googleapis / googleapis/google-cloud-java

[sdk-platform-java] gax: investigate GoogleCredentialsProvider JWT with scopes with service account workflows

未关闭
#12,424 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
priority: p3 type: cleanup
主要语言
Java
星标
2.1k
派生
1.2k
平均合并
1 天 23 小时
30 天内合并 PR
154

描述

In `GoogleCredentialsProvider`, getCredentials() has 2 JWT with scopes with service account workflows:
- One with [ServiceAccountJwtAccessCredentials](https://github.com/googleapis/sdk-platform-java/blob/eb7475c8fe16661a824d40c99c9bffec47060f24/gax-java/gax/src/main/java/com/google/api/gax/core/GoogleCredentialsProvider.java#L82-L92), which is added at https://github.com/googleapis/gax-java/pull/504. This one predates when ServiceAccountCredentials in auth supports JWT ([part 1](https://github.com/googleapis/google-auth-library-java/pull/572) and [part 2](https://github.com/googleapis/google-auth-library-java/pull/689))
- Another one with service account [here](https://github.com/googleapis/sdk-platform-java/blob/eb7475c8fe16661a824d40c99c9bffec47060f24/gax-java/gax/src/main/java/com/google/api/gax/core/GoogleCredentialsProvider.java#L98-L102) added in https://github.com/googleapis/gax-java/pull/1420, adopting https://google.aip.dev/auth/4111.

These 2 workflows looks suspicious to me, is there reasons why both are needed?

Separately, our guidance is to use ServiceAccountCredentials with SSJWT whenever possible. (see [related issue](https://github.com/googleapis/google-cloud-java/issues/12593)). Thus if both are to keep, the first one can be updated to use ServiceAccountCredentials.

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。