Package com.google.auth.oauth2

Class ExternalAccountCredentials

java.lang.Object

com.google.auth.Credentials

com.google.auth.oauth2.OAuth2Credentials

com.google.auth.oauth2.GoogleCredentials

com.google.auth.oauth2.ExternalAccountCredentials

All Implemented Interfaces:

QuotaProjectIdProvider, Serializable

Direct Known Subclasses:

AwsCredentials, IdentityPoolCredentials, PluggableAuthCredentials

public abstract class ExternalAccountCredentials
extends GoogleCredentials

Base external account credentials class.

Handles initializing external credentials, calls to the Security Token Service, and service account impersonation.

See Also:

• Serialized Form

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	ExternalAccountCredentials.Builder	Base builder for external account credentials.
static enum	ExternalAccountCredentials.SubjectTokenTypes	Enum specifying values for the subjectTokenType field in ExternalAccountCredentials.

Nested classes/interfaces inherited from class com.google.auth.oauth2.OAuth2Credentials

OAuth2Credentials.CredentialsChangedListener

Field Summary

Fields

Modifier and Type	Field	Description
protected ImpersonatedCredentials	impersonatedCredentials
protected HttpTransportFactory	transportFactory

Fields inherited from class com.google.auth.oauth2.GoogleCredentials

quotaProjectId

Fields inherited from class com.google.auth.Credentials

GOOGLE_DEFAULT_UNIVERSE

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	ExternalAccountCredentials(HttpTransportFactory transportFactory, String audience, String subjectTokenType, String tokenUrl, com.google.auth.oauth2.ExternalAccountCredentials.CredentialSource credentialSource, String tokenInfoUrl, String serviceAccountImpersonationUrl, String quotaProjectId, String clientId, String clientSecret, Collection<String> scopes)	Constructor with minimum identifying information and custom HTTP transport.
protected	ExternalAccountCredentials(HttpTransportFactory transportFactory, String audience, String subjectTokenType, String tokenUrl, com.google.auth.oauth2.ExternalAccountCredentials.CredentialSource credentialSource, String tokenInfoUrl, String serviceAccountImpersonationUrl, String quotaProjectId, String clientId, String clientSecret, Collection<String> scopes, EnvironmentProvider environmentProvider)	Constructor with minimum identifying information and custom HTTP transport.
protected	ExternalAccountCredentials(ExternalAccountCredentials.Builder builder)	Internal constructor with minimum identifying information and custom HTTP transport.

Method Summary

Modifier and Type	Method	Description
protected AccessToken	exchangeExternalCredentialForAccessToken(StsTokenExchangeRequest stsTokenExchangeRequest)	Exchanges the external credential for a Google Cloud access token.
static ExternalAccountCredentials	fromStream(InputStream credentialsStream)	Returns credentials defined by a JSON file stream.
static ExternalAccountCredentials	fromStream(InputStream credentialsStream, HttpTransportFactory transportFactory)	Returns credentials defined by a JSON file stream.
String	getAudience()
String	getClientId()
String	getClientSecret()
com.google.auth.oauth2.ExternalAccountCredentials.CredentialSource	getCredentialSource()
Map<String,List<String>>	getRequestMetadata(URI uri)	Provide the request metadata by ensuring there is a current access token and providing it as an authorization bearer token.
void	getRequestMetadata(URI uri, Executor executor, RequestMetadataCallback callback)
Collection<String>	getScopes()
String	getServiceAccountEmail()
com.google.auth.oauth2.ExternalAccountCredentials.ServiceAccountImpersonationOptions	getServiceAccountImpersonationOptions()
String	getServiceAccountImpersonationUrl()
String	getSubjectTokenType()
String	getTokenInfoUrl()
String	getTokenUrl()
String	getUniverseDomain()	Gets the universe domain for the credential.
String	getWorkforcePoolUserProject()
boolean	isWorkforcePoolConfiguration()
abstract String	retrieveSubjectToken()	Retrieves the external subject token to be exchanged for a Google Cloud access token.

Methods inherited from class com.google.auth.oauth2.GoogleCredentials

create, create, createDelegated, createScoped, createScoped, createScoped, createScopedRequired, createWithCustomRetryStrategy, createWithQuotaProject, equals, getAdditionalHeaders, getApplicationDefault, getApplicationDefault, getCredentialInfo, getProjectId, getQuotaProjectId, hashCode, isExplicitUniverseDomain, newBuilder, toBuilder, toString, toStringHelper

Methods inherited from class com.google.auth.oauth2.OAuth2Credentials

addChangeListener, getAccessToken, getAuthenticationType, getFromServiceLoader, getRequestMetadataInternal, hasRequestMetadata, hasRequestMetadataOnly, newInstance, refresh, refreshAccessToken, refreshIfExpired, removeChangeListener

Methods inherited from class com.google.auth.Credentials

blockingGetToCallback, getMetricsCredentialType, getRequestMetadata

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, wait, wait, wait

Field Details

transportFactory

protected transient HttpTransportFactory transportFactory

impersonatedCredentials

@Nullable
protected ImpersonatedCredentials impersonatedCredentials

Constructor Details

ExternalAccountCredentials

protected ExternalAccountCredentials(HttpTransportFactory transportFactory,
 String audience,
 String subjectTokenType,
 String tokenUrl,
 com.google.auth.oauth2.ExternalAccountCredentials.CredentialSource credentialSource,
 @Nullable
 String tokenInfoUrl,
 @Nullable
 String serviceAccountImpersonationUrl,
 @Nullable
 String quotaProjectId,
 @Nullable
 String clientId,
 @Nullable
 String clientSecret,
 @Nullable
 Collection<String> scopes)

Constructor with minimum identifying information and custom HTTP transport. Does not support workforce credentials.

Parameters:

transportFactory - HTTP transport factory, creates the transport used to get access tokens

audience - the Security Token Service audience, which is usually the fully specified resource name of the workload/workforce pool provider

subjectTokenType - the Security Token Service subject token type based on the OAuth 2.0 token exchange spec. Indicates the type of the security token in the credential file

tokenUrl - the Security Token Service token exchange endpoint

tokenInfoUrl - the endpoint used to retrieve account related information. Required for gCloud session account identification.

credentialSource - the external credential source

serviceAccountImpersonationUrl - the URL for the service account impersonation request. This URL is required for some APIs. If this URL is not available, the access token from the Security Token Service is used directly. May be null.

quotaProjectId - the project used for quota and billing purposes. May be null.

clientId - client ID of the service account from the console. May be null.

clientSecret - client secret of the service account from the console. May be null.

scopes - the scopes to request during the authorization grant. May be null.

ExternalAccountCredentials

protected ExternalAccountCredentials(HttpTransportFactory transportFactory,
 String audience,
 String subjectTokenType,
 String tokenUrl,
 com.google.auth.oauth2.ExternalAccountCredentials.CredentialSource credentialSource,
 @Nullable
 String tokenInfoUrl,
 @Nullable
 String serviceAccountImpersonationUrl,
 @Nullable
 String quotaProjectId,
 @Nullable
 String clientId,
 @Nullable
 String clientSecret,
 @Nullable
 Collection<String> scopes,
 @Nullable
 EnvironmentProvider environmentProvider)

Constructor with minimum identifying information and custom HTTP transport. Does not support workforce credentials.

Parameters:

transportFactory - HTTP transport factory, creates the transport used to get access tokens

audience - the Security Token Service audience, which is usually the fully specified resource name of the workload/workforce pool provider

subjectTokenType - the Security Token Service subject token type based on the OAuth 2.0 token exchange spec. Indicates the type of the security token in the credential file

tokenUrl - the Security Token Service token exchange endpoint

tokenInfoUrl - the endpoint used to retrieve account related information. Required for gCloud session account identification.

credentialSource - the external credential source

serviceAccountImpersonationUrl - the URL for the service account impersonation request. This URL is required for some APIs. If this URL is not available, the access token from the Security Token Service is used directly. May be null.

quotaProjectId - the project used for quota and billing purposes. May be null.

clientId - client ID of the service account from the console. May be null.

clientSecret - client secret of the service account from the console. May be null.

scopes - the scopes to request during the authorization grant. May be null.

environmentProvider - the environment provider. May be null. Defaults to SystemEnvironmentProvider.

ExternalAccountCredentials

protected ExternalAccountCredentials(ExternalAccountCredentials.Builder builder)

Internal constructor with minimum identifying information and custom HTTP transport. See ExternalAccountCredentials.Builder.

Parameters:

builder - the Builder object used to construct the credentials.

Method Details

getRequestMetadata

public void getRequestMetadata(URI uri,
 Executor executor,
 RequestMetadataCallback callback)

Overrides:

getRequestMetadata in class OAuth2Credentials

getUniverseDomain

public String getUniverseDomain()

Description copied from class: GoogleCredentials

Gets the universe domain for the credential.

Overrides:

getUniverseDomain in class GoogleCredentials

Returns:

An explicit universe domain if it was explicitly provided, invokes the super implementation otherwise

getRequestMetadata

public Map<String,List<String>> getRequestMetadata(URI uri)
                                            throws IOException

Description copied from class: OAuth2Credentials

Provide the request metadata by ensuring there is a current access token and providing it as an authorization bearer token.

Overrides:

getRequestMetadata in class OAuth2Credentials

Throws:

IOException

fromStream

public static ExternalAccountCredentials fromStream(InputStream credentialsStream)
                                             throws IOException

Returns credentials defined by a JSON file stream.

Returns IdentityPoolCredentials or AwsCredentials.

Important: If you accept a credential configuration (credential JSON/File/Stream) from an external source for authentication to Google Cloud Platform, you must validate it before providing it to any Google API or library. Providing an unvalidated credential configuration to Google APIs can compromise the security of your systems and data. For more information, refer to .

Parameters:

credentialsStream - the stream with the credential definition

Returns:

the credential defined by the credentialsStream

Throws:

IOException - if the credential cannot be created from the stream

fromStream

public static ExternalAccountCredentials fromStream(InputStream credentialsStream,
 HttpTransportFactory transportFactory)
                                             throws IOException

Returns credentials defined by a JSON file stream.

Returns a IdentityPoolCredentials or AwsCredentials.

Important: If you accept a credential configuration (credential JSON/File/Stream) from an external source for authentication to Google Cloud Platform, you must validate it before providing it to any Google API or library. Providing an unvalidated credential configuration to Google APIs can compromise the security of your systems and data. For more information, refer to .

Parameters:

credentialsStream - the stream with the credential definition

transportFactory - the HTTP transport factory used to create the transport to get access tokens

Returns:

the credential defined by the credentialsStream

Throws:

IOException - if the credential cannot be created from the stream

exchangeExternalCredentialForAccessToken

protected AccessToken exchangeExternalCredentialForAccessToken(StsTokenExchangeRequest stsTokenExchangeRequest)
                                                        throws IOException

Exchanges the external credential for a Google Cloud access token.

Parameters:

stsTokenExchangeRequest - the Security Token Service token exchange request

Returns:

the access token returned by the Security Token Service

Throws:

com.google.auth.oauth2.OAuthException - if the call to the Security Token Service fails

IOException

retrieveSubjectToken

public abstract String retrieveSubjectToken()
                                     throws IOException

Retrieves the external subject token to be exchanged for a Google Cloud access token.

Must be implemented by subclasses as the retrieval method is dependent on the credential source.

Returns:

the external subject token

Throws:

IOException - if the subject token cannot be retrieved

getAudience

public String getAudience()

getSubjectTokenType

public String getSubjectTokenType()

getTokenUrl

public String getTokenUrl()

getTokenInfoUrl

public String getTokenInfoUrl()

getCredentialSource

public com.google.auth.oauth2.ExternalAccountCredentials.CredentialSource getCredentialSource()

getServiceAccountImpersonationUrl

@Nullable
public String getServiceAccountImpersonationUrl()

getServiceAccountEmail

@Nullable
public String getServiceAccountEmail()

Returns:

The service account email to be impersonated, if available

getClientId

@Nullable
public String getClientId()

getClientSecret

@Nullable
public String getClientSecret()

getScopes

@Nullable
public Collection<String> getScopes()

getWorkforcePoolUserProject

@Nullable
public String getWorkforcePoolUserProject()

getServiceAccountImpersonationOptions

@Nullable
public com.google.auth.oauth2.ExternalAccountCredentials.ServiceAccountImpersonationOptions getServiceAccountImpersonationOptions()

isWorkforcePoolConfiguration

public boolean isWorkforcePoolConfiguration()

Returns:

whether the current configuration is for Workforce Pools (which enable 3p user identities, rather than workloads)