OLD | NEW |
1 # Copyright (C) 2012 Google Inc. | 1 # Copyright 2014 Google Inc. All rights reserved. |
2 # | 2 # |
3 # Licensed under the Apache License, Version 2.0 (the "License"); | 3 # Licensed under the Apache License, Version 2.0 (the "License"); |
4 # you may not use this file except in compliance with the License. | 4 # you may not use this file except in compliance with the License. |
5 # You may obtain a copy of the License at | 5 # You may obtain a copy of the License at |
6 # | 6 # |
7 # http://www.apache.org/licenses/LICENSE-2.0 | 7 # http://www.apache.org/licenses/LICENSE-2.0 |
8 # | 8 # |
9 # Unless required by applicable law or agreed to in writing, software | 9 # Unless required by applicable law or agreed to in writing, software |
10 # distributed under the License is distributed on an "AS IS" BASIS, | 10 # distributed under the License is distributed on an "AS IS" BASIS, |
11 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | 11 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
12 # See the License for the specific language governing permissions and | 12 # See the License for the specific language governing permissions and |
13 # limitations under the License. | 13 # limitations under the License. |
14 | 14 |
15 """Utilities for Google Compute Engine | 15 """Utilities for Google Compute Engine |
16 | 16 |
17 Utilities for making it easier to use OAuth 2.0 on Google Compute Engine. | 17 Utilities for making it easier to use OAuth 2.0 on Google Compute Engine. |
18 """ | 18 """ |
19 | 19 |
20 __author__ = 'jcgregorio@google.com (Joe Gregorio)' | 20 __author__ = 'jcgregorio@google.com (Joe Gregorio)' |
21 | 21 |
22 import httplib2 | 22 import json |
23 import logging | 23 import logging |
24 import uritemplate | 24 from third_party.six.moves import urllib |
25 | 25 |
26 from oauth2client import util | 26 from third_party.oauth2client import util |
27 from oauth2client.anyjson import simplejson | 27 from third_party.oauth2client.client import AccessTokenRefreshError |
28 from oauth2client.client import AccessTokenRefreshError | 28 from third_party.oauth2client.client import AssertionCredentials |
29 from oauth2client.client import AssertionCredentials | |
30 | 29 |
31 logger = logging.getLogger(__name__) | 30 logger = logging.getLogger(__name__) |
32 | 31 |
33 # URI Template for the endpoint that returns access_tokens. | 32 # URI Template for the endpoint that returns access_tokens. |
34 META = ('http://metadata.google.internal/0.1/meta-data/service-accounts/' | 33 META = ('http://metadata.google.internal/0.1/meta-data/service-accounts/' |
35 'default/acquire{?scope}') | 34 'default/acquire{?scope}') |
36 | 35 |
37 | 36 |
38 class AppAssertionCredentials(AssertionCredentials): | 37 class AppAssertionCredentials(AssertionCredentials): |
39 """Credentials object for Compute Engine Assertion Grants | 38 """Credentials object for Compute Engine Assertion Grants |
(...skipping 10 matching lines...) Expand all Loading... |
50 | 49 |
51 @util.positional(2) | 50 @util.positional(2) |
52 def __init__(self, scope, **kwargs): | 51 def __init__(self, scope, **kwargs): |
53 """Constructor for AppAssertionCredentials | 52 """Constructor for AppAssertionCredentials |
54 | 53 |
55 Args: | 54 Args: |
56 scope: string or iterable of strings, scope(s) of the credentials being | 55 scope: string or iterable of strings, scope(s) of the credentials being |
57 requested. | 56 requested. |
58 """ | 57 """ |
59 self.scope = util.scopes_to_string(scope) | 58 self.scope = util.scopes_to_string(scope) |
| 59 self.kwargs = kwargs |
60 | 60 |
61 # Assertion type is no longer used, but still in the parent class signature. | 61 # Assertion type is no longer used, but still in the parent class signature. |
62 super(AppAssertionCredentials, self).__init__(None) | 62 super(AppAssertionCredentials, self).__init__(None) |
63 | 63 |
64 @classmethod | 64 @classmethod |
65 def from_json(cls, json): | 65 def from_json(cls, json_data): |
66 data = simplejson.loads(json) | 66 data = json.loads(json_data) |
67 return AppAssertionCredentials(data['scope']) | 67 return AppAssertionCredentials(data['scope']) |
68 | 68 |
69 def _refresh(self, http_request): | 69 def _refresh(self, http_request): |
70 """Refreshes the access_token. | 70 """Refreshes the access_token. |
71 | 71 |
72 Skip all the storage hoops and just refresh using the API. | 72 Skip all the storage hoops and just refresh using the API. |
73 | 73 |
74 Args: | 74 Args: |
75 http_request: callable, a callable that matches the method signature of | 75 http_request: callable, a callable that matches the method signature of |
76 httplib2.Http.request, used to make the refresh request. | 76 httplib2.Http.request, used to make the refresh request. |
77 | 77 |
78 Raises: | 78 Raises: |
79 AccessTokenRefreshError: When the refresh fails. | 79 AccessTokenRefreshError: When the refresh fails. |
80 """ | 80 """ |
81 uri = uritemplate.expand(META, {'scope': self.scope}) | 81 query = '?scope=%s' % urllib.parse.quote(self.scope, '') |
| 82 uri = META.replace('{?scope}', query) |
82 response, content = http_request(uri) | 83 response, content = http_request(uri) |
83 if response.status == 200: | 84 if response.status == 200: |
84 try: | 85 try: |
85 d = simplejson.loads(content) | 86 d = json.loads(content) |
86 except StandardError, e: | 87 except Exception as e: |
87 raise AccessTokenRefreshError(str(e)) | 88 raise AccessTokenRefreshError(str(e)) |
88 self.access_token = d['accessToken'] | 89 self.access_token = d['accessToken'] |
89 else: | 90 else: |
| 91 if response.status == 404: |
| 92 content += (' This can occur if a VM was created' |
| 93 ' with no service account or scopes.') |
90 raise AccessTokenRefreshError(content) | 94 raise AccessTokenRefreshError(content) |
| 95 |
| 96 @property |
| 97 def serialization_data(self): |
| 98 raise NotImplementedError( |
| 99 'Cannot serialize credentials for GCE service accounts.') |
| 100 |
| 101 def create_scoped_required(self): |
| 102 return not self.scope |
| 103 |
| 104 def create_scoped(self, scopes): |
| 105 return AppAssertionCredentials(scopes, **self.kwargs) |
OLD | NEW |