googleapis / googleapis/google-cloud-java

[sdk-platform-java] gax: investigate GoogleCredentialsProvider JWT with scopes with service account workflows

Abierto
#12,424 0 comentarios 0 reacciones 0 asignados Ver en GitHub
priority: p3 type: cleanup
Lenguaje dominante
Java
Estrellas
2.1k
Forks
1.2k
Merge medio
1 d 23 h
PR fusionados (30 d)
154

Descripción

In `GoogleCredentialsProvider`, getCredentials() has 2 JWT with scopes with service account workflows:
- One with [ServiceAccountJwtAccessCredentials](https://github.com/googleapis/sdk-platform-java/blob/eb7475c8fe16661a824d40c99c9bffec47060f24/gax-java/gax/src/main/java/com/google/api/gax/core/GoogleCredentialsProvider.java#L82-L92), which is added at https://github.com/googleapis/gax-java/pull/504. This one predates when ServiceAccountCredentials in auth supports JWT ([part 1](https://github.com/googleapis/google-auth-library-java/pull/572) and [part 2](https://github.com/googleapis/google-auth-library-java/pull/689))
- Another one with service account [here](https://github.com/googleapis/sdk-platform-java/blob/eb7475c8fe16661a824d40c99c9bffec47060f24/gax-java/gax/src/main/java/com/google/api/gax/core/GoogleCredentialsProvider.java#L98-L102) added in https://github.com/googleapis/gax-java/pull/1420, adopting https://google.aip.dev/auth/4111.

These 2 workflows looks suspicious to me, is there reasons why both are needed?

Separately, our guidance is to use ServiceAccountCredentials with SSJWT whenever possible. (see [related issue](https://github.com/googleapis/google-cloud-java/issues/12593)). Thus if both are to keep, the first one can be updated to use ServiceAccountCredentials.

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.