Class PluggableAuthCredentials
- All Implemented Interfaces:
QuotaProjectIdProvider
,Serializable
To use these credentials, the GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES environment variable must be set to '1'. This is for security reasons.
Both OIDC and SAML are supported. The executable must adhere to a specific response format defined below.
The executable must print out the 3rd party token to STDOUT in JSON format. When an output_file is specified in the credential configuration, the executable must also handle writing the JSON response to this file.
OIDC response sample: { "version": 1, "success": true, "token_type": "urn:ietf:params:oauth:token-type:id_token", "id_token": "HEADER.PAYLOAD.SIGNATURE", "expiration_time": 1620433341 } SAML2 response sample: { "version": 1, "success": true, "token_type": "urn:ietf:params:oauth:token-type:saml2", "saml_response": "...", "expiration_time": 1620433341 } Error response sample: { "version": 1, "success": false, "code": "401", "message": "Error message." }
The `expiration_time` field in the JSON response is only required for successful responses when an output file was specified in the credential configuration.
The auth libraries will populate certain environment variables that will be accessible by the executable, such as: GOOGLE_EXTERNAL_ACCOUNT_AUDIENCE, GOOGLE_EXTERNAL_ACCOUNT_TOKEN_TYPE, GOOGLE_EXTERNAL_ACCOUNT_INTERACTIVE, GOOGLE_EXTERNAL_ACCOUNT_IMPERSONATED_EMAIL, and GOOGLE_EXTERNAL_ACCOUNT_OUTPUT_FILE.
Please see this repositories README for a complete executable request/response specification.
- See Also:
-
Nested Class Summary
Nested ClassesNested classes/interfaces inherited from class com.google.auth.oauth2.ExternalAccountCredentials
ExternalAccountCredentials.CredentialSource, ExternalAccountCredentials.ServiceAccountImpersonationOptions, ExternalAccountCredentials.SubjectTokenTypes
Nested classes/interfaces inherited from class com.google.auth.oauth2.OAuth2Credentials
OAuth2Credentials.AsyncRefreshResult, OAuth2Credentials.CacheState, OAuth2Credentials.CredentialsChangedListener, OAuth2Credentials.FutureCallbackToMetadataCallbackAdapter, OAuth2Credentials.OAuthValue, OAuth2Credentials.RefreshTask, OAuth2Credentials.RefreshTaskListener
-
Field Summary
FieldsModifier and TypeFieldDescriptionprivate final PluggableAuthCredentialSource
private final ExecutableHandler
(package private) static final String
Fields inherited from class com.google.auth.oauth2.ExternalAccountCredentials
DEFAULT_TOKEN_URL, EXECUTABLE_SOURCE_KEY, EXTERNAL_ACCOUNT_FILE_TYPE, impersonatedCredentials, PROGRAMMATIC_METRICS_HEADER_VALUE, transportFactory
Fields inherited from class com.google.auth.oauth2.GoogleCredentials
GDCH_SERVICE_ACCOUNT_FILE_TYPE, QUOTA_PROJECT_ID_HEADER_KEY, quotaProjectId, SERVICE_ACCOUNT_FILE_TYPE, USER_FILE_TYPE
Fields inherited from class com.google.auth.oauth2.OAuth2Credentials
clock, DEFAULT_EXPIRATION_MARGIN, DEFAULT_REFRESH_MARGIN, lock, refreshTask
Fields inherited from class com.google.auth.Credentials
GOOGLE_DEFAULT_UNIVERSE
-
Constructor Summary
ConstructorsConstructorDescriptionInternal constructor. -
Method Summary
Modifier and TypeMethodDescriptioncreateScoped
(Collection<String> newScopes) Clones the PluggableAuthCredentials with the specified scopes.(package private) String
(package private) ExecutableHandler
newBuilder
(PluggableAuthCredentials pluggableAuthCredentials) Method to refresh the access token according to the specific type of credentials.Returns the 3rd party subject token by calling the executable specified in the credential source.Methods inherited from class com.google.auth.oauth2.ExternalAccountCredentials
buildImpersonatedCredentials, exchangeExternalCredentialForAccessToken, fromJson, fromStream, fromStream, getAudience, getClientId, getClientSecret, getCredentialSource, getEnvironmentProvider, getRequestMetadata, getRequestMetadata, getScopes, getServiceAccountEmail, getServiceAccountImpersonationOptions, getServiceAccountImpersonationUrl, getSubjectTokenType, getTokenInfoUrl, getTokenUrl, getUniverseDomain, getWorkforcePoolUserProject, isWorkforcePoolConfiguration, validateServiceAccountImpersonationInfoUrl, validateTokenUrl
Methods inherited from class com.google.auth.oauth2.GoogleCredentials
addQuotaProjectIdToRequestMetadata, create, create, createDelegated, createScoped, createScoped, createScopedRequired, createWithCustomRetryStrategy, createWithQuotaProject, equals, getAdditionalHeaders, getApplicationDefault, getApplicationDefault, getQuotaProjectId, hashCode, isDefaultUniverseDomain, isExplicitUniverseDomain, toBuilder, toString, toStringHelper
Methods inherited from class com.google.auth.oauth2.OAuth2Credentials
addChangeListener, getAccessToken, getAuthenticationType, getExpirationMargin, getFromServiceLoader, getRefreshMargin, getRequestMetadataInternal, hasRequestMetadata, hasRequestMetadataOnly, newInstance, refresh, refreshIfExpired, removeChangeListener
Methods inherited from class com.google.auth.Credentials
blockingGetToCallback, getMetricsCredentialType, getRequestMetadata
-
Field Details
-
PLUGGABLE_AUTH_METRICS_HEADER_VALUE
- See Also:
-
config
-
handler
-
-
Constructor Details
-
PluggableAuthCredentials
PluggableAuthCredentials(PluggableAuthCredentials.Builder builder) Internal constructor. SeePluggableAuthCredentials.Builder
.
-
-
Method Details
-
refreshAccessToken
Description copied from class:OAuth2Credentials
Method to refresh the access token according to the specific type of credentials.Throws IllegalStateException if not overridden since direct use of OAuth2Credentials is only for temporary or non-refreshing access tokens.
- Overrides:
refreshAccessToken
in classOAuth2Credentials
- Returns:
- never
- Throws:
IOException
-
retrieveSubjectToken
Returns the 3rd party subject token by calling the executable specified in the credential source.- Specified by:
retrieveSubjectToken
in classExternalAccountCredentials
- Returns:
- the external subject token
- Throws:
IOException
- if an error occurs with the executable execution.
-
createScoped
Clones the PluggableAuthCredentials with the specified scopes.- Overrides:
createScoped
in classGoogleCredentials
- Parameters:
newScopes
- Collection of scopes to request.- Returns:
- GoogleCredentials with requested scopes.
-
getCredentialSourceType
String getCredentialSourceType()- Overrides:
getCredentialSourceType
in classExternalAccountCredentials
-
newBuilder
-
newBuilder
public static PluggableAuthCredentials.Builder newBuilder(PluggableAuthCredentials pluggableAuthCredentials) -
getExecutableHandler
-