googleapis / googleapis/google-cloud-python

PubSub client does not read domain delegated credentials

Đang mở
#15,208 3 bình luận 0 reaction 1 người được giao Được @arithmetic1728 nhận Xem trên GitHub
type: feature request
Ngôn ngữ chính
Python
Star
5.4k
Fork
1.8k
Merge trung bình
3 ngày 4 giờ
Pull request đã merge (30 ngày)
122

Mô tả

Credentials that are enabled for domain delegation is ignored with google-cloud-Pubsub (and possibly other gRPC based service clients).

THis is a relatively rare usecase but consider the snippet below.

the service account in question is enalbed by thw workspace admin to do domain_delegation over the scopes proved. The svc account assumes the identity of `user1@domain` and the credentials object contains that users' access_token.

I can use that client to access GCS _as user1@domain.com`

if i acquire the raw authorizedsession, i can access pubsub with direct API call

however, if i pass the credential into a pubsub client, it seems to reset and reacquire credentials representing the original service account.

I'm pretty sure thats the case here since as-is the snippet will fail but if enable the service account permissions ont he pubsub topic, the last step succeeds

```python
project='your_project'

import google.auth
from google.oauth2 import service_account

target_scopes = ["https://www.googleapis.com/auth/cloud-platform",
"https://www.googleapis.com/auth/admin.directory.user.readonly"]

credentials = service_account.Credentials.from_service_account_file(
'/path/to/svc_account.json',
scopes=target_scopes,
subject='user1@domain.com')

from google.cloud import storage
client = storage.Client(project=project, credentials=credentials)
for b in client.list_buckets():
print(b.name)

from google.cloud import pubsub_v1
from google.auth.transport.requests import AuthorizedSession
project_path = f"projects/{project}"
authed_session = AuthorizedSession(credentials)
response = authed_session.request('GET', 'https://pubsub.googleapis.com/v1/{}/topics'.format(project_path))
print(response.json())

# ## bug:
publisher = pubsub_v1.PublisherClient(credentials=credentials)
for topic in publisher.list_topics(request={"project": project_path}):
print(topic.name)
````

```
google-api-core==2.0.1
google-api-python-client==2.24.0
google-auth==2.1.0
google-auth-httplib2==0.1.0
google-cloud-core==2.0.0
google-cloud-pubsub==2.9.0
google-cloud-storage==1.42.3
```

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.