git.iko.soy/gogol
on develop help sign in
Support service account user impersonation

Allow setting the impersonated user for a service account as described in https://developers.google.com/identity/protocols/OAuth2ServiceAccount

commit1b4dd4757eb65f9716bc1f94943d31022d73d3ad authorKarshan Sharma <karshan.sharma@gmail.com> dateWed 9 Aug 2017, 21:22 (9 years ago) parent8140e4e
3 files changed+21−6
compare with develop
unifiedsplit
gogol/src/Network/Google/Auth.hs+13 gogol/src/Network/Google/Auth/ServiceAccount.hs+2−2 gogol/src/Network/Google/Internal/Auth.hs+6−4
gogol/src/Network/Google/Auth.hs+13
@@ -25,6 +25,9 @@ module Network.Google.Auth
2525 , saveAuthorizedUserToWellKnownPath
2626 , saveAuthorizedUser
2727
28+ -- ** Service account user impersonation
29+ , serviceAccountUser
30+
2831 -- ** Installed Application Credentials
2932 , installedApplication
3033 , formURL
@@ -198,3 +201,13 @@ authorize rq s l m = bearer <$> getToken s l m
198201 , "Bearer " <> toHeader (_tokenAccess t)
199202 ) : Client.requestHeaders rq
200203 }
204+
205+-- | Set the user to be impersonated for a service account with domain
206+-- wide delegation. See
207+-- https://developers.google.com/identity/protocols/OAuth2ServiceAccount
208+serviceAccountUser :: forall s. (AllowScopes s)
209+ => Maybe Text
210+ -> Credentials s
211+ -> Credentials s
212+serviceAccountUser u (FromAccount s) = FromAccount $ s { _serviceAccountUser = u }
213+serviceAccountUser _ c = c
gogol/src/Network/Google/Auth/ServiceAccount.hs+2−2
@@ -125,10 +125,10 @@ encodeBearerJWT s p = liftIO $ do
125125 , "kid" .= _serviceKeyId s
126126 ]
127127
128− payload = base64Encode
128+ payload = base64Encode $
129129 [ "aud" .= tokenURL
130130 , "scope" .= concatScopes (allowScopes p)
131131 , "iat" .= n
132132 , "exp" .= (n + seconds maxTokenLifetime)
133133 , "iss" .= _serviceEmail s
134− ]
134+ ] <> maybe [] (\sub -> ["sub" .= sub]) (_serviceAccountUser s)
gogol/src/Network/Google/Internal/Auth.hs+6−4
@@ -91,10 +91,11 @@ specifying which 'Scope's the resulting 'OAuthToken' is authorized to access.
9191/See:/ <https://developers.google.com/identity/protocols/OAuth2ServiceAccount#delegatingauthority Delegating authority to your service account>.
9292-}
9393data ServiceAccount = ServiceAccount
94− { _serviceId :: !ClientId
95− , _serviceEmail :: !Text
96− , _serviceKeyId :: !Text
97− , _servicePrivateKey :: !PrivateKey
94+ { _serviceId :: !ClientId
95+ , _serviceEmail :: !Text
96+ , _serviceKeyId :: !Text
97+ , _servicePrivateKey :: !PrivateKey
98+ , _serviceAccountUser :: !(Maybe Text)
9899 } deriving (Eq, Show)
99100
100101instance FromJSON ServiceAccount where
@@ -109,6 +110,7 @@ instance FromJSON ServiceAccount where
109110 <*> o .: "client_email"
110111 <*> o .: "private_key_id"
111112 <*> pure k
113+ <*> pure Nothing
112114
113115{-| Authorized User credentials which are typically generated by the Cloud SDK
114116Tools such as @gcloud init@, of the following form: