googleapis / googleapis/google-cloud-python

PubSub client does not read domain delegated credentials

Abierto
#15,208 3 comentarios 0 reacciones 1 asignado Reclamado por @arithmetic1728 Ver en GitHub
type: feature request
Lenguaje dominante
Python
Estrellas
5.4k
Forks
1.8k
Merge medio
3 d 4 h
PR fusionados (30 d)
122

Descripción

Credentials that are enabled for domain delegation is ignored with google-cloud-Pubsub (and possibly other gRPC based service clients).

THis is a relatively rare usecase but consider the snippet below.

the service account in question is enalbed by thw workspace admin to do domain_delegation over the scopes proved. The svc account assumes the identity of `user1@domain` and the credentials object contains that users' access_token.

I can use that client to access GCS _as user1@domain.com`

if i acquire the raw authorizedsession, i can access pubsub with direct API call

however, if i pass the credential into a pubsub client, it seems to reset and reacquire credentials representing the original service account.

I'm pretty sure thats the case here since as-is the snippet will fail but if enable the service account permissions ont he pubsub topic, the last step succeeds

```python
project='your_project'

import google.auth
from google.oauth2 import service_account

target_scopes = ["https://www.googleapis.com/auth/cloud-platform",
"https://www.googleapis.com/auth/admin.directory.user.readonly"]

credentials = service_account.Credentials.from_service_account_file(
'/path/to/svc_account.json',
scopes=target_scopes,
subject='user1@domain.com')

from google.cloud import storage
client = storage.Client(project=project, credentials=credentials)
for b in client.list_buckets():
print(b.name)

from google.cloud import pubsub_v1
from google.auth.transport.requests import AuthorizedSession
project_path = f"projects/{project}"
authed_session = AuthorizedSession(credentials)
response = authed_session.request('GET', 'https://pubsub.googleapis.com/v1/{}/topics'.format(project_path))
print(response.json())

# ## bug:
publisher = pubsub_v1.PublisherClient(credentials=credentials)
for topic in publisher.list_topics(request={"project": project_path}):
print(topic.name)
````

```
google-api-core==2.0.1
google-api-python-client==2.24.0
google-auth==2.1.0
google-auth-httplib2==0.1.0
google-cloud-core==2.0.0
google-cloud-pubsub==2.9.0
google-cloud-storage==1.42.3
```

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.