Adds SSO auth to gsutil

third_party/gsutil/plugins/sso_auth.py

Index: third_party/gsutil/plugins/sso_auth.py
diff --git a/third_party/gsutil/plugins/sso_auth.py b/third_party/gsutil/plugins/sso_auth.py
new file mode 100644
index 0000000000000000000000000000000000000000..614cc1877fef1a3fa15e877ee02ae5a2e66d847a
--- /dev/null
+++ b/third_party/gsutil/plugins/sso_auth.py
@@ -0,0 +1,54 @@
+import json
+import getpass
+import os
+import re
+import urllib2
+import subprocess
+
+from boto.auth_handler import AuthHandler
+from boto.auth_handler import NotReadyToAuthenticate
+
+CMD = ['stubby', '--proto2', 'call', 'blade:sso', 'CorpLogin.Exchange']
+STUBBY_CMD = """target: {
+  scope: GAIA_USER
+  name: "%s"
+}
+target_credential: {
+  type: OAUTH2_TOKEN
+  oauth2_attributes: {
+    scope: 'https://www.googleapis.com/auth/devstorage.read_only'
+  }
+}"""
+
+
+class SSOAuth(AuthHandler):
+  """SSO based auth handler."""
+
+  capability = ['google-oauth2', 's3']
+
+  def __init__(self, path, config, provider):
+    if provider.name == 'google' and self.has_prodaccess():
+      pass
+    else:
+      raise NotReadyToAuthenticate()
+
+  def GetAccessToken(self):
+    username = '%s@google.com' % getpass.getuser()
+    proc = subprocess.Popen(CMD, stdin=subprocess.PIPE, stdout=subprocess.PIPE)
+    out, err = proc.communicate(STUBBY_CMD % username)
+    token_match = re.search(r'oauth2_token: "(.*)"$', out)
+    if token_match:
+      return token_match.group(1)
+    return None
+
+  def add_auth(self, http_request):
+    http_request.headers['Authorization'] = (
+        'OAuth %s' % self.GetAccessToken())
+
+  @staticmethod
+  def has_prodaccess():
+    for path in os.environ["PATH"].split(os.pathsep):
+      exe_file = os.path.join(path, 'prodaccess')
+      if os.path.exists(exe_file) and os.access(exe_file, os.X_OK):
+        return True
+    return False