Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: disabling self-signed jwt for domain wide delegation #754

Merged
merged 2 commits into from Oct 4, 2021
Merged

fix: disabling self-signed jwt for domain wide delegation #754

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e7ab7b0
disabling self-signed jwt for domain wide delegation
TimurSadykov Oct 1, 2021
a2a8abc
fix: nit fixes
TimurSadykov Oct 4, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
3 changes: 2 additions & 1 deletion oauth2_http/java/com/google/auth/oauth2/ServiceAccountCredentials.java
View file
Open in desktop
Expand Up @@ -1018,7 +1018,8 @@ public Map<String, List<String>> getRequestMetadata(URI uri) throws IOException

// If scopes are provided but we cannot use self signed JWT, then use scopes to get access
// token.
if (!createScopedRequired() && !useJwtAccessWithScope) {
if ((!createScopedRequired() && !useJwtAccessWithScope)
|| (serviceAccountUser != null && serviceAccountUser.length() > 0)) {
return super.getRequestMetadata(uri);
}

Expand Down
40 changes: 36 additions & 4 deletions oauth2_http/javatests/com/google/auth/oauth2/ServiceAccountCredentialsTest.java
View file
Open in desktop
Expand Up @@ -1355,7 +1355,6 @@ public void getRequestMetadata_selfSignedJWT_withScopes() throws IOException {
.setPrivateKey(privateKey)
.setPrivateKeyId(PRIVATE_KEY_ID)
.setScopes(SCOPES)
.setServiceAccountUser(USER)
.setProjectId(PROJECT_ID)
.setHttpTransportFactory(new MockTokenServerTransportFactory())
.setUseJwtAccessWithScope(true)
Expand All @@ -1366,16 +1365,51 @@ public void getRequestMetadata_selfSignedJWT_withScopes() throws IOException {
}

@Test
public void getRequestMetadata_selfSignedJWT_withAudience() throws IOException {
public void refreshAccessToken_withDomainDelegation_selfSignedJWT_disabled() throws IOException {
final String accessToken1 = "1/MkSJoj1xsli0AccessToken_NKPY2";
final String accessToken2 = "2/MkSJoj1xsli0AccessToken_NKPY2";
MockTokenServerTransportFactory transportFactory = new MockTokenServerTransportFactory();
MockTokenServerTransport transport = transportFactory.transport;
PrivateKey privateKey = ServiceAccountCredentials.privateKeyFromPkcs8(PRIVATE_KEY_PKCS8);
GoogleCredentials credentials =
ServiceAccountCredentials.newBuilder()
.setClientId(CLIENT_ID)
.setClientEmail(CLIENT_EMAIL)
.setPrivateKey(privateKey)
.setPrivateKeyId(PRIVATE_KEY_ID)
.setScopes(SCOPES)
.setServiceAccountUser(USER)
.setProjectId(PROJECT_ID)
.setHttpTransportFactory(transportFactory)
.setUseJwtAccessWithScope(true)
.build();

transport.addServiceAccount(CLIENT_EMAIL, accessToken1);
Map<String, List<String>> metadata = credentials.getRequestMetadata(CALL_URI);
TestUtils.assertContainsBearerToken(metadata, accessToken1);

try {
verifyJwtAccess(metadata, "dummy.scope");
fail("jwt access should fail with ServiceAccountUser");
} catch (Exception ex) {
// expected
}

transport.addServiceAccount(CLIENT_EMAIL, accessToken2);
credentials.refresh();
TestUtils.assertContainsBearerToken(credentials.getRequestMetadata(CALL_URI), accessToken2);
}

@Test
public void getRequestMetadata_selfSignedJWT_withAudience() throws IOException {
PrivateKey privateKey = ServiceAccountCredentials.privateKeyFromPkcs8(PRIVATE_KEY_PKCS8);
GoogleCredentials credentials =
ServiceAccountCredentials.newBuilder()
.setClientId(CLIENT_ID)
.setClientEmail(CLIENT_EMAIL)
.setPrivateKey(privateKey)
.setPrivateKeyId(PRIVATE_KEY_ID)
.setProjectId(PROJECT_ID)
.setHttpTransportFactory(new MockTokenServerTransportFactory())
.build();

Expand All @@ -1393,7 +1427,6 @@ public void getRequestMetadata_selfSignedJWT_withDefaultScopes() throws IOExcept
.setPrivateKey(privateKey)
.setPrivateKeyId(PRIVATE_KEY_ID)
.setScopes(null, SCOPES)
.setServiceAccountUser(USER)
.setProjectId(PROJECT_ID)
.setHttpTransportFactory(new MockTokenServerTransportFactory())
.setUseJwtAccessWithScope(true)
Expand All @@ -1412,7 +1445,6 @@ public void getRequestMetadataWithCallback_selfSignedJWT() throws IOException {
.setClientEmail(CLIENT_EMAIL)
.setPrivateKey(privateKey)
.setPrivateKeyId(PRIVATE_KEY_ID)
.setServiceAccountUser(USER)
.setProjectId(PROJECT_ID)
.setQuotaProjectId("my-quota-project-id")
.setHttpTransportFactory(new MockTokenServerTransportFactory())
Expand Down
2 changes: 0 additions & 2 deletions oauth2_http/javatests/com/google/auth/oauth2/TokenVerifierTest.java
View file
Open in desktop
Expand Up @@ -242,8 +242,6 @@ public void verifyRs256TokenWithLegacyCertificateUrlFormat()
@Test
public void verifyServiceAccountRs256Token()
throws TokenVerifier.VerificationException, IOException {
HttpTransportFactory httpTransportFactory =
arithmetic1728 marked this conversation as resolved.
Show resolved Hide resolved
mockTransport(SERVICE_ACCOUNT_CERT_URL, readResourceAsString("service_account_keys.json"));
TokenVerifier tokenVerifier =
TokenVerifier.newBuilder()
.setClock(FIXED_CLOCK)
Expand Down