Git Product home page Git Product logo

gcp_auth's Introduction

GCP Auth

Crates.io Documentation MIT licensed

GCP Auth is a simple, minimal authentication library for Google Cloud Platform (GCP) providing authentication using services accounts. Once authenticated, the service account can be used to acquire bearer tokens for use in authenticating against GCP services.

The library looks for authentication methods in the following order:

  1. Path to service account JSON configuration file using GOOGLE_APPLICATION_CREDENTIALS environment variable. The service account configuration file can be downloaded in the IAM service when displaying service account detail. The downloaded JSON file should be provided without any further modification.
  2. Invoking the library inside GCP environment fetches the default service account for the service and he application is authenticated using that particular account
  3. Application default credentials. Local user authetincation for development purposes created using gcloud auth application.
  4. If none of the above can be used an error occurs

Tokens should not be cached in the application; before every use a new token should be requested. The GCP auth library contains logic to determine if an already available token can be used, or if a new token should be requested.

Default service account

When running inside GCP the library can be asked without any further configuration to provide a bearer token for the current service account of the service.

let scopes = &["https://www.googleapis.com/auth/bigquery/"];
let authentication_manager = gcp_auth::init().await?;
let token = authentication_manager.get_token(scopes).await?;

Custom service account

When running outside of GCP (for example, on a developer's laptop), a custom service account may be used to grant some permissions. To use a custom service account a configuration file containing a private key can be downloaded in IAM service for the service account you intend to use. The configuration file has to be available to the application at run time. The path to the configuration file is specified by the GOOGLE_APPLICATION_CREDENTIALS environment variable.

// With the GOOGLE_APPLICATION_CREDENTIALS environment variable set
let scopes = &["https://www.googleapis.com/auth/bigquery/"];
let authentication_manager = gcp_auth::init().await?;
let token = authentication_manager.get_token(&scopes).await?;

Local user authentication

This authentication method allows developers to authenticate again GCP when developing locally. Its use should be limited to development. Credentials can be set up using the gcloud auth utility. Credentials are read from file ~/.config/gcloud/application_default_credentials.json.

FAQ

Does the library support windows?

No.

Getting tokens in multithreaded async programs

There is a simple pattern that can be used in async/await programs, to avoid creating multiple instances of AuthenticationManager:

use once_cell::sync::Lazy;

static AUTHENTICATOR: Lazy<gcp_auth::AuthenticationManager> =
    Lazy::new(|| {
        futures::executor::block_on(gcp_auth::init()).expect("Should set-up auth")
    });

License

Parts of the implementatino have been sourced from yup-oauth2.

Licensed under MIT license.

gcp_auth's People

Contributors

bes avatar d0x2f avatar djc avatar hrvolapeter avatar lawliet89 avatar

Watchers

 avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.