This PR adds services accounts as a capability within SWAT for authentication. The reason being for adversary emulation/simulation with another Google Account. The main SWAT tool will use OAuth, thus requiring the OAuth workflow and consent.
It also cleans up main.py and removes the need to start the shell with credentials so a user can just start the shell by calling swat. Once in, use authenticate --help to understand what is possible.
_authenticate_service_account can be used to return creds necessary in an emulation module to build a service client for one of Google Workspace's services. SWAT will also check environment variables first for credentials or a token before referencing a file.
We will need to update the docs for this. I avoided using service accounts only for SWAT as it would make this tool an "off-the-shelf" target by skiddies whom may have simply compromised service account credentials.
add option to store account data and access throughout SWAT
Overview
This PR adds services accounts as a capability within SWAT for authentication. The reason being for adversary emulation/simulation with another Google Account. The main SWAT tool will use OAuth, thus requiring the OAuth workflow and consent.
It also cleans up
main.py
and removes the need to start the shell with credentials so a user can just start the shell by callingswat
. Once in, useauthenticate --help
to understand what is possible._authenticate_service_account
can be used to return creds necessary in an emulation module to build a service client for one of Google Workspace's services. SWAT will also check environment variables first for credentials or a token before referencing a file.We will need to update the docs for this. I avoided using service accounts only for SWAT as it would make this tool an "off-the-shelf" target by skiddies whom may have simply compromised service account credentials.