1# Copyright 2020 Google Inc.
2#
3# Licensed under the Apache License, Version 2.0 (the "License");
4# you may not use this file except in compliance with the License.
5# You may obtain a copy of the License at
6#
7#      http://www.apache.org/licenses/LICENSE-2.0
8#
9# Unless required by applicable law or agreed to in writing, software
10# distributed under the License is distributed on an "AS IS" BASIS,
11# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12# See the License for the specific language governing permissions and
13# limitations under the License.
14
15"""Application default credentials.
16
17Implements application default credentials and project ID detection.
18"""
19
20import io
21import json
22import os
23
24import six
25
26from google.auth import _default
27from google.auth import environment_vars
28from google.auth import exceptions
29
30
31def load_credentials_from_file(filename, scopes=None, quota_project_id=None):
32    """Loads Google credentials from a file.
33
34    The credentials file must be a service account key or stored authorized
35    user credentials.
36
37    Args:
38        filename (str): The full path to the credentials file.
39        scopes (Optional[Sequence[str]]): The list of scopes for the credentials. If
40            specified, the credentials will automatically be scoped if
41            necessary
42        quota_project_id (Optional[str]):  The project ID used for
43                quota and billing.
44
45    Returns:
46        Tuple[google.auth.credentials.Credentials, Optional[str]]: Loaded
47            credentials and the project ID. Authorized user credentials do not
48            have the project ID information.
49
50    Raises:
51        google.auth.exceptions.DefaultCredentialsError: if the file is in the
52            wrong format or is missing.
53    """
54    if not os.path.exists(filename):
55        raise exceptions.DefaultCredentialsError(
56            "File {} was not found.".format(filename)
57        )
58
59    with io.open(filename, "r") as file_obj:
60        try:
61            info = json.load(file_obj)
62        except ValueError as caught_exc:
63            new_exc = exceptions.DefaultCredentialsError(
64                "File {} is not a valid json file.".format(filename), caught_exc
65            )
66            six.raise_from(new_exc, caught_exc)
67
68    # The type key should indicate that the file is either a service account
69    # credentials file or an authorized user credentials file.
70    credential_type = info.get("type")
71
72    if credential_type == _default._AUTHORIZED_USER_TYPE:
73        from google.oauth2 import _credentials_async as credentials
74
75        try:
76            credentials = credentials.Credentials.from_authorized_user_info(
77                info, scopes=scopes
78            )
79        except ValueError as caught_exc:
80            msg = "Failed to load authorized user credentials from {}".format(filename)
81            new_exc = exceptions.DefaultCredentialsError(msg, caught_exc)
82            six.raise_from(new_exc, caught_exc)
83        if quota_project_id:
84            credentials = credentials.with_quota_project(quota_project_id)
85        if not credentials.quota_project_id:
86            _default._warn_about_problematic_credentials(credentials)
87        return credentials, None
88
89    elif credential_type == _default._SERVICE_ACCOUNT_TYPE:
90        from google.oauth2 import _service_account_async as service_account
91
92        try:
93            credentials = service_account.Credentials.from_service_account_info(
94                info, scopes=scopes
95            ).with_quota_project(quota_project_id)
96        except ValueError as caught_exc:
97            msg = "Failed to load service account credentials from {}".format(filename)
98            new_exc = exceptions.DefaultCredentialsError(msg, caught_exc)
99            six.raise_from(new_exc, caught_exc)
100        return credentials, info.get("project_id")
101
102    else:
103        raise exceptions.DefaultCredentialsError(
104            "The file {file} does not have a valid type. "
105            "Type is {type}, expected one of {valid_types}.".format(
106                file=filename, type=credential_type, valid_types=_default._VALID_TYPES
107            )
108        )
109
110
111def _get_gcloud_sdk_credentials(quota_project_id=None):
112    """Gets the credentials and project ID from the Cloud SDK."""
113    from google.auth import _cloud_sdk
114
115    # Check if application default credentials exist.
116    credentials_filename = _cloud_sdk.get_application_default_credentials_path()
117
118    if not os.path.isfile(credentials_filename):
119        return None, None
120
121    credentials, project_id = load_credentials_from_file(
122        credentials_filename, quota_project_id=quota_project_id
123    )
124
125    if not project_id:
126        project_id = _cloud_sdk.get_project_id()
127
128    return credentials, project_id
129
130
131def _get_explicit_environ_credentials(quota_project_id=None):
132    """Gets credentials from the GOOGLE_APPLICATION_CREDENTIALS environment
133    variable."""
134    from google.auth import _cloud_sdk
135
136    cloud_sdk_adc_path = _cloud_sdk.get_application_default_credentials_path()
137    explicit_file = os.environ.get(environment_vars.CREDENTIALS)
138
139    if explicit_file is not None and explicit_file == cloud_sdk_adc_path:
140        # Cloud sdk flow calls gcloud to fetch project id, so if the explicit
141        # file path is cloud sdk credentials path, then we should fall back
142        # to cloud sdk flow, otherwise project id cannot be obtained.
143        return _get_gcloud_sdk_credentials(quota_project_id=quota_project_id)
144
145    if explicit_file is not None:
146        credentials, project_id = load_credentials_from_file(
147            os.environ[environment_vars.CREDENTIALS], quota_project_id=quota_project_id
148        )
149
150        return credentials, project_id
151
152    else:
153        return None, None
154
155
156def _get_gae_credentials():
157    """Gets Google App Engine App Identity credentials and project ID."""
158    # While this library is normally bundled with app_engine, there are
159    # some cases where it's not available, so we tolerate ImportError.
160
161    return _default._get_gae_credentials()
162
163
164def _get_gce_credentials(request=None):
165    """Gets credentials and project ID from the GCE Metadata Service."""
166    # Ping requires a transport, but we want application default credentials
167    # to require no arguments. So, we'll use the _http_client transport which
168    # uses http.client. This is only acceptable because the metadata server
169    # doesn't do SSL and never requires proxies.
170
171    # While this library is normally bundled with compute_engine, there are
172    # some cases where it's not available, so we tolerate ImportError.
173
174    return _default._get_gce_credentials(request)
175
176
177def default_async(scopes=None, request=None, quota_project_id=None):
178    """Gets the default credentials for the current environment.
179
180    `Application Default Credentials`_ provides an easy way to obtain
181    credentials to call Google APIs for server-to-server or local applications.
182    This function acquires credentials from the environment in the following
183    order:
184
185    1. If the environment variable ``GOOGLE_APPLICATION_CREDENTIALS`` is set
186       to the path of a valid service account JSON private key file, then it is
187       loaded and returned. The project ID returned is the project ID defined
188       in the service account file if available (some older files do not
189       contain project ID information).
190    2. If the `Google Cloud SDK`_ is installed and has application default
191       credentials set they are loaded and returned.
192
193       To enable application default credentials with the Cloud SDK run::
194
195            gcloud auth application-default login
196
197       If the Cloud SDK has an active project, the project ID is returned. The
198       active project can be set using::
199
200            gcloud config set project
201
202    3. If the application is running in the `App Engine standard environment`_
203       (first generation) then the credentials and project ID from the
204       `App Identity Service`_ are used.
205    4. If the application is running in `Compute Engine`_ or `Cloud Run`_ or
206       the `App Engine flexible environment`_ or the `App Engine standard
207       environment`_ (second generation) then the credentials and project ID
208       are obtained from the `Metadata Service`_.
209    5. If no credentials are found,
210       :class:`~google.auth.exceptions.DefaultCredentialsError` will be raised.
211
212    .. _Application Default Credentials: https://developers.google.com\
213            /identity/protocols/application-default-credentials
214    .. _Google Cloud SDK: https://cloud.google.com/sdk
215    .. _App Engine standard environment: https://cloud.google.com/appengine
216    .. _App Identity Service: https://cloud.google.com/appengine/docs/python\
217            /appidentity/
218    .. _Compute Engine: https://cloud.google.com/compute
219    .. _App Engine flexible environment: https://cloud.google.com\
220            /appengine/flexible
221    .. _Metadata Service: https://cloud.google.com/compute/docs\
222            /storing-retrieving-metadata
223    .. _Cloud Run: https://cloud.google.com/run
224
225    Example::
226
227        import google.auth
228
229        credentials, project_id = google.auth.default()
230
231    Args:
232        scopes (Sequence[str]): The list of scopes for the credentials. If
233            specified, the credentials will automatically be scoped if
234            necessary.
235        request (google.auth.transport.Request): An object used to make
236            HTTP requests. This is used to detect whether the application
237            is running on Compute Engine. If not specified, then it will
238            use the standard library http client to make requests.
239        quota_project_id (Optional[str]):  The project ID used for
240            quota and billing.
241    Returns:
242        Tuple[~google.auth.credentials.Credentials, Optional[str]]:
243            the current environment's credentials and project ID. Project ID
244            may be None, which indicates that the Project ID could not be
245            ascertained from the environment.
246
247    Raises:
248        ~google.auth.exceptions.DefaultCredentialsError:
249            If no credentials were found, or if the credentials found were
250            invalid.
251    """
252    from google.auth._credentials_async import with_scopes_if_required
253
254    explicit_project_id = os.environ.get(
255        environment_vars.PROJECT, os.environ.get(environment_vars.LEGACY_PROJECT)
256    )
257
258    checkers = (
259        lambda: _get_explicit_environ_credentials(quota_project_id=quota_project_id),
260        lambda: _get_gcloud_sdk_credentials(quota_project_id=quota_project_id),
261        _get_gae_credentials,
262        lambda: _get_gce_credentials(request),
263    )
264
265    for checker in checkers:
266        credentials, project_id = checker()
267        if credentials is not None:
268            credentials = with_scopes_if_required(
269                credentials, scopes
270            ).with_quota_project(quota_project_id)
271            effective_project_id = explicit_project_id or project_id
272            if not effective_project_id:
273                _default._LOGGER.warning(
274                    "No project ID could be determined. Consider running "
275                    "`gcloud config set project` or setting the %s "
276                    "environment variable",
277                    environment_vars.PROJECT,
278                )
279            return credentials, effective_project_id
280
281    raise exceptions.DefaultCredentialsError(_default._HELP_MESSAGE)
282