Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: auto create self signed jwt cred #1418

Merged
merged 1 commit into from
Nov 14, 2023
Merged

fix: auto create self signed jwt cred #1418

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 5 additions & 7 deletions google/oauth2/service_account.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -417,13 +417,11 @@ def _metric_header_for_usage(self):

@_helpers.copy_docstring(credentials.Credentials)
def refresh(self, request):
if (
self._universe_domain != _DEFAULT_UNIVERSE_DOMAIN
and not self._jwt_credentials
):
raise exceptions.RefreshError(
"self._jwt_credentials is missing for non-default universe domain"
)
if self._always_use_jwt_access and not self._jwt_credentials:
# If self signed jwt should be used but jwt credential is not
# created, try to create one with scopes
self._create_self_signed_jwt(None)

if self._universe_domain != _DEFAULT_UNIVERSE_DOMAIN and self._subject:
raise exceptions.RefreshError(
"domain wide delegation is not supported for non-default universe domain"
Expand Down
Binary file modified system_tests/secrets.tar.enc
View file
Open in desktop
Binary file not shown.
14 changes: 9 additions & 5 deletions tests/oauth2/test_service_account.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -557,12 +557,16 @@ def test_refresh_jwt_not_used_for_domain_wide_delegation(
assert jwt_grant.called
assert not self_signed_jwt_refresh.called

def test_refresh_non_gdu_missing_jwt_credentials(self):
credentials = self.make_credentials(universe_domain="foo")
def test_refresh_missing_jwt_credentials(self):
credentials = self.make_credentials()
credentials = credentials.with_scopes(["foo", "bar"])
credentials = credentials.with_always_use_jwt_access(True)
assert not credentials._jwt_credentials

with pytest.raises(exceptions.RefreshError) as excinfo:
credentials.refresh(None)
assert excinfo.match("self._jwt_credentials is missing")
credentials.refresh(mock.Mock())

# jwt credentials should have been automatically created with scopes
assert credentials._jwt_credentials is not None

def test_refresh_non_gdu_domain_wide_delegation_not_supported(self):
credentials = self.make_credentials(universe_domain="foo")
Expand Down