| Index: third_party/oauth2client/service_account.py
|
| diff --git a/third_party/oauth2client/service_account.py b/third_party/oauth2client/service_account.py
|
| deleted file mode 100644
|
| index b6b694c840c601099881f60cbae8d7b2666da9b9..0000000000000000000000000000000000000000
|
| --- a/third_party/oauth2client/service_account.py
|
| +++ /dev/null
|
| @@ -1,139 +0,0 @@
|
| -# Copyright 2014 Google Inc. All rights reserved.
|
| -#
|
| -# Licensed under the Apache License, Version 2.0 (the "License");
|
| -# you may not use this file except in compliance with the License.
|
| -# You may obtain a copy of the License at
|
| -#
|
| -# http://www.apache.org/licenses/LICENSE-2.0
|
| -#
|
| -# Unless required by applicable law or agreed to in writing, software
|
| -# distributed under the License is distributed on an "AS IS" BASIS,
|
| -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
| -# See the License for the specific language governing permissions and
|
| -# limitations under the License.
|
| -
|
| -"""A service account credentials class.
|
| -
|
| -This credentials class is implemented on top of rsa library.
|
| -"""
|
| -
|
| -import base64
|
| -import json
|
| -import time
|
| -
|
| -from pyasn1.codec.ber import decoder
|
| -from pyasn1_modules.rfc5208 import PrivateKeyInfo
|
| -import rsa
|
| -
|
| -from . import GOOGLE_REVOKE_URI
|
| -from . import GOOGLE_TOKEN_URI
|
| -from . import util
|
| -from client import AssertionCredentials
|
| -from third_party import six
|
| -
|
| -
|
| -class _ServiceAccountCredentials(AssertionCredentials):
|
| - """Class representing a service account (signed JWT) credential."""
|
| -
|
| - MAX_TOKEN_LIFETIME_SECS = 3600 # 1 hour in seconds
|
| -
|
| - def __init__(self, service_account_id, service_account_email, private_key_id,
|
| - private_key_pkcs8_text, scopes, user_agent=None,
|
| - token_uri=GOOGLE_TOKEN_URI, revoke_uri=GOOGLE_REVOKE_URI,
|
| - **kwargs):
|
| -
|
| - super(_ServiceAccountCredentials, self).__init__(
|
| - None, user_agent=user_agent, token_uri=token_uri, revoke_uri=revoke_uri)
|
| -
|
| - self._service_account_id = service_account_id
|
| - self._service_account_email = service_account_email
|
| - self._private_key_id = private_key_id
|
| - self._private_key = _get_private_key(private_key_pkcs8_text)
|
| - self._private_key_pkcs8_text = private_key_pkcs8_text
|
| - self._scopes = util.scopes_to_string(scopes)
|
| - self._user_agent = user_agent
|
| - self._token_uri = token_uri
|
| - self._revoke_uri = revoke_uri
|
| - self._kwargs = kwargs
|
| -
|
| - def _generate_assertion(self):
|
| - """Generate the assertion that will be used in the request."""
|
| -
|
| - header = {
|
| - 'alg': 'RS256',
|
| - 'typ': 'JWT',
|
| - 'kid': self._private_key_id
|
| - }
|
| -
|
| - now = int(time.time())
|
| - payload = {
|
| - 'aud': self._token_uri,
|
| - 'scope': self._scopes,
|
| - 'iat': now,
|
| - 'exp': now + _ServiceAccountCredentials.MAX_TOKEN_LIFETIME_SECS,
|
| - 'iss': self._service_account_email
|
| - }
|
| - payload.update(self._kwargs)
|
| -
|
| - assertion_input = (_urlsafe_b64encode(header) + b'.' +
|
| - _urlsafe_b64encode(payload))
|
| -
|
| - # Sign the assertion.
|
| - rsa_bytes = rsa.pkcs1.sign(assertion_input, self._private_key, 'SHA-256')
|
| - signature = base64.urlsafe_b64encode(rsa_bytes).rstrip(b'=')
|
| -
|
| - return assertion_input + b'.' + signature
|
| -
|
| - def sign_blob(self, blob):
|
| - # Ensure that it is bytes
|
| - try:
|
| - blob = blob.encode('utf-8')
|
| - except AttributeError:
|
| - pass
|
| - return (self._private_key_id,
|
| - rsa.pkcs1.sign(blob, self._private_key, 'SHA-256'))
|
| -
|
| - @property
|
| - def service_account_email(self):
|
| - return self._service_account_email
|
| -
|
| - @property
|
| - def serialization_data(self):
|
| - return {
|
| - 'type': 'service_account',
|
| - 'client_id': self._service_account_id,
|
| - 'client_email': self._service_account_email,
|
| - 'private_key_id': self._private_key_id,
|
| - 'private_key': self._private_key_pkcs8_text
|
| - }
|
| -
|
| - def create_scoped_required(self):
|
| - return not self._scopes
|
| -
|
| - def create_scoped(self, scopes):
|
| - return _ServiceAccountCredentials(self._service_account_id,
|
| - self._service_account_email,
|
| - self._private_key_id,
|
| - self._private_key_pkcs8_text,
|
| - scopes,
|
| - user_agent=self._user_agent,
|
| - token_uri=self._token_uri,
|
| - revoke_uri=self._revoke_uri,
|
| - **self._kwargs)
|
| -
|
| -
|
| -def _urlsafe_b64encode(data):
|
| - return base64.urlsafe_b64encode(
|
| - json.dumps(data, separators=(',', ':')).encode('UTF-8')).rstrip(b'=')
|
| -
|
| -
|
| -def _get_private_key(private_key_pkcs8_text):
|
| - """Get an RSA private key object from a pkcs8 representation."""
|
| -
|
| - if not isinstance(private_key_pkcs8_text, six.binary_type):
|
| - private_key_pkcs8_text = private_key_pkcs8_text.encode('ascii')
|
| - der = rsa.pem.load_pem(private_key_pkcs8_text, 'PRIVATE KEY')
|
| - asn1_private_key, _ = decoder.decode(der, asn1Spec=PrivateKeyInfo())
|
| - return rsa.PrivateKey.load_pkcs1(
|
| - asn1_private_key.getComponentByName('privateKey').asOctets(),
|
| - format='DER')
|
|
|