Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: service account is able to use a private token endpoint #835

Merged
merged 3 commits into from Aug 16, 2021
Merged
Show file tree
Hide file tree
Changes from 2 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
5 changes: 3 additions & 2 deletions google/oauth2/service_account.py
Expand Up @@ -80,6 +80,7 @@
from google.oauth2 import _client

_DEFAULT_TOKEN_LIFETIME_SECS = 3600 # 1 hour in seconds
_GOOGLE_OAUTH2_TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token"


class Credentials(
Expand Down Expand Up @@ -382,7 +383,7 @@ def _make_authorization_grant_assertion(self):
# The issuer must be the service account email.
"iss": self._service_account_email,
# The audience must be the auth token endpoint's URI
"aud": self._token_uri,
"aud": _GOOGLE_OAUTH2_TOKEN_ENDPOINT,
"scope": _helpers.scopes_to_string(self._scopes or ()),
}

Expand Down Expand Up @@ -643,7 +644,7 @@ def _make_authorization_grant_assertion(self):
# The issuer must be the service account email.
"iss": self.service_account_email,
# The audience must be the auth token endpoint's URI
"aud": self._token_uri,
"aud": _GOOGLE_OAUTH2_TOKEN_ENDPOINT,
# The target audience specifies which service the ID token is
# intended for.
"target_audience": self._target_audience,
Expand Down
4 changes: 2 additions & 2 deletions tests/oauth2/test_service_account.py
Expand Up @@ -167,7 +167,7 @@ def test__make_authorization_grant_assertion(self):
token = credentials._make_authorization_grant_assertion()
payload = jwt.decode(token, PUBLIC_CERT_BYTES)
assert payload["iss"] == self.SERVICE_ACCOUNT_EMAIL
assert payload["aud"] == self.TOKEN_URI
assert payload["aud"] == service_account._GOOGLE_OAUTH2_TOKEN_ENDPOINT

def test__make_authorization_grant_assertion_scoped(self):
credentials = self.make_credentials()
Expand Down Expand Up @@ -440,7 +440,7 @@ def test__make_authorization_grant_assertion(self):
token = credentials._make_authorization_grant_assertion()
payload = jwt.decode(token, PUBLIC_CERT_BYTES)
assert payload["iss"] == self.SERVICE_ACCOUNT_EMAIL
assert payload["aud"] == self.TOKEN_URI
assert payload["aud"] == service_account._GOOGLE_OAUTH2_TOKEN_ENDPOINT
assert payload["target_audience"] == self.TARGET_AUDIENCE

@mock.patch("google.oauth2._client.id_token_jwt_grant", autospec=True)
Expand Down
10 changes: 8 additions & 2 deletions tests_async/oauth2/test_service_account_async.py
Expand Up @@ -152,7 +152,10 @@ def test__make_authorization_grant_assertion(self):
token = credentials._make_authorization_grant_assertion()
payload = jwt.decode(token, test_service_account.PUBLIC_CERT_BYTES)
assert payload["iss"] == self.SERVICE_ACCOUNT_EMAIL
assert payload["aud"] == self.TOKEN_URI
assert (
payload["aud"]
== service_account.service_account._GOOGLE_OAUTH2_TOKEN_ENDPOINT
)

def test__make_authorization_grant_assertion_scoped(self):
credentials = self.make_credentials()
Expand Down Expand Up @@ -311,7 +314,10 @@ def test__make_authorization_grant_assertion(self):
token = credentials._make_authorization_grant_assertion()
payload = jwt.decode(token, test_service_account.PUBLIC_CERT_BYTES)
assert payload["iss"] == self.SERVICE_ACCOUNT_EMAIL
assert payload["aud"] == self.TOKEN_URI
assert (
payload["aud"]
== service_account.service_account._GOOGLE_OAUTH2_TOKEN_ENDPOINT
)
assert payload["target_audience"] == self.TARGET_AUDIENCE

@mock.patch("google.oauth2._client_async.id_token_jwt_grant", autospec=True)
Expand Down