Skip to content

Commit d3ed898

Browse files
gIthurielcodyoss
gIthuriel
authored and
codyoss
committed
google: support url-sourced 3rd party credentials
Implements functionality to allow for URL-sourced 3rd party credentials, expanding the functionality added in #462 . Change-Id: Ib7615fb618486612960d60bee6b9a1ecf5de1404 GitHub-Last-Rev: 9571392 GitHub-Pull-Request: #466 Reviewed-on: https://go-review.googlesource.com/c/oauth2/+/283372 Run-TryBot: Cody Oss <codyoss@google.com> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Cody Oss <codyoss@google.com> Trust: Tyler Bui-Palsulich <tbp@google.com> Trust: Cody Oss <codyoss@google.com>
1 parent 8b1d76f commit d3ed898

File tree

5 files changed

+185
-20
lines changed

5 files changed

+185
-20
lines changed

‎google/google.go‎

Lines changed: 16 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -115,14 +115,13 @@ type credentialsFile struct {
115115
RefreshToken string `json:"refresh_token"`
116116

117117
// External Account fields
118-
Audience string `json:"audience"`
119-
SubjectTokenType string `json:"subject_token_type"`
120-
TokenURLExternal string `json:"token_url"`
121-
TokenInfoURL string `json:"token_info_url"`
122-
ServiceAccountImpersonationURL string `json:"service_account_impersonation_url"`
123-
CredentialSource externalaccount.CredentialSource `json:"credential_source"`
124-
QuotaProjectID string `json:"quota_project_id"`
125-
118+
Audience string `json:"audience"`
119+
SubjectTokenType string `json:"subject_token_type"`
120+
TokenURLExternal string `json:"token_url"`
121+
TokenInfoURL string `json:"token_info_url"`
122+
ServiceAccountImpersonationURL string `json:"service_account_impersonation_url"`
123+
CredentialSource externalaccount.CredentialSource `json:"credential_source"`
124+
QuotaProjectID string `json:"quota_project_id"`
126125
}
127126

128127
func (f *credentialsFile) jwtConfig(scopes []string) *jwt.Config {
@@ -155,16 +154,16 @@ func (f *credentialsFile) tokenSource(ctx context.Context, scopes []string) (oau
155154
return cfg.TokenSource(ctx, tok), nil
156155
case externalAccountKey:
157156
cfg := &externalaccount.Config{
158-
Audience: f.Audience,
159-
SubjectTokenType: f.SubjectTokenType,
160-
TokenURL: f.TokenURLExternal,
161-
TokenInfoURL: f.TokenInfoURL,
157+
Audience: f.Audience,
158+
SubjectTokenType: f.SubjectTokenType,
159+
TokenURL: f.TokenURLExternal,
160+
TokenInfoURL: f.TokenInfoURL,
162161
ServiceAccountImpersonationURL: f.ServiceAccountImpersonationURL,
163-
ClientSecret: f.ClientSecret,
164-
ClientID: f.ClientID,
165-
CredentialSource: f.CredentialSource,
166-
QuotaProjectID: f.QuotaProjectID,
167-
Scopes: scopes,
162+
ClientSecret: f.ClientSecret,
163+
ClientID: f.ClientID,
164+
CredentialSource: f.CredentialSource,
165+
QuotaProjectID: f.QuotaProjectID,
166+
Scopes: scopes,
168167
}
169168
return cfg.TokenSource(ctx), nil
170169
case "":

‎google/internal/externalaccount/basecredentials.go‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -66,9 +66,11 @@ type CredentialSource struct {
6666
}
6767

6868
// parse determines the type of CredentialSource needed
69-
func (c *Config) parse() baseCredentialSource {
69+
func (c *Config) parse(ctx context.Context) baseCredentialSource {
7070
if c.CredentialSource.File != "" {
7171
return fileCredentialSource{File: c.CredentialSource.File, Format: c.CredentialSource.Format}
72+
} else if c.CredentialSource.URL != "" {
73+
return urlCredentialSource{URL: c.CredentialSource.URL, Format: c.CredentialSource.Format, ctx: ctx}
7274
}
7375
return nil
7476
}
@@ -87,7 +89,7 @@ type tokenSource struct {
8789
func (ts tokenSource) Token() (*oauth2.Token, error) {
8890
conf := ts.conf
8991

90-
credSource := conf.parse()
92+
credSource := conf.parse(ts.ctx)
9193
if credSource == nil {
9294
return nil, fmt.Errorf("oauth2/google: unable to parse credential source")
9395
}

‎google/internal/externalaccount/filecredsource_test.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
package externalaccount
66

77
import (
8+
"context"
89
"testing"
910
)
1011

@@ -55,7 +56,7 @@ func TestRetrieveFileSubjectToken(t *testing.T) {
5556
tfc.CredentialSource = test.cs
5657

5758
t.Run(test.name, func(t *testing.T) {
58-
out, err := tfc.parse().subjectToken()
59+
out, err := tfc.parse(context.Background()).subjectToken()
5960
if err != nil {
6061
t.Errorf("Method subjectToken() errored.")
6162
} else if test.want != out {

‎google/internal/externalaccount/urlcredsource.go‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
// Copyright 2020 The Go Authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style
3+
// license that can be found in the LICENSE file.
4+
5+
package externalaccount
6+
7+
import (
8+
"context"
9+
"encoding/json"
10+
"errors"
11+
"fmt"
12+
"golang.org/x/oauth2"
13+
"io"
14+
"io/ioutil"
15+
"net/http"
16+
)
17+
18+
type urlCredentialSource struct {
19+
URL string
20+
Headers map[string]string
21+
Format format
22+
ctx context.Context
23+
}
24+
25+
func (cs urlCredentialSource) subjectToken() (string, error) {
26+
client := oauth2.NewClient(cs.ctx, nil)
27+
req, err := http.NewRequest("GET", cs.URL, nil)
28+
if err != nil {
29+
return "", fmt.Errorf("oauth2/google: HTTP request for URL-sourced credential failed: %v", err)
30+
}
31+
req = req.WithContext(cs.ctx)
32+
33+
for key, val := range cs.Headers {
34+
req.Header.Add(key, val)
35+
}
36+
resp, err := client.Do(req)
37+
if err != nil {
38+
return "", fmt.Errorf("oauth2/google: invalid response when retrieving subject token: %v", err)
39+
}
40+
defer resp.Body.Close()
41+
42+
tokenBytes, err := ioutil.ReadAll(io.LimitReader(resp.Body, 1<<20))
43+
if err != nil {
44+
return "", fmt.Errorf("oauth2/google: invalid body in subject token URL query: %v", err)
45+
}
46+
47+
switch cs.Format.Type {
48+
case "json":
49+
jsonData := make(map[string]interface{})
50+
err = json.Unmarshal(tokenBytes, &jsonData)
51+
if err != nil {
52+
return "", fmt.Errorf("oauth2/google: failed to unmarshal subject token file: %v", err)
53+
}
54+
val, ok := jsonData[cs.Format.SubjectTokenFieldName]
55+
if !ok {
56+
return "", errors.New("oauth2/google: provided subject_token_field_name not found in credentials")
57+
}
58+
token, ok := val.(string)
59+
if !ok {
60+
return "", errors.New("oauth2/google: improperly formatted subject token")
61+
}
62+
return token, nil
63+
case "text":
64+
return string(tokenBytes), nil
65+
case "":
66+
return string(tokenBytes), nil
67+
default:
68+
return "", errors.New("oauth2/google: invalid credential_source file format type")
69+
}
70+
71+
}

‎google/internal/externalaccount/urlcredsource_test.go‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
// Copyright 2020 The Go Authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style
3+
// license that can be found in the LICENSE file.
4+
5+
package externalaccount
6+
7+
import (
8+
"context"
9+
"encoding/json"
10+
"net/http"
11+
"net/http/httptest"
12+
"testing"
13+
)
14+
15+
var myURLToken = "testTokenValue"
16+
17+
func TestRetrieveURLSubjectToken_Text(t *testing.T) {
18+
ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
19+
if r.Method != "GET" {
20+
t.Errorf("Unexpected request method, %v is found", r.Method)
21+
}
22+
w.Write([]byte("testTokenValue"))
23+
}))
24+
cs := CredentialSource{
25+
URL: ts.URL,
26+
Format: format{Type: fileTypeText},
27+
}
28+
tfc := testFileConfig
29+
tfc.CredentialSource = cs
30+
31+
out, err := tfc.parse(context.Background()).subjectToken()
32+
if err != nil {
33+
t.Fatalf("retrieveSubjectToken() failed: %v", err)
34+
}
35+
if out != myURLToken {
36+
t.Errorf("got %v but want %v", out, myURLToken)
37+
}
38+
}
39+
40+
// Checking that retrieveSubjectToken properly defaults to type text
41+
func TestRetrieveURLSubjectToken_Untyped(t *testing.T) {
42+
ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
43+
if r.Method != "GET" {
44+
t.Errorf("Unexpected request method, %v is found", r.Method)
45+
}
46+
w.Write([]byte("testTokenValue"))
47+
}))
48+
cs := CredentialSource{
49+
URL: ts.URL,
50+
}
51+
tfc := testFileConfig
52+
tfc.CredentialSource = cs
53+
54+
out, err := tfc.parse(context.Background()).subjectToken()
55+
if err != nil {
56+
t.Fatalf("Failed to retrieve URL subject token: %v", err)
57+
}
58+
if out != myURLToken {
59+
t.Errorf("got %v but want %v", out, myURLToken)
60+
}
61+
}
62+
63+
func TestRetrieveURLSubjectToken_JSON(t *testing.T) {
64+
type tokenResponse struct {
65+
TestToken string `json:"SubjToken"`
66+
}
67+
ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
68+
if got, want := r.Method, "GET"; got != want {
69+
t.Errorf("got %v, but want %v", r.Method, want)
70+
}
71+
resp := tokenResponse{TestToken: "testTokenValue"}
72+
jsonResp, err := json.Marshal(resp)
73+
if err != nil {
74+
t.Errorf("Failed to marshal values: %v", err)
75+
}
76+
w.Write(jsonResp)
77+
}))
78+
cs := CredentialSource{
79+
URL: ts.URL,
80+
Format: format{Type: fileTypeJSON, SubjectTokenFieldName: "SubjToken"},
81+
}
82+
tfc := testFileConfig
83+
tfc.CredentialSource = cs
84+
85+
out, err := tfc.parse(context.Background()).subjectToken()
86+
if err != nil {
87+
t.Fatalf("%v", err)
88+
}
89+
if out != myURLToken {
90+
t.Errorf("got %v but want %v", out, myURLToken)
91+
}
92+
}

0 commit comments

Comments
 (0)