googleauth 1.5.1 → 1.5.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 553d9c5927ca82c62dafc3a90529029ffd7813d99a9ae4ae146ae27370beb631
-  data.tar.gz: 55b33ba8e1ea2cf72f1f0c6c3c356ca825a4d575d8ac5665dc038118fc635198
+  metadata.gz: cc7032e8f5f0a060f621bd405feccbea08b70b5a8ed7a3d33676ddf1926160a7
+  data.tar.gz: 23a199f6a6333ed269c8f564a028533802450c3e7cb100debf5e7e8d940dc8b3
 SHA512:
-  metadata.gz: 73a897d4813f5f016b252a299d126535fa32f017aa40ac7ac67200bef1332696298e2e082c279c3b8b850ca1d93d46f8a56f75d5c3ab408c33db391572944af7
-  data.tar.gz: b0d137864100e7e16ae1bac0b22ca7b2b09b5a9724692ed794170dbd712bc16b6ef00ad0913c47620d6df3e7324ce5a54484e2e4f9dfe06f999ebbeffd3c6007
+  metadata.gz: 8b2142a0bdeffd451c3f98c97c8414b26a63939dcd5b4430cb9299b3f1ecdf12d8cc39b8cf813531034dc63121764600c386b372ffe819fdd202c51b070acef2
+  data.tar.gz: 56e4c86362466b27ad68ec388138fb469b44e604aa60f40454f7499210f61c16e19e559ecd9358023a9de74a8f21289410f5855e128598ac1206c341c328997d

data/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Release History
 
+### 1.5.2 (2023-04-13)
+
+#### Bug Fixes
+
+* AWS IMDSV2 session token fetching shall call PUT method instead of GET ([#429](https://github.com/googleapis/google-auth-library-ruby/issues/429)) 
+* GCECredentials - Allow retrieval of ID token ([#425](https://github.com/googleapis/google-auth-library-ruby/issues/425)) 
+
 ### 1.5.1 (2023-04-10)
 
 #### Bug Fixes

data/lib/googleauth/application_default.rb

@@ -60,7 +60,7 @@ module Google
         GCECredentials.unmemoize_all
         raise NOT_FOUND_ERROR
       end
-      GCECredentials.new scope: scope
+      GCECredentials.new options.merge(scope: scope)
     end
   end
 end

data/lib/googleauth/external_account/aws_credentials.rb

@@ -16,16 +16,16 @@ require "time"
 require "googleauth/external_account/base_credentials"
 
 module Google
-  # Module Auth provides classes that provide Google-specific authorization
-  # used to access Google APIs.
+  # Module Auth provides classes that provide Google-specific authorization used to access Google APIs.
   module Auth
-    # Authenticates requests using External Account credentials, such
-    # as those provided by the AWS provider.
+    # Authenticates requests using External Account credentials, such as those provided by the AWS provider.
     module ExternalAccount
-      # This module handles the retrieval of credentials from Google Cloud
-      # by utilizing the AWS EC2 metadata service and then exchanging the
-      # credentials for a short-lived Google Cloud access token.
+      # This module handles the retrieval of credentials from Google Cloud by utilizing the AWS EC2 metadata service and
+      # then exchanging the credentials for a short-lived Google Cloud access token.
       class AwsCredentials
+        # Constant for imdsv2 session token expiration in seconds
+        IMDSV2_TOKEN_EXPIRATION_IN_SECONDS = 300
+
         include Google::Auth::ExternalAccount::BaseCredentials
         extend CredentialsLoader
 
@@ -46,6 +46,8 @@ module Google
           # These will be lazily loaded when needed, or will raise an error if not provided
           @region = nil
           @request_signer = nil
+          @imdsv2_session_token = nil
+          @imdsv2_session_token_expiry = nil
         end
 
         # Retrieves the subject token using the credential_source object.
@@ -54,22 +56,20 @@ module Google
         #
         # The logic is summarized as:
         #
-        # Retrieve the AWS region from the AWS_REGION or AWS_DEFAULT_REGION
-        # environment variable or from the AWS metadata server availability-zone
-        # if not found in the environment variable.
+        # Retrieve the AWS region from the AWS_REGION or AWS_DEFAULT_REGION environment variable or from the AWS
+        # metadata server availability-zone if not found in the environment variable.
         #
-        # Check AWS credentials in environment variables. If not found, retrieve
-        # from the AWS metadata server security-credentials endpoint.
+        # Check AWS credentials in environment variables. If not found, retrieve from the AWS metadata server
+        # security-credentials endpoint.
         #
-        # When retrieving AWS credentials from the metadata server
-        # security-credentials endpoint, the AWS role needs to be determined by
-        # calling the security-credentials endpoint without any argument. Then the
-        # credentials can be retrieved via: security-credentials/role_name
+        # When retrieving AWS credentials from the metadata server security-credentials endpoint, the AWS role needs to
+        # be determined by # calling the security-credentials endpoint without any argument.
+        # Then the credentials can be retrieved via: security-credentials/role_name
         #
         # Generate the signed request to AWS STS GetCallerIdentity action.
         #
-        # Inject x-goog-cloud-target-resource into header and serialize the
-        # signed request. This will be the subject-token to pass to GCP STS.
+        # Inject x-goog-cloud-target-resource into header and serialize the signed request.
+        # This will be the subject-token to pass to GCP STS.
         #
         # @return [string] The retrieved subject token.
         #
@@ -104,16 +104,30 @@ module Google
 
         private
 
-        def get_aws_resource url, name, data: nil, headers: {}
+        def imdsv2_session_token
+          return @imdsv2_session_token unless imdsv2_session_token_invalid?
+          raise "IMDSV2 token url must be provided" if @imdsv2_session_token_url.nil?
           begin
-            unless [nil, url].include? @imdsv2_session_token_url
-              headers["x-aws-ec2-metadata-token"] = get_aws_resource(
-                @imdsv2_session_token_url,
-                "Session Token",
-                headers: { "x-aws-ec2-metadata-token-ttl-seconds": "300" }
-              ).body
+            response = connection.put @imdsv2_session_token_url do |req|
+              req.headers["x-aws-ec2-metadata-token-ttl-seconds"] = IMDSV2_TOKEN_EXPIRATION_IN_SECONDS.to_s
             end
+          rescue Faraday::Error => e
+            raise "Fetching AWS IMDSV2 token error: #{e}"
+          end
+          raise Faraday::Error unless response.success?
+          @imdsv2_session_token = response.body
+          @imdsv2_session_token_expiry = Time.now + IMDSV2_TOKEN_EXPIRATION_IN_SECONDS
+          @imdsv2_session_token
+        end
 
+        def imdsv2_session_token_invalid?
+          return true if @imdsv2_session_token.nil?
+          @imdsv2_session_token_expiry.nil? || @imdsv2_session_token_expiry < Time.now
+        end
+
+        def get_aws_resource url, name, data: nil, headers: {}
+          begin
+            headers["x-aws-ec2-metadata-token"] = imdsv2_session_token
             response = if data
                          headers["Content-Type"] = "application/json"
                          connection.post url, data, headers
@@ -136,9 +150,8 @@ module Google
           end
         end
 
-        # Retrieves the AWS security credentials required for signing AWS
-        # requests from either the AWS security credentials environment variables
-        # or from the AWS metadata server.
+        # Retrieves the AWS security credentials required for signing AWS requests from either the AWS security
+        # credentials environment variables or from the AWS metadata server.
         def fetch_security_credentials
           env_aws_access_key_id = ENV[CredentialsLoader::AWS_ACCESS_KEY_ID_VAR]
           env_aws_secret_access_key = ENV[CredentialsLoader::AWS_SECRET_ACCESS_KEY_VAR]
@@ -163,10 +176,9 @@ module Google
           }
         end
 
-        # Retrieves the AWS role currently attached to the current AWS
-        # workload by querying the AWS metadata server. This is needed for the
-        # AWS metadata server security credentials endpoint in order to retrieve
-        # the AWS security credentials needed to sign requests to AWS APIs.
+        # Retrieves the AWS role currently attached to the current AWS workload by querying the AWS metadata server.
+        # This is needed for the AWS metadata server security credentials endpoint in order to retrieve the AWS security
+        # credentials needed to sign requests to AWS APIs.
         def fetch_metadata_role_name
           unless @credential_verification_url
             raise "Unable to determine the AWS metadata server security credentials endpoint"
@@ -175,8 +187,7 @@ module Google
           get_aws_resource(@credential_verification_url, "IAM Role").body
         end
 
-        # Retrieves the AWS security credentials required for signing AWS
-        # requests from the AWS metadata server.
+        # Retrieves the AWS security credentials required for signing AWS requests from the AWS metadata server.
         def fetch_metadata_security_credentials role_name
           response = get_aws_resource "#{@credential_verification_url}/#{role_name}", "credentials"
           MultiJson.load response.body
@@ -198,8 +209,8 @@ module Google
       # Implements an AWS request signer based on the AWS Signature Version 4 signing process.
       # https://docs.aws.amazon.com/general/latest/gr/signature-version-4.html
       class AwsRequestSigner
-        # Instantiates an AWS request signer used to compute authenticated signed
-        # requests to AWS APIs based on the AWS Signature Version 4 signing process.
+        # Instantiates an AWS request signer used to compute authenticated signed requests to AWS APIs based on the AWS
+        # Signature Version 4 signing process.
         #
         # @param [string] region_name
         #     The AWS region to use.

data/lib/googleauth/external_account/base_credentials.rb

@@ -101,7 +101,7 @@ module Google
           end
 
           if response.status == 200
-            response_data = MultiJson.load response.body
+            response_data = MultiJson.load response.body, symbolize_names: true
             @project_id = response_data[:projectId]
           end
 

data/lib/googleauth/version.rb

@@ -16,6 +16,6 @@ module Google
   # Module Auth provides classes that provide Google-specific authorization
   # used to access Google APIs.
   module Auth
-    VERSION = "1.5.1".freeze
+    VERSION = "1.5.2".freeze
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: googleauth
 version: !ruby/object:Gem::Version
-  version: 1.5.1
+  version: 1.5.2
 platform: ruby
 authors:
 - Tim Emiola
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-04-10 00:00:00.000000000 Z
+date: 2023-04-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday