Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
refactor: add scopes to credentials for provisioners (#163)
* refactor: add scopes to credentials for provisioners, - IamService provides methods for getting credentials from token or service account, using optionally scopes * chore: DEPENDENCIES * refactor: avoid code duplication for credentials, use constants for scopes, improve test coverage * chore: DEPENDENCIES * test: improve coverage of IamServiceImpl * fix: register GCS provisioner types for JSON serialization * fix: register BigQuery provisioner types for JSON serialization * chore: DEPENDENCIES * chore: DEPENDENCIES * refactor: added DefaultCredentialsManager, code clean-up
- Loading branch information
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,48 @@ | ||
| /* | ||
| * Copyright (c) 2024 Google LLC | ||
| * | ||
| * This program and the accompanying materials are made available under the | ||
| * terms of the Apache License, Version 2.0 which is available at | ||
| * https://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| * | ||
| * Contributors: | ||
| * Google LLC - Initial implementation | ||
| * | ||
| */ | ||
|
|
||
| package org.eclipse.edc.gcp.iam; | ||
|
|
||
| import com.google.auth.oauth2.GoogleCredentials; | ||
| import org.eclipse.edc.gcp.common.GcpServiceAccount; | ||
|
|
||
| /** | ||
| * Interface for credentials providing access tokens. | ||
| */ | ||
| public interface CredentialsManager { | ||
| /** | ||
| * Returns the default credentials. | ||
| * | ||
| * @return the {@link GoogleCredentials}. | ||
| */ | ||
| GoogleCredentials getApplicationDefaultCredentials(); | ||
|
|
||
| /** | ||
| * Refresh the credentials if needed. | ||
| * | ||
| * @param credentials the credentials to be refreshed. | ||
| */ | ||
| void refreshCredentials(GoogleCredentials credentials); | ||
|
|
||
| /** | ||
| * Returns the impersonated credentials. | ||
| * | ||
| * @param sourceCredentials the source credentials to start for impersonation. | ||
| * @param serviceAccount the service account to be impersonated. | ||
| * @param lifeTime lifetime of the credentials in seconds. | ||
| * @param scopes the list of scopes to be added to the credentials. | ||
| * @return the impersonated {@link GoogleCredentials}. | ||
| */ | ||
| GoogleCredentials createImpersonated(GoogleCredentials sourceCredentials, GcpServiceAccount serviceAccount, int lifeTime, String... scopes); | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| /* | ||
| * Copyright (c) 2024 Google LLC | ||
| * | ||
| * This program and the accompanying materials are made available under the | ||
| * terms of the Apache License, Version 2.0 which is available at | ||
| * https://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| * | ||
| * Contributors: | ||
| * Google LLC - Initial implementation | ||
| * | ||
| */ | ||
|
|
||
| package org.eclipse.edc.gcp.iam; | ||
|
|
||
| import com.google.auth.oauth2.GoogleCredentials; | ||
| import com.google.auth.oauth2.ImpersonatedCredentials; | ||
| import org.eclipse.edc.gcp.common.GcpException; | ||
| import org.eclipse.edc.gcp.common.GcpServiceAccount; | ||
| import org.eclipse.edc.spi.monitor.Monitor; | ||
|
|
||
| import java.io.IOException; | ||
| import java.util.Arrays; | ||
|
|
||
| /** | ||
| * The DefaultCredentialsManager class provides the implementation of the CredentialsManager | ||
| * interface by means of the standard GCP API to fetch application-default credentials, refresh | ||
| * credentials, and impersonate service accounts. | ||
| */ | ||
| record DefaultCredentialsManager(Monitor monitor) implements CredentialsManager { | ||
| @Override | ||
| public GoogleCredentials getApplicationDefaultCredentials() { | ||
| try { | ||
| return GoogleCredentials.getApplicationDefault(); | ||
| } catch (IOException ioException) { | ||
| monitor.severe("Cannot get application default credentials", ioException); | ||
| throw new GcpException(ioException); | ||
| } | ||
| } | ||
|
|
||
| @Override | ||
| public void refreshCredentials(GoogleCredentials credentials) { | ||
| try { | ||
| credentials.refreshIfExpired(); | ||
| } catch (IOException ioException) { | ||
| monitor.severe("Cannot get refresh the credentials", ioException); | ||
| throw new GcpException(ioException); | ||
| } | ||
| } | ||
|
|
||
| @Override | ||
| public GoogleCredentials createImpersonated(GoogleCredentials sourceCredentials, GcpServiceAccount serviceAccount, int lifeTime, String... scopes) { | ||
| return ImpersonatedCredentials.create( | ||
| sourceCredentials, | ||
| serviceAccount.getEmail(), | ||
| null, | ||
| Arrays.asList(scopes), | ||
| lifeTime); | ||
| } | ||
| } |
Oops, something went wrong.