feat: add sample and test for getting an access token from an imperso… (GoogleCloudPlatform#8747)

irataxy · Sita04 · web-flow · commit 2fdb7947885d · 2023-10-12T12:23:12.000-07:00
* feat: add sample and test for getting an access token from an impersonated SA

* fix checkstyle violations

* setup secret for impersonated service account

* fix lint check

* add cleanup method to test

---------

Co-authored-by: Sita Lakshmi Sangameswaran &lt;sitalakshmi@google.com&gt;
diff --git a/.kokoro/tests/run_tests.sh b/.kokoro/tests/run_tests.sh
@@ -82,7 +82,8 @@ if [[ "$SCRIPT_DEBUG" != "true" ]]; then
     "java-iam-samples-secrets.txt" \
     "java-scc-samples-secrets.txt" \
     "java-bigqueryconnection-samples-secrets.txt" \
-    "java-bigquerydatatransfer-samples-secrets.txt")
+    "java-bigquerydatatransfer-samples-secrets.txt" \
+    "java-auth-samples-secrets.txt")
 
     # create secret dir
     mkdir -p "${KOKORO_GFILE_DIR}/secrets"
diff --git a/auth/src/main/java/com/google/cloud/auth/samples/AccessTokenFromImpersonatedCredentials.java b/auth/src/main/java/com/google/cloud/auth/samples/AccessTokenFromImpersonatedCredentials.java
@@ -0,0 +1,79 @@
+/*
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// [START auth_cloud_accesstoken_impersonated_credentials]
+
+package com.google.cloud.auth.samples;
+
+import com.google.auth.oauth2.GoogleCredentials;
+import com.google.auth.oauth2.ImpersonatedCredentials;
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.List;
+
+public class AccessTokenFromImpersonatedCredentials {
+
+  public static void main(String[] args) throws IOException {
+    // TODO(Developer): Replace the below variables before running the code.
+
+    // Provide the scopes that you might need to request access to Google APIs,
+    // depending on the level of access you need.
+    // This example uses the cloud-wide scope and uses IAM to narrow the permissions.
+    // https://cloud.google.com/docs/authentication/external/authorization-gcp
+    // For more information, see: https://developers.google.com/identity/protocols/oauth2/scopes
+    String scope = "https://www.googleapis.com/auth/cloud-platform";
+
+    // The name of the privilege-bearing service account for whom the credential is created.
+    String impersonatedServiceAccount = "name@project.service.gserviceaccount.com";
+
+    getAccessToken(impersonatedServiceAccount, scope);
+  }
+
+  // Use a service account (SA1) to impersonate another service account (SA2) and obtain an ID token
+  // for the impersonated account.
+  // To obtain a token for SA2, SA1 should have the "roles/iam.serviceAccountTokenCreator"
+  // permission on SA2.
+  public static void getAccessToken(
+      String impersonatedServiceAccount, String scope) throws IOException {
+
+    // Construct the GoogleCredentials object which obtains the default configuration from your
+    // working environment.
+    GoogleCredentials googleCredentials = GoogleCredentials.getApplicationDefault();
+
+    // delegates: The chained list of delegates required to grant the final accessToken.
+    // For more information, see:
+    // https://cloud.google.com/iam/docs/create-short-lived-credentials-direct#sa-credentials-permissions
+    // Delegate is NOT USED here.
+    List<String> delegates = null;
+
+    // Create the impersonated credential.
+    ImpersonatedCredentials impersonatedCredentials =
+        ImpersonatedCredentials.newBuilder()
+            .setSourceCredentials(googleCredentials)
+            .setTargetPrincipal(impersonatedServiceAccount)
+            .setScopes(Arrays.asList(scope))
+            .setLifetime(300)
+            .setDelegates(delegates)
+            .build();
+
+    // Get the OAuth2 token.
+    // Once you've obtained the OAuth2 token, you can use it to make an authenticated call.
+    impersonatedCredentials.refresh();
+    String accessToken = impersonatedCredentials.getAccessToken().getTokenValue();
+    System.out.println("Generated access token.");
+  }
+}
+// [END auth_cloud_accesstoken_impersonated_credentials]
diff --git a/auth/src/test/java/com/google/cloud/auth/samples/AccessTokenFromImpersonatedCredentialsIT.java b/auth/src/test/java/com/google/cloud/auth/samples/AccessTokenFromImpersonatedCredentialsIT.java
@@ -0,0 +1,66 @@
+/*
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.google.cloud.auth.samples;
+
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.PrintStream;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+@RunWith(JUnit4.class)
+//CHECKSTYLE OFF: AbbreviationAsWordInName
+public class AccessTokenFromImpersonatedCredentialsIT {
+
+  //CHECKSTYLE ON: AbbreviationAsWordInName
+  private static final String impersonatedServiceAccount =
+      System.getenv("IMPERSONATED_SERVICE_ACCOUNT");
+  private static final String scope = "https://www.googleapis.com/auth/cloud-platform";
+  private final PrintStream originalOut = System.out;
+  private ByteArrayOutputStream bout;
+  private PrintStream out;
+  private String credentials;
+
+  @Before
+  public void setUp() {
+    bout = new ByteArrayOutputStream();
+    out = new PrintStream(bout);
+    System.setOut(out);
+    credentials = System.getenv("GOOGLE_APPLICATION_CREDENTIALS");
+    assertNotNull(credentials);
+  }
+
+  @Test
+  public void testAccessTokenFromImpersonatedCredentials()
+      throws IOException {
+    AccessTokenFromImpersonatedCredentials.getAccessToken(impersonatedServiceAccount, scope);
+    String output = bout.toString();
+    assertTrue(output.contains("Generated access token."));
+  }
+
+  @After
+  public void tearDown() throws IOException {
+    System.setOut(originalOut);
+    bout.reset();
+  }
+}
