peburrows / goth

Elixir package for Oauth authentication via Google Cloud APIs
http://hexdocs.pm/goth
MIT License
289 stars 111 forks source link

Fix metadata token path and simplify calling #89

Closed mcrumm closed 3 years ago

mcrumm commented 3 years ago

Ref: #82, #85

I realized too late that I had the path wrong in my last PR 🙈

http://metadata.google.internal/computeMetadata/v1/instance/default/token vs. http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token

Additionally I went ahead and implemented the "magic" URL override, and ultimately I did something similar for scope that might be a little bit more controversial. Looking forward to feedback :) tl;dr there are instances where you want to pass scope to the metadata server, but in the most common use case(GCE/GKE) do not want to/it is not allowed.

See https://cloud.google.com/run/docs/securing/service-identity#access_tokens for a better explanation. Primarily it's App Engine/Cloud Run may need to set scope for service instance access tokens, and everyone else can/will ignore scope for their service accounts.

wojtekmach commented 3 years ago

@mcrumm I'm gonna close this in favour of #91 as I believe I found a cleaner solution but please let me know otherwise! :)

Basically we'd now configure it like this:

Generate a token using a service account credentials file:

    iex> credentials = "credentials.json" |> File.read!() |> Jason.decode!()
    iex> Goth.start_link(name: MyApp.Goth, source: {:service_account, credentials, []})
    iex> Goth.fetch(MyApp.Goth)
    {:ok, %Goth.Token{...}}

Retrieve the token using a refresh token:

    iex> credentials = "credentials.json" |> File.read!() |> Jason.decode!()
    iex> Goth.start_link(name: MyApp.Goth, source: {:refresh_token, credentials, []})
    iex> Goth.fetch(MyApp.Goth)
    {:ok, %Goth.Token{...}}

Retrieve the token using the Google metadata server:

    iex> Goth.start_link(name: MyApp.Goth, source: {:metadata, []})
    iex> Goth.fetch(MyApp.Goth)
    {:ok, %Goth.Token{...}}
wojtekmach commented 3 years ago

For now, we won't be able to set scope when using refresh token or metadata as support for that is shaky, however it's gonna be super easy to add it later if someone wants it.

mcrumm commented 3 years ago

All good, thanks @wojtekmach !