(s) to access

data/lib/googleauth/impersonated_service_account.rb

@@ -23,6 +23,9 @@ module Google
     # and then that claim is exchanged for a short-lived token at an IAMCredentials endpoint.
     # The short-lived token and its expiration time are cached.
     class ImpersonatedServiceAccountCredentials
+      # @private
+      CREDENTIAL_TYPE_NAME = "impersonated_service_account".freeze
+
       # @private
       ERROR_SUFFIX = <<~ERROR.freeze
         when trying to get security access token
@@ -69,6 +72,15 @@ module Google
       # and request short-lived credentials for a service account
       # that has the authorization that your use case requires.
       #
+      # @note Warning:
+      # This method does not validate the credential configuration. A security
+      # risk occurs when a credential configuration configured with malicious urls
+      # is used.
+      # When the credential configuration is accepted from an
+      # untrusted source, you should validate it before using with this method.
+      # See https://cloud.google.com/docs/authentication/external/externally-sourced-credentials
+      # for more details.
+      #
       # @param options [Hash] A hash of options to configure the credentials.
       # @option options [Object] :base_credentials (required) The authenticated principal.
       #   It will be used as following:
@@ -84,11 +96,50 @@ module Google
       #   defining the permissions required for the token.
       # @option options [Object] :source_credentials The authenticated principal that will be used
       #   to fetch the short-lived impersonation access token. It is an alternative to providing the base credentials.
+      # @option options [IO] :json_key_io The IO object that contains the credential configuration.
+      #   It is exclusive with `:base_credentials` and `:source_credentials` options.
       #
       # @return [Google::Auth::ImpersonatedServiceAccountCredentials]
       def self.make_creds options = {}
-        new options
+        if options[:json_key_io]
+          make_creds_from_json options
+        else
+          new options
+        end
+      end
+
+      # @private
+      def self.make_creds_from_json options
+        json_key_io = options[:json_key_io]
+        if options[:base_credentials] || options[:source_credentials]
+          raise Google::Auth::InitializationError,
+                "json_key_io is not compatible with base_credentials or source_credentials"
+        end
+
+        require "googleauth/default_credentials"
+        impersonated_json = MultiJson.load json_key_io.read
+        source_credentials_info = impersonated_json["source_credentials"]
+
+        if source_credentials_info["type"] == CREDENTIAL_TYPE_NAME
+          raise Google::Auth::InitializationError,
+                "Source credentials can't be of type impersonated_service_account, " \
+                "use delegates to chain impersonation."
+        end
+
+        source_credentials = DefaultCredentials.make_creds(
+          json_key_io: StringIO.new(MultiJson.dump(source_credentials_info))
+        )
+
+        impersonation_url = impersonated_json["service_account_impersonation_url"]
+        scope = options[:scope] || impersonated_json["scopes"]
+
+        new(
+          source_credentials: source_credentials,
+          impersonation_url:  impersonation_url,
+          scope:              scope
+        )
       end
+      private_class_method :make_creds_from_json
 
       # Initializes a new instance of ImpersonatedServiceAccountCredentials.
       #
@@ -105,6 +156,7 @@ module Google
       #     - `{source_sa_email}` is the email address of the service account to impersonate.
       # @option options [Array<String>, String] :scope (required) The scope(s) for the short-lived impersonation token,
       #   defining the permissions required for the token.
+      #   It will override the scope from the `json_key_io` file if provided.
       # @option options [Object] :source_credentials The authenticated principal that will be used
       #   to fetch the short-lived impersonation access token. It is an alternative to providing the base credentials.
       #   It is redundant to provide both source and base credentials as only source will be used,

data/lib/googleauth/version.rb

@@ -16,6 +16,6 @@ module Google
   # Module Auth provides classes that provide Google-specific authorization
   # used to access Google APIs.
   module Auth
-    VERSION = "1.15.1".freeze
+    VERSION = "1.16.0".freeze
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: googleauth
 version: !ruby/object:Gem::Version
-  version: 1.15.1
+  version: 1.16.0
 platform: ruby
 authors:
 - Google LLC