googleapis / googleapis/google-cloud-java

[sdk-platform-java] gax: investigate GoogleCredentialsProvider JWT with scopes with service account workflows

Open
#12,424 0 comments 0 reactions 0 assignees View on GitHub
priority: p3 type: cleanup
Dominant language
Java
Stars
2.1k
Forks
1.2k
Avg merge
1d 23h
Merged PRs (30d)
154

Description

In `GoogleCredentialsProvider`, getCredentials() has 2 JWT with scopes with service account workflows:
- One with [ServiceAccountJwtAccessCredentials](https://github.com/googleapis/sdk-platform-java/blob/eb7475c8fe16661a824d40c99c9bffec47060f24/gax-java/gax/src/main/java/com/google/api/gax/core/GoogleCredentialsProvider.java#L82-L92), which is added at https://github.com/googleapis/gax-java/pull/504. This one predates when ServiceAccountCredentials in auth supports JWT ([part 1](https://github.com/googleapis/google-auth-library-java/pull/572) and [part 2](https://github.com/googleapis/google-auth-library-java/pull/689))
- Another one with service account [here](https://github.com/googleapis/sdk-platform-java/blob/eb7475c8fe16661a824d40c99c9bffec47060f24/gax-java/gax/src/main/java/com/google/api/gax/core/GoogleCredentialsProvider.java#L98-L102) added in https://github.com/googleapis/gax-java/pull/1420, adopting https://google.aip.dev/auth/4111.

These 2 workflows looks suspicious to me, is there reasons why both are needed?

Separately, our guidance is to use ServiceAccountCredentials with SSJWT whenever possible. (see [related issue](https://github.com/googleapis/google-cloud-java/issues/12593)). Thus if both are to keep, the first one can be updated to use ServiceAccountCredentials.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.