From 1492408997e15659ab7d3eadb8d394d58ee9f6d5 Mon Sep 17 00:00:00 2001 From: Tim Emiola Date: Thu, 12 Feb 2015 12:54:58 -0800 Subject: [PATCH 1/6] Adds funcs for json key from environment defaults - adds support for path specified by an ENV var - adds support for loading from a default path --- lib/googleauth/service_account.rb | 52 ++++++++++++-- spec/googleauth/service_account_spec.rb | 90 ++++++++++++++++++++++--- 2 files changed, 129 insertions(+), 13 deletions(-) diff --git a/lib/googleauth/service_account.rb b/lib/googleauth/service_account.rb index a7b9072..2d26154 100644 --- a/lib/googleauth/service_account.rb +++ b/lib/googleauth/service_account.rb @@ -28,8 +28,10 @@ # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. require 'googleauth/signet' +require 'memoist' require 'multi_json' require 'openssl' +require 'rbconfig' # Reads the private key and client email fields from service account JSON key. def read_json_key(json_key_io) @@ -45,14 +47,56 @@ module Google module Auth # Authenticates requests using Google's Service Account credentials. # - # This class provides a simpler surface to the behavior in - # Signet::OAuth2::Client. It allows authorizing requests directly using - # credentials from a json key file downloaded from the developer console - # (via 'Generate new Json Key'). + # This class allows authorizing requests for service accounts directly + # from credentials from a json key file downloaded from the developer + # console (via 'Generate new Json Key'). # # cf [Application Default Credentials](http://goo.gl/mkAHpZ) class ServiceAccountCredentials < Signet::OAuth2::Client + ENV_VAR = 'GOOGLE_APPLICATION_CREDENTIALS' + NOT_FOUND_PREFIX = + "Unable to read the credential file specified by #{ENV_VAR}" TOKEN_CRED_URI = 'https://www.googleapis.com/oauth2/v3/token' + WELL_KNOWN_PATH = 'gcloud/application_default_credentials.json' + WELL_KNOWN_PREFIX = 'Unable to read the default credential file' + + class << self + extend Memoist + + # determines if the current OS is windows + def windows? + RbConfig::CONFIG['host_os'] =~ /Windows|mswin/ + end + memoize :windows? + + # Creates an instance from the path specified in an environment + # variable. + # + # @param scope [string|array] the scope(s) to access + def from_env(scope) + return nil unless ENV.key?(ENV_VAR) + path = ENV[ENV_VAR] + fail 'file #{path} does not exist' unless File.exist?(path) + return new(scope, File.open(path)) + rescue StandardError => e + raise "#{NOT_FOUND_PREFIX}: #{e}" + end + + # Creates an instance from a well known path. + # + # @param scope [string|array] the scope(s) to access + def from_well_known_path(scope) + home_var = windows? ? 'APPDATA' : 'HOME' + root = ENV[home_var].nil? ? '' : ENV[home_var] + base = WELL_KNOWN_PATH + base = File.join('.config', base) unless windows? + path = File.join(root, base) + return nil unless File.exist?(path) + return new(scope, File.open(path)) + rescue StandardError => e + raise "#{WELL_KNOWN_PREFIX}: #{e}" + end + end # Initializes a ServiceAccountCredentials. # diff --git a/spec/googleauth/service_account_spec.rb b/spec/googleauth/service_account_spec.rb index 20700d1..e6657b4 100644 --- a/spec/googleauth/service_account_spec.rb +++ b/spec/googleauth/service_account_spec.rb @@ -32,24 +32,20 @@ $LOAD_PATH.unshift(spec_dir) $LOAD_PATH.uniq! require 'apply_auth_examples' +require 'fileutils' require 'googleauth/service_account' require 'jwt' require 'multi_json' require 'openssl' require 'spec_helper' +require 'tmpdir' describe Google::Auth::ServiceAccountCredentials do + ServiceAccountCredentials = Google::Auth::ServiceAccountCredentials + before(:example) do @key = OpenSSL::PKey::RSA.new(2048) - cred_json = { - private_key_id: 'a_private_key_id', - private_key: @key.to_pem, - client_email: 'app@developer.gserviceaccount.com', - client_id: 'app.apps.googleusercontent.com', - type: 'service_account' - } - cred_json_text = MultiJson.dump(cred_json) - @client = Google::Auth::ServiceAccountCredentials.new( + @client = ServiceAccountCredentials.new( 'https://www.googleapis.com/auth/userinfo.profile', StringIO.new(cred_json_text)) end @@ -67,5 +63,81 @@ describe Google::Auth::ServiceAccountCredentials do end end + def cred_json_text + cred_json = { + private_key_id: 'a_private_key_id', + private_key: @key.to_pem, + client_email: 'app@developer.gserviceaccount.com', + client_id: 'app.apps.googleusercontent.com', + type: 'service_account' + } + MultiJson.dump(cred_json) + end + it_behaves_like 'apply/apply! are OK' + + describe '#from_env' do + before(:example) do + @var_name = ServiceAccountCredentials::ENV_VAR + @orig = ENV[@var_name] + @scope = 'https://www.googleapis.com/auth/userinfo.profile' + end + + after(:example) do + ENV[@var_name] = @orig unless @orig.nil? + end + + it 'returns nil if the GOOGLE_APPLICATION_CREDENTIALS is unset' do + ENV.delete(@var_name) unless ENV[@var_name].nil? + expect(ServiceAccountCredentials.from_env(@scope)).to be_nil + end + + it 'fails if the GOOGLE_APPLICATION_CREDENTIALS path does not exist' do + ENV.delete(@var_name) unless ENV[@var_name].nil? + expect(ServiceAccountCredentials.from_env(@scope)).to be_nil + Dir.mktmpdir do |dir| + key_path = File.join(dir, 'does-not-exist') + ENV[@var_name] = key_path + expect { sac.from_env(@scope) }.to raise_error + end + end + + it 'succeeds when the GOOGLE_APPLICATION_CREDENTIALS file is valid' do + sac = ServiceAccountCredentials # shortens name + Dir.mktmpdir do |dir| + key_path = File.join(dir, 'my_cert_file') + FileUtils.mkdir_p(File.dirname(key_path)) + File.write(key_path, cred_json_text) + ENV[@var_name] = key_path + expect(sac.from_env(@scope)).to_not be_nil + end + end + end + + describe '#from_well_known_path' do + before(:example) do + @home = ENV['HOME'] + @scope = 'https://www.googleapis.com/auth/userinfo.profile' + end + + after(:example) do + ENV['HOME'] = @home unless @home == ENV['HOME'] + end + + it 'is nil if no file exists' do + ENV['HOME'] = File.dirname(__FILE__) + expect(ServiceAccountCredentials.from_well_known_path(@scope)).to be_nil + end + + it 'successfully loads the file when it is present' do + sac = ServiceAccountCredentials # shortens name + Dir.mktmpdir do |dir| + key_path = File.join(dir, '.config', sac::WELL_KNOWN_PATH) + FileUtils.mkdir_p(File.dirname(key_path)) + File.write(key_path, cred_json_text) + ENV['HOME'] = dir + expect(sac.from_well_known_path(@scope)).to_not be_nil + end + end + end end From f8fd5fa519ee82ce3d6e60a92184cd95327478c4 Mon Sep 17 00:00:00 2001 From: Tim Emiola Date: Thu, 12 Feb 2015 16:58:48 -0800 Subject: [PATCH 2/6] Corrects the rescue clause --- lib/googleauth/compute_engine.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/lib/googleauth/compute_engine.rb b/lib/googleauth/compute_engine.rb index c99214b..b820af1 100644 --- a/lib/googleauth/compute_engine.rb +++ b/lib/googleauth/compute_engine.rb @@ -46,6 +46,7 @@ module Google class << self extend Memoist + # Detect if this appear to be a GCE instance, by checking if metadata # is available def on_gce?(options = {}) @@ -64,9 +65,10 @@ module Google return false unless resp.status == 200 return false unless resp.headers.key?('Metadata-Flavor') return resp.headers['Metadata-Flavor'] == 'Google' - rescue [Faraday::TimeoutError, Faraday::ConnectionFailed] + rescue Faraday::TimeoutError, Faraday::ConnectionFailed return false end + memoize :on_gce? end From a5bb601fe3da8225729adb99a2c54f077e6cd6dd Mon Sep 17 00:00:00 2001 From: Tim Emiola Date: Thu, 12 Feb 2015 16:59:08 -0800 Subject: [PATCH 3/6] Adds an implementation of Application Default Credentials - supports two initial scenarios - 2LO with service accounts - Compute Engine - performs all 3 'sniffs' for the service account credentials - from environment - from a well known file - from GCE --- lib/googleauth.rb | 62 ++++++++ .../get_application_default_spec.rb | 134 ++++++++++++++++++ 2 files changed, 196 insertions(+) create mode 100644 lib/googleauth.rb create mode 100644 spec/googleauth/get_application_default_spec.rb diff --git a/lib/googleauth.rb b/lib/googleauth.rb new file mode 100644 index 0000000..4abc0f7 --- /dev/null +++ b/lib/googleauth.rb @@ -0,0 +1,62 @@ +# Copyright 2015, Google Inc. +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are +# met: +# +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above +# copyright notice, this list of conditions and the following disclaimer +# in the documentation and/or other materials provided with the +# distribution. +# * Neither the name of Google Inc. nor the names of its +# contributors may be used to endorse or promote products derived from +# this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +require 'googleauth/service_account' +require 'googleauth/compute_engine' + +module Google + # Module Auth provides classes that provide Google-specific authorization + # used to access Google APIs. + module Auth + NOT_FOUND = < 'Google' }, + ''] + end + end # GCE not detected + Dir.mktmpdir do |dir| + ENV.delete(@var_name) unless ENV[@var_name].nil? # no env var + ENV['HOME'] = dir # no config present in this tmp dir + c = Faraday.new do |b| + b.adapter(:test, stubs) + end + blk = proc do + Google::Auth.get_application_default(@scope, connection: c) + end + expect(&blk).to raise_error + end + stubs.verify_stubbed_calls + end + + it 'succeeds without default file or env if on compute engine' do + stubs = Faraday::Adapter::Test::Stubs.new do |stub| + stub.get('/') do |_env| + [200, + { 'Metadata-Flavor' => 'Google' }, + ''] + end + end # GCE detected + Dir.mktmpdir do |dir| + ENV.delete(@var_name) unless ENV[@var_name].nil? # no env var + ENV['HOME'] = dir # no config present in this tmp dir + c = Faraday.new do |b| + b.adapter(:test, stubs) + end + expect(Google::Auth.get_application_default(@scope, + connection: c)).to_not be_nil + end + stubs.verify_stubbed_calls + end +end From 7adcf42958f9f42e3e0243f8514aefa85bdf69a7 Mon Sep 17 00:00:00 2001 From: Tim Emiola Date: Tue, 17 Feb 2015 18:43:00 -0800 Subject: [PATCH 4/6] Renamed the error vars --- lib/googleauth.rb | 4 ++-- lib/googleauth/service_account.rb | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/lib/googleauth.rb b/lib/googleauth.rb index 4abc0f7..f68f912 100644 --- a/lib/googleauth.rb +++ b/lib/googleauth.rb @@ -34,7 +34,7 @@ module Google # Module Auth provides classes that provide Google-specific authorization # used to access Google APIs. module Auth - NOT_FOUND = < e - raise "#{NOT_FOUND_PREFIX}: #{e}" + raise "#{NOT_FOUND_ERROR}: #{e}" end # Creates an instance from a well known path. @@ -94,7 +94,7 @@ module Google return nil unless File.exist?(path) return new(scope, File.open(path)) rescue StandardError => e - raise "#{WELL_KNOWN_PREFIX}: #{e}" + raise "#{WELL_KNOWN_ERROR}: #{e}" end end From 21b0a3dead47ffdf37c77ca1d250f9b1f02a8855 Mon Sep 17 00:00:00 2001 From: Tim Emiola Date: Tue, 24 Feb 2015 14:57:12 -0800 Subject: [PATCH 5/6] Ensures that the loaded files are closed --- lib/googleauth/service_account.rb | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/lib/googleauth/service_account.rb b/lib/googleauth/service_account.rb index 0cd841e..4e8072b 100644 --- a/lib/googleauth/service_account.rb +++ b/lib/googleauth/service_account.rb @@ -77,7 +77,9 @@ module Google return nil unless ENV.key?(ENV_VAR) path = ENV[ENV_VAR] fail 'file #{path} does not exist' unless File.exist?(path) - return new(scope, File.open(path)) + File.open(path) do |f| + return new(scope, f) + end rescue StandardError => e raise "#{NOT_FOUND_ERROR}: #{e}" end @@ -86,13 +88,14 @@ module Google # # @param scope [string|array] the scope(s) to access def from_well_known_path(scope) - home_var = windows? ? 'APPDATA' : 'HOME' + home_var, base = windows? ? 'APPDATA' : 'HOME', WELL_KNOWN_PATH root = ENV[home_var].nil? ? '' : ENV[home_var] - base = WELL_KNOWN_PATH base = File.join('.config', base) unless windows? path = File.join(root, base) return nil unless File.exist?(path) - return new(scope, File.open(path)) + File.open(path) do |f| + return new(scope, f) + end rescue StandardError => e raise "#{WELL_KNOWN_ERROR}: #{e}" end From 34429f3298d4cd9e3bee329d51ccef9417c45278 Mon Sep 17 00:00:00 2001 From: Tim Emiola Date: Tue, 24 Feb 2015 15:01:11 -0800 Subject: [PATCH 6/6] Updates the comment to link to Application Default Credentials --- lib/googleauth.rb | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/lib/googleauth.rb b/lib/googleauth.rb index f68f912..d6dafa5 100644 --- a/lib/googleauth.rb +++ b/lib/googleauth.rb @@ -43,6 +43,10 @@ END # Obtains the default credentials implementation to use in this # environment. # + # Use this to obtain the Application Default Credentials for accessing + # Google APIs. Application Default Credentials are described in detail + # at http://goo.gl/IUuyuX. + # # If supplied, scope is used to create the credentials instance, when it # can applied. E.g, on compute engine, the scope is ignored. #