Not Being Able To impersonate for Domain-Wide Delegation. #174
Comments
|
Hi @ken5scal Can you try setting |
|
I had the same problem and tried setting |
|
@sethvargo @fujikky |
|
I have retrieved following credential as result of Using this value just like the way we do in
|
|
@ken5scal Here is the YAML of the Actions I tried. - id: auth
uses: google-github-actions/auth@v0
with:
workload_identity_provider: projects/00000000000/locations/global/workloadIdentityPools/github-actions/providers/foo-provider
service_account: foo@bar-project-id.iam.gserviceaccount.com
token_format: access_token
access_token_scopes: https://www.googleapis.com/auth/spreadsheets
access_token_subject: user@example.com
access_token_lifetime: 1800sI got the same error message. |
|
@ken5scal what API(s) are you trying to call after authenticating? The action.yml in the original issue stops at the auth step. Note all technologies support WIF (for example, bq and gsutil do not support WIF). @fujikky make sure you've granted |
|
@sethvargo I believe the value in scope ( |
|
@sethvargo I have confirmed that the policy is attached in the Cloud Console.
|
|
And the error message is still "failed to sign JWT using ..."? Do you have debug logs you could share? |
That's right. Let me share the debug log later |
|
Thanks for the help! My current error message is not about JWT. |
|
@sethvargo First, I founded that the Next, I found a bug in the auth action. Line 213 in 714f1fe It should be fix like this:diff --git a/src/main.ts b/src/main.ts
index 5f82809..aba9498 100644
--- a/src/main.ts
+++ b/src/main.ts
@@ -210,13 +210,14 @@ async function run(): Promise<void> {
// perform Domain-Wide Delegation. Otherwise, use the modern IAM
// Credentials endpoints.
let accessToken, expiration;
- if (accessTokenSubject && accessTokenLifetime > 3600) {
- logInfo(
- `An access token subject was specified, triggering Domain-Wide ` +
- `Delegation flow. This flow does not support specifying an ` +
- `access token lifetime of greater than 1 hour.`,
- );
-
+ if (accessTokenSubject) {
+ if (accessTokenLifetime > 3600) {
+ logInfo(
+ `An access token subject was specified, triggering Domain-Wide ` +
+ `Delegation flow. This flow does not support specifying an ` +
+ `access token lifetime of greater than 1 hour.`,
+ );
+ }
const unsignedJWT = buildDomainWideDelegationJWT(
serviceAccount,
accessTokenSubject,I changed to the previous version |
|
@sethvargo Now, I use a Golang App to fetch the audit log...and get an error. Go Code |
|
@fujikky fixed in #178 and will be released as 0.7.3. Thanks for catching that, and I'm glad to see this is working for you now. @ken5scal which client library is that, and which version are you using? In general, you should never need to parse |
|
@sethvargo Thanks, I'm using https://pkg.go.dev/google.golang.org/api@v0.80.0 which is the latest and official one. |
|
That library doesn't support WIF yet: googleapis/google-api-go-client#750 |
|
Ohhh.... Thanks, I would watch the issue in there @sethvargo |
TL;DR
credentials_jsonruns successfully, I believe this issue is specific to Domain-Wide Delegation.roles/iam.serviceAccountTokenCreatorandroles/iam.workloadIdentityUserExpected behavior
GitHub Action is able to retrieve an access tokens created for Domain-Wide Delegation.
Observed behavior
An access token subject was specified, triggering Domain-Wide Delegation flow. This flow does not support specifying an access token lifetime of greater than 1 hour.
Error: google-github-actions/auth failed with: failed to sign JWT using gws-access@${{PROJECT_ID}}.iam.gserviceaccount.com: {
"error": {
"code": 403,
"message": "The caller does not have permission",
"status": "PERMISSION_DENIED"
}
}
Action YAML
Log output
Additional information
No response
The text was updated successfully, but these errors were encountered: