Class ExternalAccountCredentials

java.lang.Object

com.google.auth.Credentials

com.google.auth.oauth2.OAuth2Credentials

com.google.auth.oauth2.GoogleCredentials

com.google.auth.oauth2.ExternalAccountCredentials

All Implemented Interfaces:

QuotaProjectIdProvider, Serializable

Direct Known Subclasses:

AwsCredentials, IdentityPoolCredentials, PluggableAuthCredentials

public abstract class ExternalAccountCredentials
extends GoogleCredentials

Base external account credentials class.

Handles initializing external credentials, calls to the Security Token Service, and service account impersonation.

See Also:

• Serialized Form

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	ExternalAccountCredentials.Builder	Base builder for external account credentials.
(package private) static class	ExternalAccountCredentials.CredentialSource	Base credential source class.
(package private) static final class	ExternalAccountCredentials.ServiceAccountImpersonationOptions	Encapsulates the service account impersonation options portion of the configuration for ExternalAccountCredentials.
static enum	ExternalAccountCredentials.SubjectTokenTypes	Enum specifying values for the subjectTokenType field in ExternalAccountCredentials.

Nested classes/interfaces inherited from class OAuth2Credentials

OAuth2Credentials.AsyncRefreshResult, OAuth2Credentials.CacheState, OAuth2Credentials.CredentialsChangedListener, OAuth2Credentials.FutureCallbackToMetadataCallbackAdapter, OAuth2Credentials.OAuthValue, OAuth2Credentials.RefreshTask, OAuth2Credentials.RefreshTaskListener

Field Summary

Fields

Modifier and Type	Field	Description
private final String	audience
private final String	clientId
private final String	clientSecret
private static final String	CLOUD_PLATFORM_SCOPE
private final ExternalAccountCredentials.CredentialSource	credentialSource
(package private) static final String	DEFAULT_TOKEN_URL
private EnvironmentProvider	environmentProvider
(package private) static final String	EXECUTABLE_SOURCE_KEY
(package private) static final String	EXTERNAL_ACCOUNT_FILE_TYPE
protected ImpersonatedCredentials	impersonatedCredentials
private ExternalAccountMetricsHandler	metricsHandler
(package private) static final String	PROGRAMMATIC_METRICS_HEADER_VALUE
private final Collection<String>	scopes
private static final long	serialVersionUID
private final ExternalAccountCredentials.ServiceAccountImpersonationOptions	serviceAccountImpersonationOptions
private final String	serviceAccountImpersonationUrl
private final String	subjectTokenType
private final String	tokenInfoUrl
private final String	tokenUrl
protected HttpTransportFactory	transportFactory
private final String	transportFactoryClassName
private final String	workforcePoolUserProject

Fields inherited from class GoogleCredentials

GDCH_SERVICE_ACCOUNT_FILE_TYPE, QUOTA_PROJECT_ID_HEADER_KEY, quotaProjectId, SERVICE_ACCOUNT_FILE_TYPE, USER_FILE_TYPE

Fields inherited from class OAuth2Credentials

clock, DEFAULT_EXPIRATION_MARGIN, DEFAULT_REFRESH_MARGIN, lock, refreshTask

Fields inherited from class Credentials

GOOGLE_DEFAULT_UNIVERSE

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	ExternalAccountCredentials(HttpTransportFactory transportFactory, String audience, String subjectTokenType, String tokenUrl, ExternalAccountCredentials.CredentialSource credentialSource, String tokenInfoUrl, String serviceAccountImpersonationUrl, String quotaProjectId, String clientId, String clientSecret, Collection<String> scopes)	Constructor with minimum identifying information and custom HTTP transport.
protected	ExternalAccountCredentials(HttpTransportFactory transportFactory, String audience, String subjectTokenType, String tokenUrl, ExternalAccountCredentials.CredentialSource credentialSource, String tokenInfoUrl, String serviceAccountImpersonationUrl, String quotaProjectId, String clientId, String clientSecret, Collection<String> scopes, EnvironmentProvider environmentProvider)	Constructor with minimum identifying information and custom HTTP transport.
protected	ExternalAccountCredentials(ExternalAccountCredentials.Builder builder)	Internal constructor with minimum identifying information and custom HTTP transport.

Method Summary

Modifier and Type	Method	Description
(package private) ImpersonatedCredentials	buildImpersonatedCredentials()
protected AccessToken	exchangeExternalCredentialForAccessToken(StsTokenExchangeRequest stsTokenExchangeRequest)	Exchanges the external credential for a Google Cloud access token.
(package private) static ExternalAccountCredentials	fromJson(Map<String,Object> json, HttpTransportFactory transportFactory)	Returns external account credentials defined by JSON using the format generated by gCloud.
static ExternalAccountCredentials	fromStream(InputStream credentialsStream)	Returns credentials defined by a JSON file stream.
static ExternalAccountCredentials	fromStream(InputStream credentialsStream, HttpTransportFactory transportFactory)	Returns credentials defined by a JSON file stream.
String	getAudience()
String	getClientId()
String	getClientSecret()
ExternalAccountCredentials.CredentialSource	getCredentialSource()
(package private) String	getCredentialSourceType()
(package private) EnvironmentProvider	getEnvironmentProvider()
Map<String, List<String>>	getRequestMetadata(URI uri)	Provide the request metadata by ensuring there is a current access token and providing it as an authorization bearer token.
void	getRequestMetadata(URI uri, Executor executor, RequestMetadataCallback callback)	Get the current request metadata without blocking.
Collection<String>	getScopes()
String	getServiceAccountEmail()
ExternalAccountCredentials.ServiceAccountImpersonationOptions	getServiceAccountImpersonationOptions()
String	getServiceAccountImpersonationUrl()
String	getSubjectTokenType()
String	getTokenInfoUrl()
String	getTokenUrl()
String	getUniverseDomain()	Gets the universe domain for the credential.
String	getWorkforcePoolUserProject()
private static boolean	isAwsCredential(Map<String,Object> credentialSource)
private static boolean	isPluggableAuthCredential(Map<String,Object> credentialSource)
private static boolean	isValidUrl(String url)	Returns true if the provided URL's scheme is valid and is HTTPS.
boolean	isWorkforcePoolConfiguration()
private void	readObject(ObjectInputStream input)
abstract String	retrieveSubjectToken()	Retrieves the external subject token to be exchanged for a Google Cloud access token.
private boolean	shouldBuildImpersonatedCredential()
(package private) static void	validateServiceAccountImpersonationInfoUrl(String serviceAccountImpersonationUrl)
(package private) static void	validateTokenUrl(String tokenUrl)

Methods inherited from class GoogleCredentials

addQuotaProjectIdToRequestMetadata, create, create, createDelegated, createScoped, createScoped, createScoped, createScopedRequired, createWithCustomRetryStrategy, createWithQuotaProject, equals, getAdditionalHeaders, getApplicationDefault, getApplicationDefault, getQuotaProjectId, hashCode, isDefaultUniverseDomain, isExplicitUniverseDomain, newBuilder, toBuilder, toString, toStringHelper

Methods inherited from class OAuth2Credentials

addChangeListener, getAccessToken, getAuthenticationType, getExpirationMargin, getFromServiceLoader, getRefreshMargin, getRequestMetadataInternal, hasRequestMetadata, hasRequestMetadataOnly, newInstance, refresh, refreshAccessToken, refreshIfExpired, removeChangeListener

Methods inherited from class Credentials

blockingGetToCallback, getMetricsCredentialType, getRequestMetadata

Methods inherited from class Object

clone, finalize, getClass, notify, notifyAll, wait, wait, wait

Field Details

serialVersionUID

private static final long serialVersionUID

See Also:

• Constant Field Values

CLOUD_PLATFORM_SCOPE

private static final String CLOUD_PLATFORM_SCOPE

See Also:

• Constant Field Values

EXTERNAL_ACCOUNT_FILE_TYPE

static final String EXTERNAL_ACCOUNT_FILE_TYPE

See Also:

• Constant Field Values

EXECUTABLE_SOURCE_KEY

static final String EXECUTABLE_SOURCE_KEY

See Also:

• Constant Field Values

DEFAULT_TOKEN_URL

static final String DEFAULT_TOKEN_URL

See Also:

• Constant Field Values

PROGRAMMATIC_METRICS_HEADER_VALUE

static final String PROGRAMMATIC_METRICS_HEADER_VALUE

See Also:

• Constant Field Values

transportFactoryClassName

private final String transportFactoryClassName

audience

private final String audience

subjectTokenType

private final String subjectTokenType

tokenUrl

private final String tokenUrl

credentialSource

private final ExternalAccountCredentials.CredentialSource credentialSource

scopes

private final Collection<String> scopes

serviceAccountImpersonationOptions

private final ExternalAccountCredentials.ServiceAccountImpersonationOptions serviceAccountImpersonationOptions

metricsHandler

private ExternalAccountMetricsHandler metricsHandler

tokenInfoUrl

@Nullable
private final String tokenInfoUrl

serviceAccountImpersonationUrl

@Nullable
private final String serviceAccountImpersonationUrl

clientId

@Nullable
private final String clientId

clientSecret

@Nullable
private final String clientSecret

workforcePoolUserProject

@Nullable
private final String workforcePoolUserProject

transportFactory

protected transient HttpTransportFactory transportFactory

impersonatedCredentials

@Nullable
protected ImpersonatedCredentials impersonatedCredentials

environmentProvider

private EnvironmentProvider environmentProvider

Constructor Details

ExternalAccountCredentials

protected ExternalAccountCredentials(HttpTransportFactory transportFactory,
 String audience,
 String subjectTokenType,
 String tokenUrl,
 ExternalAccountCredentials.CredentialSource credentialSource,
 @Nullable
 String tokenInfoUrl,
 @Nullable
 String serviceAccountImpersonationUrl,
 @Nullable
 String quotaProjectId,
 @Nullable
 String clientId,
 @Nullable
 String clientSecret,
 @Nullable
 Collection<String> scopes)

Constructor with minimum identifying information and custom HTTP transport. Does not support workforce credentials.

Parameters:

transportFactory - HTTP transport factory, creates the transport used to get access tokens

audience - the Security Token Service audience, which is usually the fully specified resource name of the workload/workforce pool provider

subjectTokenType - the Security Token Service subject token type based on the OAuth 2.0 token exchange spec. Indicates the type of the security token in the credential file

tokenUrl - the Security Token Service token exchange endpoint

credentialSource - the external credential source

tokenInfoUrl - the endpoint used to retrieve account related information. Required for gCloud session account identification.

serviceAccountImpersonationUrl - the URL for the service account impersonation request. This URL is required for some APIs. If this URL is not available, the access token from the Security Token Service is used directly. May be null.

quotaProjectId - the project used for quota and billing purposes. May be null.

clientId - client ID of the service account from the console. May be null.

clientSecret - client secret of the service account from the console. May be null.

scopes - the scopes to request during the authorization grant. May be null.

ExternalAccountCredentials

protected ExternalAccountCredentials(HttpTransportFactory transportFactory,
 String audience,
 String subjectTokenType,
 String tokenUrl,
 ExternalAccountCredentials.CredentialSource credentialSource,
 @Nullable
 String tokenInfoUrl,
 @Nullable
 String serviceAccountImpersonationUrl,
 @Nullable
 String quotaProjectId,
 @Nullable
 String clientId,
 @Nullable
 String clientSecret,
 @Nullable
 Collection<String> scopes,
 @Nullable
 EnvironmentProvider environmentProvider)

Constructor with minimum identifying information and custom HTTP transport. Does not support workforce credentials.

Parameters:

transportFactory - HTTP transport factory, creates the transport used to get access tokens

audience - the Security Token Service audience, which is usually the fully specified resource name of the workload/workforce pool provider

subjectTokenType - the Security Token Service subject token type based on the OAuth 2.0 token exchange spec. Indicates the type of the security token in the credential file

tokenUrl - the Security Token Service token exchange endpoint

credentialSource - the external credential source

tokenInfoUrl - the endpoint used to retrieve account related information. Required for gCloud session account identification.

serviceAccountImpersonationUrl - the URL for the service account impersonation request. This URL is required for some APIs. If this URL is not available, the access token from the Security Token Service is used directly. May be null.

quotaProjectId - the project used for quota and billing purposes. May be null.

clientId - client ID of the service account from the console. May be null.

clientSecret - client secret of the service account from the console. May be null.

scopes - the scopes to request during the authorization grant. May be null.

environmentProvider - the environment provider. May be null. Defaults to SystemEnvironmentProvider.

ExternalAccountCredentials

protected ExternalAccountCredentials(ExternalAccountCredentials.Builder builder)

Internal constructor with minimum identifying information and custom HTTP transport. See ExternalAccountCredentials.Builder.

Parameters:

builder - the Builder object used to construct the credentials.

Method Details

buildImpersonatedCredentials

ImpersonatedCredentials buildImpersonatedCredentials()

getRequestMetadata

public void getRequestMetadata(URI uri,
 Executor executor,
 RequestMetadataCallback callback)

Description copied from class: Credentials

Get the current request metadata without blocking.

This should be called by the transport layer on each request, and the data should be populated in headers or other context. The implementation can either call the callback inline or asynchronously. Either way it should never block in this method. The executor is provided for tasks that may block.

The default implementation will just call Credentials.getRequestMetadata(URI) then the callback from the given executor.

The convention for handling binary data is for the key in the returned map to end with "-bin" and for the corresponding values to be base64 encoded.

Overrides:

getRequestMetadata in class OAuth2Credentials

Parameters:

uri - URI of the entry point for the request.

executor - Executor to perform the request.

callback - Callback to execute when the request is finished.

getUniverseDomain

public String getUniverseDomain()

Description copied from class: GoogleCredentials

Gets the universe domain for the credential.

Overrides:

getUniverseDomain in class GoogleCredentials

Returns:

An explicit universe domain if it was explicitly provided, invokes the super implementation otherwise

getRequestMetadata

public Map<String, List<String>> getRequestMetadata(URI uri)
                                             throws IOException

Description copied from class: OAuth2Credentials

Provide the request metadata by ensuring there is a current access token and providing it as an authorization bearer token.

Overrides:

getRequestMetadata in class OAuth2Credentials

Parameters:

uri - URI of the entry point for the request.

Returns:

The request metadata used for populating headers or other context.

Throws:

IOException - if there was an error getting up-to-date access. The exception should implement Retryable and isRetryable() will return true if the operation may be retried.

fromStream

public static ExternalAccountCredentials fromStream(InputStream credentialsStream)
                                             throws IOException

Returns credentials defined by a JSON file stream.

Returns IdentityPoolCredentials or AwsCredentials.

Parameters:

credentialsStream - the stream with the credential definition

Returns:

the credential defined by the credentialsStream

Throws:

IOException - if the credential cannot be created from the stream

fromStream

public static ExternalAccountCredentials fromStream(InputStream credentialsStream,
 HttpTransportFactory transportFactory)
                                             throws IOException

Returns credentials defined by a JSON file stream.

Returns a IdentityPoolCredentials or AwsCredentials.

Parameters:

credentialsStream - the stream with the credential definition

transportFactory - the HTTP transport factory used to create the transport to get access tokens

Returns:

the credential defined by the credentialsStream

Throws:

IOException - if the credential cannot be created from the stream

fromJson

static ExternalAccountCredentials fromJson(Map<String,Object> json,
 HttpTransportFactory transportFactory)

Returns external account credentials defined by JSON using the format generated by gCloud.

Parameters:

json - a map from the JSON representing the credentials

transportFactory - HTTP transport factory, creates the transport used to get access tokens

Returns:

the credentials defined by the JSON

isPluggableAuthCredential

private static boolean isPluggableAuthCredential(Map<String,Object> credentialSource)

isAwsCredential

private static boolean isAwsCredential(Map<String,Object> credentialSource)

shouldBuildImpersonatedCredential

private boolean shouldBuildImpersonatedCredential()

exchangeExternalCredentialForAccessToken

protected AccessToken exchangeExternalCredentialForAccessToken(StsTokenExchangeRequest stsTokenExchangeRequest)
                                                        throws IOException

Exchanges the external credential for a Google Cloud access token.

Parameters:

stsTokenExchangeRequest - the Security Token Service token exchange request

Returns:

the access token returned by the Security Token Service

Throws:

OAuthException - if the call to the Security Token Service fails

IOException

retrieveSubjectToken

public abstract String retrieveSubjectToken()
                                     throws IOException

Retrieves the external subject token to be exchanged for a Google Cloud access token.

Must be implemented by subclasses as the retrieval method is dependent on the credential source.

Returns:

the external subject token

Throws:

IOException - if the subject token cannot be retrieved

getAudience

public String getAudience()

getSubjectTokenType

public String getSubjectTokenType()

getTokenUrl

public String getTokenUrl()

getTokenInfoUrl

public String getTokenInfoUrl()

getCredentialSource

public ExternalAccountCredentials.CredentialSource getCredentialSource()

readObject

private void readObject(ObjectInputStream input)
                 throws IOException,
ClassNotFoundException

Throws:

IOException

ClassNotFoundException

getServiceAccountImpersonationUrl

@Nullable
public String getServiceAccountImpersonationUrl()

getServiceAccountEmail

@Nullable
public String getServiceAccountEmail()

Returns:

The service account email to be impersonated, if available

getClientId

@Nullable
public String getClientId()

getClientSecret

@Nullable
public String getClientSecret()

getScopes

@Nullable
public Collection<String> getScopes()

getWorkforcePoolUserProject

@Nullable
public String getWorkforcePoolUserProject()

getServiceAccountImpersonationOptions

@Nullable
public ExternalAccountCredentials.ServiceAccountImpersonationOptions getServiceAccountImpersonationOptions()

getCredentialSourceType

String getCredentialSourceType()

getEnvironmentProvider

EnvironmentProvider getEnvironmentProvider()

isWorkforcePoolConfiguration

public boolean isWorkforcePoolConfiguration()

Returns:

whether the current configuration is for Workforce Pools (which enable 3p user identities, rather than workloads)

validateTokenUrl

static void validateTokenUrl(String tokenUrl)

validateServiceAccountImpersonationInfoUrl

static void validateServiceAccountImpersonationInfoUrl(String serviceAccountImpersonationUrl)

isValidUrl

private static boolean isValidUrl(String url)

Returns true if the provided URL's scheme is valid and is HTTPS.