search

googleapis / google-auth-library-ruby

Google Auth Library for Ruby
Apache License 2.0
471 stars 254 forks source link

fix: GCECredentials - Allow retrieval of ID token #425

Closed StupidCodeFactory closed 1 year ago

StupidCodeFactory commented 1 year ago

CONTEXT:

While deploying a couple of services on Cloud RUN:

  1. service A running with service account A
  2. service B running with service account B
  3. I added roles/run.invoker for service account B on service A.

I expected to be able to retrieve an ID token and be able to call service A from service B. After some debugging I realised I was getting an access_token rather then an id_token. I tracked it down to the GCECredentials instantiation only passing the scope to the subclass of the Signet::Oauth2::Client, hence not being able to pass the target_audience for retrieve an id_token

I believe this should fix: https://github.com/googleapis/google-auth-library-ruby/issues/299

google-cla[bot] commented 1 year ago

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

conventional-commit-lint-gcf[bot] commented 1 year ago

🤖 I detect that the PR title and the commit message differ and there's only one commit. To use the PR title for the commit history, you can use Github's automerge feature with squashing, or use automerge label. Good luck human!

-- conventional-commit-lint bot https://conventionalcommits.org/

bajajneha27 commented 1 year ago

@StupidCodeFactory , you'd have to update your branch with main.