class Google::Auth::ExternalAccount::Credentials
Provides an entrypoint for all Exernal Account credential classes.
def self.make_creds options = {}
-
scope
(String, Array, nil
) -- the scope(s) to access -
json_key_io
(IO
) -- an IO from which the JSON key can be read
def self.make_creds options = {} json_key_io, scope = options.values_at :json_key_io, :scope raise "A json file is required for external account credentials." unless json_key_io user_creds = read_json_key json_key_io # AWS credentials is determined by aws subject token type return make_aws_credentials user_creds, scope if user_creds[:subject_token_type] == AWS_SUBJECT_TOKEN_TYPE raise MISSING_CREDENTIAL_SOURCE if user_creds[:credential_source].nil? user_creds[:scope] = scope make_external_account_credentials user_creds end
def self.read_json_key json_key_io
def self.read_json_key json_key_io json_key = MultiJson.load json_key_io.read, symbolize_keys: true wanted = [ :audience, :subject_token_type, :token_url, :credential_source ] wanted.each do |key| raise "the json is missing the #{key} field" unless json_key.key? key end json_key end
def make_aws_credentials user_creds, scope
def make_aws_credentials user_creds, scope Google::Auth::ExternalAccount::AwsCredentials.new( audience: user_creds[:audience], scope: scope, subject_token_type: user_creds[:subject_token_type], token_url: user_creds[:token_url], credential_source: user_creds[:credential_source], service_account_impersonation_url: user_creds[:service_account_impersonation_url], universe_domain: user_creds[:universe_domain] ) end
def make_external_account_credentials user_creds
def make_external_account_credentials user_creds unless user_creds[:credential_source][:file].nil? && user_creds[:credential_source][:url].nil? return Google::Auth::ExternalAccount::IdentityPoolCredentials.new user_creds end unless user_creds[:credential_source][:executable].nil? return Google::Auth::ExternalAccount::PluggableAuthCredentials.new user_creds end raise INVALID_EXTERNAL_ACCOUNT_TYPE end