cloudendpoints / endpoints-management-python

A Python library for managing API services using Google's Service Control APIs
Apache License 2.0
19 stars 22 forks source link

Token verification problem on GAE standard #41

Closed fed239 closed 7 years ago

fed239 commented 7 years ago

I'm trying to implement service-to-service authentication to Google Cloud Endpoints API using Google Service account, but get the following error.

Cannot decode and verify the auth token. The backend will not be able to retrieve user info (.../lib/endpoints_management/control/wsgi.py:596)
Traceback (most recent call last):
  File ".../lib/endpoints_management/control/wsgi.py", line 593, in __call__
    service_name)
  File ".../lib/endpoints_management/auth/tokens.py", line 81, in authenticate
    error)
UnauthenticatedException: (u'Cannot decode the auth token', UnicodeDecodeError('ascii', '\xc9\xad\xbd', 0, 1, 'ordinal not in range(128)'))

Value of auth_token variable passed to self.get_jwt_claims(auth_token) is ya29.ElmlBB1mwIfrsnURUIQg0Nv6v5UPzFR02miD4w_VywMSlWGDstpmmc5vPsmUqt5rCcho797B1HeEOgT0UBQiVfv9dlsfxSMLRf67SGwX0ceK5uTujj4_tSUXog

Looks like endpoints library is trying to decode auth_token as jwt, but auth_token is not jwt. But maybe I'm wrong. Same problem occurs when I'm trying to test API using API Explorer. This happens with the latest endpoints and also with older version.

Here is my API class:

@endpoints.api(
    name='myapi',
    version='v1',
    api_key_required=True,
    auth_level=endpoints.AUTH_LEVEL.REQUIRED,
    scopes=(
        endpoints.EMAIL_SCOPE,
    ),
)
class MyApi(remote.Service):
    ...

And this is how i I'm accessing the API:

    credentials = ServiceAccountCredentials.from_json_keyfile_dict(
        json.loads(json_keyfile_data),
        scopes='https://www.googleapis.com/auth/userinfo.email',
    )
    # credentials = AppAssertionCredentials(
    #         'https://www.googleapis.com/auth/userinfo.email',
    # )
    service = build(
        name, version,
        http=credentials.authorize(Http()),
        discoveryServiceUrl=discovery_url)
    ...
fed239 commented 7 years ago

I didn't know that endpoints expects JWT id_token in the authentication header. Although there could better diagnostics (token check) & more meaningful error message.