googleapis / googleapis/google-cloud-python
PubSub client does not read domain delegated credentials
- Langage dominant
- Python
- Étoiles
- 5.4k
- Forks
- 1.8k
- Merge moyen
- 3 j 4 h
- PR mergées (30 j)
- 122
Description
Credentials that are enabled for domain delegation is ignored with google-cloud-Pubsub (and possibly other gRPC based service clients).
THis is a relatively rare usecase but consider the snippet below.
the service account in question is enalbed by thw workspace admin to do domain_delegation over the scopes proved. The svc account assumes the identity of `user1@domain` and the credentials object contains that users' access_token.
I can use that client to access GCS _as user1@domain.com`
if i acquire the raw authorizedsession, i can access pubsub with direct API call
however, if i pass the credential into a pubsub client, it seems to reset and reacquire credentials representing the original service account.
I'm pretty sure thats the case here since as-is the snippet will fail but if enable the service account permissions ont he pubsub topic, the last step succeeds
```python
project='your_project'
import google.auth
from google.oauth2 import service_account
target_scopes = ["https://www.googleapis.com/auth/cloud-platform",
"https://www.googleapis.com/auth/admin.directory.user.readonly"]
credentials = service_account.Credentials.from_service_account_file(
'/path/to/svc_account.json',
scopes=target_scopes,
subject='user1@domain.com')
from google.cloud import storage
client = storage.Client(project=project, credentials=credentials)
for b in client.list_buckets():
print(b.name)
from google.cloud import pubsub_v1
from google.auth.transport.requests import AuthorizedSession
project_path = f"projects/{project}"
authed_session = AuthorizedSession(credentials)
response = authed_session.request('GET', 'https://pubsub.googleapis.com/v1/{}/topics'.format(project_path))
print(response.json())
# ## bug:
publisher = pubsub_v1.PublisherClient(credentials=credentials)
for topic in publisher.list_topics(request={"project": project_path}):
print(topic.name)
````
```
google-api-core==2.0.1
google-api-python-client==2.24.0
google-auth==2.1.0
google-auth-httplib2==0.1.0
google-cloud-core==2.0.0
google-cloud-pubsub==2.9.0
google-cloud-storage==1.42.3
```
Guide de contribution
Ouvrir le guide de contribution
Évaluation
Cette issue n'a pas encore été évaluée.