Class GdchCredentials

java.lang.Object

com.google.auth.Credentials

com.google.auth.oauth2.OAuth2Credentials

com.google.auth.oauth2.GoogleCredentials

com.google.auth.oauth2.GdchCredentials

All Implemented Interfaces:

QuotaProjectIdProvider, Serializable

public class GdchCredentials
extends GoogleCredentials

See Also:

• Serialized Form

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	GdchCredentials.Builder
(package private) static class	GdchCredentials.TransportFactoryForGdch

Nested classes/interfaces inherited from class OAuth2Credentials

OAuth2Credentials.AsyncRefreshResult, OAuth2Credentials.CacheState, OAuth2Credentials.CredentialsChangedListener, OAuth2Credentials.FutureCallbackToMetadataCallbackAdapter, OAuth2Credentials.OAuthValue, OAuth2Credentials.RefreshTask, OAuth2Credentials.RefreshTaskListener

Field Summary

Fields

Modifier and Type	Field	Description
private final URI	apiAudience
private final String	caCertPath
private static final int	DEFAULT_LIFETIME_IN_SECONDS
private final int	lifetime
private static final String	PARSE_ERROR_PREFIX
private final PrivateKey	privateKey
private final String	privateKeyId
private final String	projectId
private final String	serviceIdentityName
(package private) static final String	SUPPORTED_FORMAT_VERSION
private final URI	tokenServerUri
private HttpTransportFactory	transportFactory
private final String	transportFactoryClassName

Fields inherited from class GoogleCredentials

GDCH_SERVICE_ACCOUNT_FILE_TYPE, QUOTA_PROJECT_ID_HEADER_KEY, quotaProjectId, SERVICE_ACCOUNT_FILE_TYPE, USER_FILE_TYPE

Fields inherited from class OAuth2Credentials

clock, DEFAULT_EXPIRATION_MARGIN, DEFAULT_REFRESH_MARGIN, lock, refreshTask

Fields inherited from class Credentials

GOOGLE_DEFAULT_UNIVERSE

Constructor Summary

Constructors

Constructor	Description
GdchCredentials(GdchCredentials.Builder builder)	Internal constructor.

Method Summary

Modifier and Type	Method	Description
(package private) String	createAssertion(com.google.api.client.json.JsonFactory jsonFactory, long currentTime, URI apiAudience)	Create a self-signed JWT for GDCH authentication flow.
GdchCredentials	createWithGdchAudience(URI apiAudience)	Create a copy of GDCH credentials with the specified audience.
boolean	equals(Object obj)
(package private) static GdchCredentials	fromJson(Map<String,Object> json)	Create GDCH service account credentials defined by JSON.
(package private) static GdchCredentials	fromJson(Map<String,Object> json, HttpTransportFactory transportFactory)	Create GDCH service account credentials defined by JSON.
(package private) static GdchCredentials	fromPkcs8(String privateKeyPkcs8, GdchCredentials.Builder builder)	Internal constructor.
final URI	getApiAudience()
final String	getCaCertPath()
(package private) static String	getIssuerSubjectValue(String projectId, String serviceIdentityName)	Get the issuer and subject value in the format GDCH token server required.
final PrivateKey	getPrivateKey()
final String	getPrivateKeyId()
final String	getProjectId()
final String	getServiceIdentityName()
final URI	getTokenServerUri()
final HttpTransportFactory	getTransportFactory()
int	hashCode()
static GdchCredentials.Builder	newBuilder()
private void	readObject(ObjectInputStream input)
(package private) static InputStream	readStream(File file)
AccessToken	refreshAccessToken()	Refresh the OAuth2 access token by getting a new access token using a JSON Web Token (JWT).
GdchCredentials.Builder	toBuilder()
String	toString()
private static String	validateField(String field, String fieldName)

Methods inherited from class GoogleCredentials

addQuotaProjectIdToRequestMetadata, create, create, createDelegated, createScoped, createScoped, createScoped, createScopedRequired, createWithCustomRetryStrategy, createWithQuotaProject, fromStream, fromStream, getAdditionalHeaders, getApplicationDefault, getApplicationDefault, getQuotaProjectId, getUniverseDomain, isDefaultUniverseDomain, isExplicitUniverseDomain, toStringHelper

Methods inherited from class OAuth2Credentials

addChangeListener, getAccessToken, getAuthenticationType, getExpirationMargin, getFromServiceLoader, getRefreshMargin, getRequestMetadata, getRequestMetadata, getRequestMetadataInternal, hasRequestMetadata, hasRequestMetadataOnly, newInstance, refresh, refreshIfExpired, removeChangeListener

Methods inherited from class Credentials

blockingGetToCallback, getMetricsCredentialType, getRequestMetadata

Methods inherited from class Object

clone, finalize, getClass, notify, notifyAll, wait, wait, wait

Field Details

SUPPORTED_FORMAT_VERSION

static final String SUPPORTED_FORMAT_VERSION

See Also:

• Constant Field Values

PARSE_ERROR_PREFIX

private static final String PARSE_ERROR_PREFIX

See Also:

• Constant Field Values

DEFAULT_LIFETIME_IN_SECONDS

private static final int DEFAULT_LIFETIME_IN_SECONDS

See Also:

• Constant Field Values

privateKey

private final PrivateKey privateKey

privateKeyId

private final String privateKeyId

projectId

private final String projectId

serviceIdentityName

private final String serviceIdentityName

tokenServerUri

private final URI tokenServerUri

apiAudience

private final URI apiAudience

lifetime

private final int lifetime

transportFactoryClassName

private final String transportFactoryClassName

caCertPath

private final String caCertPath

transportFactory

private transient HttpTransportFactory transportFactory

Constructor Details

GdchCredentials

GdchCredentials(GdchCredentials.Builder builder)

Internal constructor.

Parameters:

builder - A builder for GdchCredentials See GdchCredentials.Builder.

Method Details

fromJson

static GdchCredentials fromJson(Map<String,Object> json)
                         throws IOException

Create GDCH service account credentials defined by JSON.

Parameters:

json - a map from the JSON representing the credentials.

Returns:

the GDCH service account credentials defined by the JSON.

Throws:

IOException - if the credential cannot be created from the JSON.

fromJson

static GdchCredentials fromJson(Map<String,Object> json,
 HttpTransportFactory transportFactory)
                         throws IOException

Create GDCH service account credentials defined by JSON.

Parameters:

json - a map from the JSON representing the credentials.

transportFactory - HTTP transport factory, creates the transport used to get access tokens.

Returns:

the GDCH service account credentials defined by the JSON.

Throws:

IOException - if the credential cannot be created from the JSON.

fromPkcs8

static GdchCredentials fromPkcs8(String privateKeyPkcs8,
 GdchCredentials.Builder builder)
                          throws IOException

Internal constructor.

Parameters:

privateKeyPkcs8 - RSA private key object for the service account in PKCS#8 format.

builder - A builder for GdchCredentials.

Returns:

an instance of GdchCredentials.

Throws:

IOException

createWithGdchAudience

public GdchCredentials createWithGdchAudience(URI apiAudience)
                                       throws IOException

Create a copy of GDCH credentials with the specified audience.

Parameters:

apiAudience - The intended audience for GDCH credentials.

Throws:

IOException

refreshAccessToken

public AccessToken refreshAccessToken()
                               throws IOException

Refresh the OAuth2 access token by getting a new access token using a JSON Web Token (JWT).

For GDCH credentials, this class creates a self-signed JWT, and sends to the GDCH authentication endpoint (tokenServerUri) to exchange an access token for the intended api audience (apiAudience).

Overrides:

refreshAccessToken in class OAuth2Credentials

Returns:

never

Throws:

IOException

createAssertion

String createAssertion(com.google.api.client.json.JsonFactory jsonFactory,
 long currentTime,
 URI apiAudience)
                throws IOException

Create a self-signed JWT for GDCH authentication flow.

The self-signed JWT is used to exchange access token from GDCH authentication (tokenServerUri), not for API call. It uses the serviceIdentityName as the `iss` and `sub` claim, and the tokenServerUri as the `aud` claim. The JWT is signed with the privateKey.

Throws:

IOException

getIssuerSubjectValue

static String getIssuerSubjectValue(String projectId,
 String serviceIdentityName)

Get the issuer and subject value in the format GDCH token server required.

This value is specific to GDCH and combined parameter used for both `iss` and `sub` fields in JWT claim.

getProjectId

public final String getProjectId()

getPrivateKeyId

public final String getPrivateKeyId()

getPrivateKey

public final PrivateKey getPrivateKey()

getServiceIdentityName

public final String getServiceIdentityName()

getTokenServerUri

public final URI getTokenServerUri()

getApiAudience

public final URI getApiAudience()

getTransportFactory

public final HttpTransportFactory getTransportFactory()

getCaCertPath

public final String getCaCertPath()

newBuilder

public static GdchCredentials.Builder newBuilder()

toBuilder

public GdchCredentials.Builder toBuilder()

Overrides:

toBuilder in class GoogleCredentials

readObject

private void readObject(ObjectInputStream input)
                 throws IOException,
ClassNotFoundException

Throws:

IOException

ClassNotFoundException

hashCode

public int hashCode()

Overrides:

hashCode in class GoogleCredentials

toString

public String toString()

Overrides:

toString in class GoogleCredentials

equals

public boolean equals(Object obj)

Overrides:

equals in class GoogleCredentials

readStream

static InputStream readStream(File file)
                       throws FileNotFoundException

Throws:

FileNotFoundException

validateField

private static String validateField(String field,
 String fieldName)
                             throws IOException

Throws:

IOException