Id tokens support for Google Credentials

[steeve]

Description of the problem / feature request:

Provide support for Id token based --google_ flags.

Feature requests: what underlying problem are you trying to solve with this feature?

I am running a Bazel cache on Cloud Run.
Cloud Run only support IdToken/JWT based authentication, while Bazel passes a OAuth2 Access token.
This feature request would allow Bazel to use an IdToken instead.

I'm working on a PoC.

What operating system are you running Bazel on?

macOS

What's the output of bazel info release?

release 3.4.1

Have you found anything relevant by searching the web?

No

[steeve]

The implementation is fairly easy, although blocked by googleapis/google-auth-library-java#469

[steeve]

All in all, the core is pretty simple to turn an access token into an id token:

        creds = IdTokenCredentials.newBuilder()
                .setIdTokenProvider((IdTokenProvider)creds)
                .setTargetAudience(url)
                .build();

Note that because of googleapis/google-auth-library-java#469, this doesn't work for authorized_user types of accounts yet.

The issue is in the target audience, which must be that of the service. So I'm torn. I think the best way forward is to make com.google.devtools.build.lib.authandtls.GoogleAuthUtils#newCallCredentials accept a URL so that the cred can be swapped transparently.

Also, I have added the following flag to bazel:

  @Option(
          name = "google_credentials_use_idtoken",
          defaultValue = "false",
          documentationCategory = OptionDocumentationCategory.UNCATEGORIZED,
          effectTags = {OptionEffectTag.UNKNOWN},
          help =
                  "Whether to use Google credentials in with an ID Token instead of an Access Token"
                          + " See https://cloud.google.com/endpoints/docs/openapi/authenticating-users-google-id for details. Disabled by default."
  )
  public boolean googleCredentialsUseIdToken;

[steeve]

Also, the issue is that some services only support Id Tokens (IAP, Cloud Run, Cloud Functions) whereas other support Access Tokens, so I think there's a UX issue here in that the auth type may need to be provided by service...

[ulfjack]

Technically, Google Run services can implement whatever authentication they want. You are not required to use id tokens.

Also see: https://cloud.google.com/run/docs/authenticating/end-users

[steeve]

Thank you for your response. Unfortunately services who validate tokens themselves only accept ID tokens, not Access tokens (AFAICT). If I could validate an Access token, indeed the problem would solve itself!

Right now I'm sort of hacking it together via a tools/bazel wrapper, but I find it's pretty gross:

#!/bin/bash
if [[ "${1}" == "build" ]]; then
    id_token=$(gcloud auth print-identity-token)
    exec ${BAZEL_REAL} ${1} "--remote_header=Authorization=Bearer ${id_token}" ${@:2}
fi
exec ${BAZEL_REAL} ${@}

[steeve]

I stand corrected, apparently access tokens can be verified using the https://www.googleapis.com/oauth2/v1/tokeninfo endpoint. From what I can read though, it seems it's legacy, and ID tokens seem to be the new preferred way.

Indeed though, that solves my problem for now, I'll just patch bazel-remote to support this.

However, since Google Cloud is apparently moving to these tokens, it may be worthwhile anyhow, once googleapis/google-auth-library-java#469 is merged and released.

[ulfjack]

Instead of /oauth2/v1/tokeninfo you can also use /oauth2/v3/userinfo.

[steeve]

Oh nice. I'll guess I'll use email_verified and hd to authorise users from a certain domain. I guess that'll do for the time being.
Less elegant than letting Google itself authenticate and let the service do it, but should work with reasonable effort in the meanwhile.

[restingbull]

Ran across this issue using IAP in a Beyond Corp style environment. As far as I can tell, IAP require an id token -- meaning the work around is to validate the credentials and use the method noted in #12135 (comment). It's non-ideal. support for id tokens would be handy!

(Mind you, I could be wrong about IAP. The documentation assumes that one already knows how exactly how everything works.)

[steeve]

For the record, IdToken support has been merged in googleapis/google-auth-library-java#650

[steeve]

More context for this, I ended up using a wrapper. I'll open a PR for IdToken support now that it's supported.

https://blog.zen.ly/fast-cheap-and-globally-accessible-bazel-remote-cache-on-google-cloud-run-storage-282e908df514

[github-actions]

Thank you for contributing to the Bazel repository! This issue has been marked as stale since it has not had any activity in the last 1+ years. It will be closed in the next 14 days unless any other activity occurs or one of the following labels is added: "not stale", "awaiting-bazeler". Please reach out to the triage team (@bazelbuild/triage) if you think this issue is still relevant or you are interested in getting the issue resolved.

[github-actions]

This issue has been automatically closed due to inactivity. If you're still interested in pursuing this, please reach out to the triage team (@bazelbuild/triage). Thanks!