3 L(Y2@srdZddlZddlZddlmZddlmZddlmZddlmZddlm Z dZ Gd d d ej ej ej Z dS) a Service Accounts: JSON Web Token (JWT) Profile for OAuth 2.0 This module implements the JWT Profile for OAuth 2.0 Authorization Grants as defined by `RFC 7523`_ with particular support for how this RFC is implemented in Google's infrastructure. Google refers to these credentials as *Service Accounts*. Service accounts are used for server-to-server communication, such as interactions between a web application server and a Google service. The service account belongs to your application instead of to an individual end user. In contrast to other OAuth 2.0 profiles, no users are involved and your application "acts" as the service account. Typically an application uses a service account when the application uses Google APIs to work with its own data rather than a user's data. For example, an application that uses Google Cloud Datastore for data persistence would use a service account to authenticate its calls to the Google Cloud Datastore API. However, an application that needs to access a user's Drive documents would use the normal OAuth 2.0 profile. Additionally, Google Apps domain administrators can grant service accounts `domain-wide delegation`_ authority to access user data on behalf of users in the domain. This profile uses a JWT to acquire an OAuth 2.0 access token. The JWT is used in place of the usual authorization token returned during the standard OAuth 2.0 Authorization Code grant. The JWT is only used for this purpose, as the acquired access token is used as the bearer token when making requests using these credentials. This profile differs from normal OAuth 2.0 profile because no user consent step is required. The use of the private key allows this profile to assert identity directly. This profile also differs from the :mod:`google.auth.jwt` authentication because the JWT credentials use the JWT directly as the bearer token. This profile instead only uses the JWT to obtain an OAuth 2.0 access token. The obtained OAuth 2.0 access token is used as the bearer token. Domain-wide delegation ---------------------- Domain-wide delegation allows a service account to access user data on behalf of any user in a Google Apps domain without consent from the user. For example, an application that uses the Google Calendar API to add events to the calendars of all users in a Google Apps domain would use a service account to access the Google Calendar API on behalf of users. The Google Apps administrator must explicitly authorize the service account to do this. This authorization step is referred to as "delegating domain-wide authority" to a service account. You can use domain-wise delegation by creating a set of credentials with a specific subject using :meth:`~Credentials.with_subject`. .. _RFC 7523: https://tools.ietf.org/html/rfc7523 N)_helpers)_service_account_info) credentials)jwt)_clienticseZdZdZd!fdd ZeddZeddZed d Ze d d Z e d dZ e ddZ e jejddZddZddZddZe jejddZe jejddZe e jejddZe e jejdd ZZS)" CredentialsaService account credentials Usually, you'll create these credentials with one of the helper constructors. To create credentials using a Google service account private key JSON file:: credentials = service_account.Credentials.from_service_account_file( 'service-account.json') Or if you already have the service account file loaded:: service_account_info = json.load(open('service_account.json')) credentials = service_account.Credentials.from_service_account_info( service_account_info) Both helper methods pass on arguments to the constructor, so you can specify additional scopes and a subject if necessary:: credentials = service_account.Credentials.from_service_account_file( 'service-account.json', scopes=['email'], subject='user@example.com') The credentials are considered immutable. If you want to modify the scopes or the subject used for delegation, use :meth:`with_scopes` or :meth:`with_subject`:: scoped_credentials = credentials.with_scopes(['email']) delegated_credentials = credentials.with_subject(subject) NcsLtt|j||_||_||_||_||_||_|dk rB||_ ni|_ dS)a Args: signer (google.auth.crypt.Signer): The signer used to sign JWTs. service_account_email (str): The service account's email. scopes (Sequence[str]): Scopes to request during the authorization grant. token_uri (str): The OAuth 2.0 Token URI. subject (str): For domain-wide delegation, the email address of the user to for which to request delegated access. project_id (str): Project ID associated with the service account credential. additional_claims (Mapping[str, str]): Any additional claims for the JWT assertion used in the authorization grant. .. note:: Typically one of the helper constructors :meth:`from_service_account_file` or :meth:`from_service_account_info` are used instead of calling the constructor directly. N) superr__init___scopes_signer_service_account_email_subject _project_id _token_uri_additional_claims)selfsignerservice_account_email token_uriscopessubject project_idadditional_claims) __class__L/private/tmp/pip-build-nl73fm5q/google-auth/google/oauth2/service_account.pyr wszCredentials.__init__cKs&||f|d|d|jdd|S)aCreates a Credentials instance from a signer and service account info. Args: signer (google.auth.crypt.Signer): The signer used to sign JWTs. info (Mapping[str, str]): The service account info. kwargs: Additional arguments to pass to the constructor. Returns: google.auth.jwt.Credentials: The constructed credentials. Raises: ValueError: If the info is not in the expected format. client_emailrr)rrr)get)clsrinfokwargsrrr_from_signer_and_infos z!Credentials._from_signer_and_infocKs"tj|ddgd}|j||f|S)aCreates a Credentials instance from parsed service account info. Args: info (Mapping[str, str]): The service account info in Google format. kwargs: Additional arguments to pass to the constructor. Returns: google.auth.service_account.Credentials: The constructed credentials. Raises: ValueError: If the info is not in the expected format. rr)require)rZ from_dictr!)rrr rrrrfrom_service_account_infosz%Credentials.from_service_account_infocKs&tj|ddgd\}}|j||f|S)aXCreates a Credentials instance from a service account json file. Args: filename (str): The path to the service account json file. kwargs: Additional arguments to pass to the constructor. Returns: google.auth.service_account.Credentials: The constructed credentials. rr)r")r from_filenamer!)rfilenamer rrrrrfrom_service_account_files z%Credentials.from_service_account_filecCs|jS)zThe service account email.)r )rrrrrsz!Credentials.service_account_emailcCs|jS)z+Project ID associated with this credential.)r)rrrrrszCredentials.project_idcCs|js dSdS)zChecks if the credentials requires scopes. Returns: bool: True if there are no scopes set otherwise False. TF)r )rrrrrequires_scopesszCredentials.requires_scopesc Cs&t|j|j||j|j|j|jjdS)N)rrrrrr)rr r rr rrcopy)rrrrr with_scopesszCredentials.with_scopesc Cs&t|j|j|j|j||j|jjdS)zCreate a copy of these credentials with the specified subject. Args: subject (str): The subject claim. Returns: google.auth.service_account.Credentials: A new credentials instance. )rrrrrr)rr r r rrrr()rrrrr with_subjects zCredentials.with_subjectc Cs<tj|j}|j|pit|j|j|j|j|j |j |dS)azReturns a copy of these credentials with modified claims. Args: additional_claims (Mapping[str, str]): Any additional claims for the JWT payload. This will be merged with the current additional claims. Returns: google.auth.service_account.Credentials: A new credentials instance. )rrrrrr) r(deepcopyrupdaterr r r rr r)rrZnew_additional_claimsrrr with_claimss zCredentials.with_claimscCsztj}tjtd}||}tj|tj||j|jtj|j p@fd}|j |j |j rh|j d|j tj|j|}|S)zCreate the OAuth 2.0 assertion. This assertion is used during the OAuth 2.0 grant to acquire an access token. Returns: bytes: The authorization grant assertion. )seconds)ZiatexpZissZaudZscopesub)rutcnowdatetime timedelta_DEFAULT_TOKEN_LIFETIME_SECSZdatetime_to_secsr rZscopes_to_stringr r,rr setdefaultrencoder )rnowZlifetimeexpirypayloadtokenrrr#_make_authorization_grant_assertions   z/Credentials._make_authorization_grant_assertioncCs.|j}tj||j|\}}}||_||_dS)N)r;rZ jwt_grantrr:r8)rrequestZ assertionZ access_tokenr8_rrrrefresh>s zCredentials.refreshcCs |jj|S)N)r sign)rmessagerrr sign_bytesFszCredentials.sign_bytescCs|jS)N)r )rrrrrJszCredentials.signercCs|jS)N)r )rrrr signer_emailOszCredentials.signer_email)NNNN)__name__ __module__ __qualname____doc__r classmethodr!r#r&propertyrrr'rZcopy_docstringrScopedr)r*r-r;rr>SigningrArrB __classcell__rr)rrrUs& "       !r)rFr(r2Z google.authrrrrZ google.oauth2rr4rJrIrrrrrGs