com.google.auth.oauth2.ServiceAccountCredentials Maven / Gradle / Ivy
/*
* Copyright 2015, Google Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are
* met:
*
* * Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above
* copyright notice, this list of conditions and the following disclaimer
* in the documentation and/or other materials provided with the
* distribution.
*
* * Neither the name of Google Inc. nor the names of its
* contributors may be used to endorse or promote products derived from
* this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
package com.google.auth.oauth2;
import static com.google.common.base.MoreObjects.firstNonNull;
import com.google.api.client.http.GenericUrl;
import com.google.api.client.http.HttpBackOffIOExceptionHandler;
import com.google.api.client.http.HttpBackOffUnsuccessfulResponseHandler;
import com.google.api.client.http.HttpContent;
import com.google.api.client.http.HttpHeaders;
import com.google.api.client.http.HttpRequest;
import com.google.api.client.http.HttpRequestFactory;
import com.google.api.client.http.HttpResponse;
import com.google.api.client.http.HttpResponseException;
import com.google.api.client.http.UrlEncodedContent;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.JsonObjectParser;
import com.google.api.client.json.webtoken.JsonWebSignature;
import com.google.api.client.json.webtoken.JsonWebToken;
import com.google.api.client.util.ExponentialBackOff;
import com.google.api.client.util.GenericData;
import com.google.api.client.util.Joiner;
import com.google.api.client.util.Preconditions;
import com.google.auth.Credentials;
import com.google.auth.RequestMetadataCallback;
import com.google.auth.ServiceAccountSigner;
import com.google.auth.http.AuthHttpConstants;
import com.google.auth.http.HttpTransportFactory;
import com.google.common.annotations.VisibleForTesting;
import com.google.common.base.MoreObjects.ToStringHelper;
import com.google.common.collect.ImmutableList;
import com.google.common.collect.ImmutableMap;
import com.google.common.collect.ImmutableSet;
import com.google.errorprone.annotations.CanIgnoreReturnValue;
import java.io.IOException;
import java.io.InputStream;
import java.io.ObjectInputStream;
import java.net.URI;
import java.net.URISyntaxException;
import java.security.GeneralSecurityException;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.security.PrivateKey;
import java.security.Signature;
import java.security.SignatureException;
import java.util.Collection;
import java.util.Collections;
import java.util.Date;
import java.util.List;
import java.util.Map;
import java.util.Objects;
import java.util.concurrent.Executor;
/**
* OAuth2 credentials representing a Service Account for calling Google APIs.
*
* By default uses a JSON Web Token (JWT) to fetch access tokens.
*/
public class ServiceAccountCredentials extends GoogleCredentials
implements ServiceAccountSigner, IdTokenProvider, JwtProvider {
private static final long serialVersionUID = 7807543542681217978L;
private static final String GRANT_TYPE = "urn:ietf:params:oauth:grant-type:jwt-bearer";
private static final String PARSE_ERROR_PREFIX = "Error parsing token refresh response. ";
private static final int TWELVE_HOURS_IN_SECONDS = 43200;
private static final int DEFAULT_LIFETIME_IN_SECONDS = 3600;
private final String clientId;
private final String clientEmail;
private final PrivateKey privateKey;
private final String privateKeyId;
private final String serviceAccountUser;
private final String projectId;
private final String transportFactoryClassName;
private final URI tokenServerUri;
private final Collection scopes;
private final Collection defaultScopes;
private final int lifetime;
private final boolean useJwtAccessWithScope;
private final boolean defaultRetriesEnabled;
private transient HttpTransportFactory transportFactory;
private transient JwtCredentials selfSignedJwtCredentialsWithScope = null;
/**
* Internal constructor
*
* @param builder A builder for {@link ServiceAccountCredentials} See {@link
* ServiceAccountCredentials.Builder}
*/
ServiceAccountCredentials(ServiceAccountCredentials.Builder builder) {
super(builder);
this.clientId = builder.clientId;
this.clientEmail = Preconditions.checkNotNull(builder.clientEmail);
this.privateKey = Preconditions.checkNotNull(builder.privateKey);
this.privateKeyId = builder.privateKeyId;
this.scopes =
(builder.scopes == null) ? ImmutableSet.of() : ImmutableSet.copyOf(builder.scopes);
this.defaultScopes =
(builder.defaultScopes == null)
? ImmutableSet.of()
: ImmutableSet.copyOf(builder.defaultScopes);
this.transportFactory =
firstNonNull(
builder.transportFactory,
getFromServiceLoader(HttpTransportFactory.class, OAuth2Utils.HTTP_TRANSPORT_FACTORY));
this.transportFactoryClassName = this.transportFactory.getClass().getName();
this.tokenServerUri =
(builder.tokenServerUri == null) ? OAuth2Utils.TOKEN_SERVER_URI : builder.tokenServerUri;
this.serviceAccountUser = builder.serviceAccountUser;
this.projectId = builder.projectId;
if (builder.lifetime > TWELVE_HOURS_IN_SECONDS) {
throw new IllegalStateException("lifetime must be less than or equal to 43200");
}
this.lifetime = builder.lifetime;
this.useJwtAccessWithScope = builder.useJwtAccessWithScope;
this.defaultRetriesEnabled = builder.defaultRetriesEnabled;
}
/**
* Returns service account credentials defined by JSON using the format supported by the Google
* Developers Console.
*
* @param json a map from the JSON representing the credentials.
* @param transportFactory HTTP transport factory, creates the transport used to get access
* tokens.
* @return the credentials defined by the JSON.
* @throws IOException if the credential cannot be created from the JSON.
*/
static ServiceAccountCredentials fromJson(
Map json, HttpTransportFactory transportFactory) throws IOException {
String clientId = (String) json.get("client_id");
String clientEmail = (String) json.get("client_email");
String privateKeyPkcs8 = (String) json.get("private_key");
String privateKeyId = (String) json.get("private_key_id");
String projectId = (String) json.get("project_id");
String tokenServerUriStringFromCreds = (String) json.get("token_uri");
String quotaProjectId = (String) json.get("quota_project_id");
String universeDomain = (String) json.get("universe_domain");
URI tokenServerUriFromCreds = null;
try {
if (tokenServerUriStringFromCreds != null) {
tokenServerUriFromCreds = new URI(tokenServerUriStringFromCreds);
}
} catch (URISyntaxException e) {
throw new IOException("Token server URI specified in 'token_uri' could not be parsed.");
}
if (clientId == null
|| clientEmail == null
|| privateKeyPkcs8 == null
|| privateKeyId == null) {
throw new IOException(
"Error reading service account credential from JSON, "
+ "expecting 'client_id', 'client_email', 'private_key' and 'private_key_id'.");
}
ServiceAccountCredentials.Builder builder =
ServiceAccountCredentials.newBuilder()
.setClientId(clientId)
.setClientEmail(clientEmail)
.setPrivateKeyId(privateKeyId)
.setHttpTransportFactory(transportFactory)
.setTokenServerUri(tokenServerUriFromCreds)
.setProjectId(projectId)
.setQuotaProjectId(quotaProjectId)
.setUniverseDomain(universeDomain);
return fromPkcs8(privateKeyPkcs8, builder);
}
/**
* Factory with minimum identifying information using PKCS#8 for the private key.
*
* @param clientId Client ID of the service account from the console. May be null.
* @param clientEmail Client email address of the service account from the console.
* @param privateKeyPkcs8 RSA private key object for the service account in PKCS#8 format.
* @param privateKeyId Private key identifier for the service account. May be null.
* @param scopes Scope strings for the APIs to be called. May be null or an empty collection,
* which results in a credential that must have createScoped called before use.
* @return New ServiceAccountCredentials created from a private key.
* @throws IOException if the credential cannot be created from the private key.
*/
public static ServiceAccountCredentials fromPkcs8(
String clientId,
String clientEmail,
String privateKeyPkcs8,
String privateKeyId,
Collection scopes)
throws IOException {
ServiceAccountCredentials.Builder builder =
ServiceAccountCredentials.newBuilder()
.setClientId(clientId)
.setClientEmail(clientEmail)
.setPrivateKeyId(privateKeyId)
.setScopes(scopes);
return fromPkcs8(privateKeyPkcs8, builder);
}
/**
* Factory with minimum identifying information using PKCS#8 for the private key.
*
* @param clientId client ID of the service account from the console. May be null.
* @param clientEmail client email address of the service account from the console
* @param privateKeyPkcs8 RSA private key object for the service account in PKCS#8 format.
* @param privateKeyId private key identifier for the service account. May be null.
* @param scopes scope strings for the APIs to be called. May be null or an empty collection.
* @param defaultScopes default scope strings for the APIs to be called. May be null or an empty.
* @return new ServiceAccountCredentials created from a private key
* @throws IOException if the credential cannot be created from the private key
*/
public static ServiceAccountCredentials fromPkcs8(
String clientId,
String clientEmail,
String privateKeyPkcs8,
String privateKeyId,
Collection scopes,
Collection defaultScopes)
throws IOException {
ServiceAccountCredentials.Builder builder =
ServiceAccountCredentials.newBuilder()
.setClientId(clientId)
.setClientEmail(clientEmail)
.setPrivateKeyId(privateKeyId)
.setScopes(scopes, defaultScopes);
return fromPkcs8(privateKeyPkcs8, builder);
}
/**
* Factory with minimum identifying information and custom transport using PKCS#8 for the private
* key.
*
* @param clientId Client ID of the service account from the console. May be null.
* @param clientEmail Client email address of the service account from the console.
* @param privateKeyPkcs8 RSA private key object for the service account in PKCS#8 format.
* @param privateKeyId Private key identifier for the service account. May be null.
* @param scopes Scope strings for the APIs to be called. May be null or an empty collection,
* which results in a credential that must have createScoped called before use.
* @param transportFactory HTTP transport factory, creates the transport used to get access
* tokens.
* @param tokenServerUri URI of the end point that provides tokens.
* @return New ServiceAccountCredentials created from a private key.
* @throws IOException if the credential cannot be created from the private key.
*/
public static ServiceAccountCredentials fromPkcs8(
String clientId,
String clientEmail,
String privateKeyPkcs8,
String privateKeyId,
Collection scopes,
HttpTransportFactory transportFactory,
URI tokenServerUri)
throws IOException {
ServiceAccountCredentials.Builder builder =
ServiceAccountCredentials.newBuilder()
.setClientId(clientId)
.setClientEmail(clientEmail)
.setPrivateKeyId(privateKeyId)
.setScopes(scopes)
.setHttpTransportFactory(transportFactory)
.setTokenServerUri(tokenServerUri);
return fromPkcs8(privateKeyPkcs8, builder);
}
/**
* Factory with minimum identifying information and custom transport using PKCS#8 for the private
* key.
*
* @param clientId client ID of the service account from the console. May be null.
* @param clientEmail client email address of the service account from the console
* @param privateKeyPkcs8 RSA private key object for the service account in PKCS#8 format.
* @param privateKeyId private key identifier for the service account. May be null.
* @param scopes scope strings for the APIs to be called. May be null or an empty collection,
* which results in a credential that must have createScoped called before use.
* @param defaultScopes default scope strings for the APIs to be called. May be null or an empty
* collection, which results in a credential that must have createScoped called before use.
* @param transportFactory HTTP transport factory, creates the transport used to get access
* tokens.
* @param tokenServerUri URI of the end point that provides tokens
* @return new ServiceAccountCredentials created from a private key
* @throws IOException if the credential cannot be created from the private key
*/
public static ServiceAccountCredentials fromPkcs8(
String clientId,
String clientEmail,
String privateKeyPkcs8,
String privateKeyId,
Collection scopes,
Collection defaultScopes,
HttpTransportFactory transportFactory,
URI tokenServerUri)
throws IOException {
ServiceAccountCredentials.Builder builder =
ServiceAccountCredentials.newBuilder()
.setClientId(clientId)
.setClientEmail(clientEmail)
.setPrivateKeyId(privateKeyId)
.setScopes(scopes, defaultScopes)
.setHttpTransportFactory(transportFactory)
.setTokenServerUri(tokenServerUri);
return fromPkcs8(privateKeyPkcs8, builder);
}
/**
* Factory with minimum identifying information and custom transport using PKCS#8 for the private
* key.
*
* @param clientId Client ID of the service account from the console. May be null.
* @param clientEmail Client email address of the service account from the console.
* @param privateKeyPkcs8 RSA private key object for the service account in PKCS#8 format.
* @param privateKeyId Private key identifier for the service account. May be null.
* @param scopes Scope strings for the APIs to be called. May be null or an empty collection,
* which results in a credential that must have createScoped called before use.
* @param transportFactory HTTP transport factory, creates the transport used to get access
* tokens.
* @param tokenServerUri URI of the end point that provides tokens.
* @param serviceAccountUser The email of the user account to impersonate, if delegating
* domain-wide authority to the service account.
* @return New ServiceAccountCredentials created from a private key.
* @throws IOException if the credential cannot be created from the private key.
*/
public static ServiceAccountCredentials fromPkcs8(
String clientId,
String clientEmail,
String privateKeyPkcs8,
String privateKeyId,
Collection scopes,
HttpTransportFactory transportFactory,
URI tokenServerUri,
String serviceAccountUser)
throws IOException {
ServiceAccountCredentials.Builder builder =
ServiceAccountCredentials.newBuilder()
.setClientId(clientId)
.setClientEmail(clientEmail)
.setPrivateKeyId(privateKeyId)
.setScopes(scopes)
.setHttpTransportFactory(transportFactory)
.setTokenServerUri(tokenServerUri)
.setServiceAccountUser(serviceAccountUser);
return fromPkcs8(privateKeyPkcs8, builder);
}
/**
* Factory with minimum identifying information and custom transport using PKCS#8 for the private
* key.
*
* @param clientId client ID of the service account from the console. May be null.
* @param clientEmail client email address of the service account from the console
* @param privateKeyPkcs8 RSA private key object for the service account in PKCS#8 format.
* @param privateKeyId private key identifier for the service account. May be null.
* @param scopes scope strings for the APIs to be called. May be null or an empty collection,
* which results in a credential that must have createScoped called before use.
* @param defaultScopes default scope strings for the APIs to be called. May be null or an empty
* collection, which results in a credential that must have createScoped called before use.
* @param transportFactory HTTP transport factory, creates the transport used to get access
* tokens.
* @param tokenServerUri URI of the end point that provides tokens
* @param serviceAccountUser the email of the user account to impersonate, if delegating
* domain-wide authority to the service account.
* @return new ServiceAccountCredentials created from a private key
* @throws IOException if the credential cannot be created from the private key
*/
public static ServiceAccountCredentials fromPkcs8(
String clientId,
String clientEmail,
String privateKeyPkcs8,
String privateKeyId,
Collection scopes,
Collection defaultScopes,
HttpTransportFactory transportFactory,
URI tokenServerUri,
String serviceAccountUser)
throws IOException {
ServiceAccountCredentials.Builder builder =
ServiceAccountCredentials.newBuilder()
.setClientId(clientId)
.setClientEmail(clientEmail)
.setPrivateKeyId(privateKeyId)
.setScopes(scopes, defaultScopes)
.setHttpTransportFactory(transportFactory)
.setTokenServerUri(tokenServerUri)
.setServiceAccountUser(serviceAccountUser);
return fromPkcs8(privateKeyPkcs8, builder);
}
/**
* Internal constructor
*
* @param privateKeyPkcs8 RSA private key object for the service account in PKCS#8 format.
* @param builder A builder for {@link ServiceAccountCredentials} See {@link
* ServiceAccountCredentials.Builder}
* @return an instance of {@link ServiceAccountCredentials}
*/
static ServiceAccountCredentials fromPkcs8(
String privateKeyPkcs8, ServiceAccountCredentials.Builder builder) throws IOException {
PrivateKey privateKey = OAuth2Utils.privateKeyFromPkcs8(privateKeyPkcs8);
builder.setPrivateKey(privateKey);
return new ServiceAccountCredentials(builder);
}
/**
* Returns credentials defined by a Service Account key file in JSON format from the Google
* Developers Console.
*
* @param credentialsStream the stream with the credential definition.
* @return the credential defined by the credentialsStream.
* @throws IOException if the credential cannot be created from the stream.
*/
public static ServiceAccountCredentials fromStream(InputStream credentialsStream)
throws IOException {
return fromStream(credentialsStream, OAuth2Utils.HTTP_TRANSPORT_FACTORY);
}
/**
* Returns credentials defined by a Service Account key file in JSON format from the Google
* Developers Console.
*
* @param credentialsStream the stream with the credential definition.
* @param transportFactory HTTP transport factory, creates the transport used to get access
* tokens.
* @return the credential defined by the credentialsStream.
* @throws IOException if the credential cannot be created from the stream.
*/
public static ServiceAccountCredentials fromStream(
InputStream credentialsStream, HttpTransportFactory transportFactory) throws IOException {
ServiceAccountCredentials credential =
(ServiceAccountCredentials)
GoogleCredentials.fromStream(credentialsStream, transportFactory);
if (credential == null) {
throw new IOException(
String.format(
"Error reading credentials from stream, ServiceAccountCredentials type is not recognized."));
}
return credential;
}
/** Returns whether the scopes are empty, meaning createScoped must be called before use. */
@Override
public boolean createScopedRequired() {
return scopes.isEmpty() && defaultScopes.isEmpty();
}
/** Returns true if credential is configured domain wide delegation */
@VisibleForTesting
boolean isConfiguredForDomainWideDelegation() {
return serviceAccountUser != null && serviceAccountUser.length() > 0;
}
/**
* Refreshes the OAuth2 access token by getting a new access token using a JSON Web Token (JWT).
*/
@Override
public AccessToken refreshAccessToken() throws IOException {
JsonFactory jsonFactory = OAuth2Utils.JSON_FACTORY;
long currentTime = clock.currentTimeMillis();
String assertion = createAssertion(jsonFactory, currentTime);
GenericData tokenRequest = new GenericData();
tokenRequest.set("grant_type", GRANT_TYPE);
tokenRequest.set("assertion", assertion);
UrlEncodedContent content = new UrlEncodedContent(tokenRequest);
HttpRequestFactory requestFactory = transportFactory.create().createRequestFactory();
HttpRequest request = requestFactory.buildPostRequest(new GenericUrl(tokenServerUri), content);
if (this.defaultRetriesEnabled) {
request.setNumberOfRetries(OAuth2Utils.DEFAULT_NUMBER_OF_RETRIES);
} else {
request.setNumberOfRetries(0);
}
request.setParser(new JsonObjectParser(jsonFactory));
ExponentialBackOff backoff =
new ExponentialBackOff.Builder()
.setInitialIntervalMillis(OAuth2Utils.INITIAL_RETRY_INTERVAL_MILLIS)
.setRandomizationFactor(OAuth2Utils.RETRY_RANDOMIZATION_FACTOR)
.setMultiplier(OAuth2Utils.RETRY_MULTIPLIER)
.build();
request.setUnsuccessfulResponseHandler(
new HttpBackOffUnsuccessfulResponseHandler(backoff)
.setBackOffRequired(
response -> {
int code = response.getStatusCode();
return OAuth2Utils.TOKEN_ENDPOINT_RETRYABLE_STATUS_CODES.contains(code);
}));
request.setIOExceptionHandler(new HttpBackOffIOExceptionHandler(backoff));
HttpResponse response;
String errorTemplate = "Error getting access token for service account: %s, iss: %s";
try {
response = request.execute();
} catch (HttpResponseException re) {
String message = String.format(errorTemplate, re.getMessage(), getIssuer());
throw GoogleAuthException.createWithTokenEndpointResponseException(re, message);
} catch (IOException e) {
throw GoogleAuthException.createWithTokenEndpointIOException(
e, String.format(errorTemplate, e.getMessage(), getIssuer()));
}
GenericData responseData = response.parseAs(GenericData.class);
String accessToken =
OAuth2Utils.validateString(responseData, "access_token", PARSE_ERROR_PREFIX);
int expiresInSeconds =
OAuth2Utils.validateInt32(responseData, "expires_in", PARSE_ERROR_PREFIX);
long expiresAtMilliseconds = clock.currentTimeMillis() + expiresInSeconds * 1000L;
return new AccessToken(accessToken, new Date(expiresAtMilliseconds));
}
/**
* Returns a Google ID Token from either the Oauth or IAM Endpoint. For Credentials that are in
* the Google Default Universe (googleapis.com), the ID Token will be retrieved from the Oauth
* Endpoint. Otherwise, it will be retrieved from the IAM Endpoint.
*
* @param targetAudience the aud: field the IdToken should include.
* @param options list of Credential specific options for the token. Currently, unused for
* ServiceAccountCredentials.
* @throws IOException if the attempt to get an IdToken failed
* @return IdToken object which includes the raw id_token, expiration and audience
*/
@Override
public IdToken idTokenWithAudience(String targetAudience, List