googleapis / googleapis/google-cloud-java
[sdk-platform-java] gax: investigate GoogleCredentialsProvider JWT with scopes with service account workflows
- 主要语言
- Java
- 星标
- 2.1k
- 派生
- 1.2k
- 平均合并
- 1 天 23 小时
- 30 天内合并 PR
- 154
描述
In `GoogleCredentialsProvider`, getCredentials() has 2 JWT with scopes with service account workflows:
- One with [ServiceAccountJwtAccessCredentials](https://github.com/googleapis/sdk-platform-java/blob/eb7475c8fe16661a824d40c99c9bffec47060f24/gax-java/gax/src/main/java/com/google/api/gax/core/GoogleCredentialsProvider.java#L82-L92), which is added at https://github.com/googleapis/gax-java/pull/504. This one predates when ServiceAccountCredentials in auth supports JWT ([part 1](https://github.com/googleapis/google-auth-library-java/pull/572) and [part 2](https://github.com/googleapis/google-auth-library-java/pull/689))
- Another one with service account [here](https://github.com/googleapis/sdk-platform-java/blob/eb7475c8fe16661a824d40c99c9bffec47060f24/gax-java/gax/src/main/java/com/google/api/gax/core/GoogleCredentialsProvider.java#L98-L102) added in https://github.com/googleapis/gax-java/pull/1420, adopting https://google.aip.dev/auth/4111.
These 2 workflows looks suspicious to me, is there reasons why both are needed?
Separately, our guidance is to use ServiceAccountCredentials with SSJWT whenever possible. (see [related issue](https://github.com/googleapis/google-cloud-java/issues/12593)). Thus if both are to keep, the first one can be updated to use ServiceAccountCredentials.
贡献指南
评估
这个 Issue 还没有评估数据。