krombel/oauth2
1
0
Fork 0
forked from remote/oauth2
Code Pull Requests 1 Activity

Restructured service account impersonation flow.

Browse Source 
Change-Id: I17c0283f053711f44abaf5620f2642eea08aca62
This commit is contained in:
Patrick Jones
2021-01-25 00:02:46 -08:00
parent 85db953d34
commit 975d0951de
3 changed files with 38 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
google/internal/externalaccount/impersonate.go
View File

@@ -6,6 +6,7 @@ package externalaccount
import (
"bytes"
"context"
"encoding/json"
"fmt"
"golang.org/x/oauth2"
@@ -27,49 +28,53 @@ type impersonateTokenResponse struct {
ExpireTime string `json:"expireTime"`
}
type impersonateTokenSource struct {
ctx context.Context
ts oauth2.TokenSource
url string
scopes []string
}
// impersonate performs the exchange to get a temporary service account
func (ts tokenSource) impersonate() (*oauth2.Token, error) {
func (its impersonateTokenSource) Token() (*oauth2.Token, error) {
reqBody := generateAccessTokenReq{
Lifetime: "3600s",
Scope: ts.conf.Scopes,
Scope: its.scopes,
}
b, err := json.Marshal(reqBody)
serviceAccountImpersonationURL := ts.conf.ServiceAccountImpersonationURL
ts.conf.ServiceAccountImpersonationURL = ""
ts.conf.Scopes = []string{"https://www.googleapis.com/auth/cloud-platform"}
client := oauth2.NewClient(ts.ctx, ts)
client := oauth2.NewClient(its.ctx, its.ts)
if err != nil {
return &oauth2.Token{}, fmt.Errorf("google: unable to marshal request: %v", err)
return nil, fmt.Errorf("oauth2/google: unable to marshal request: %v", err)
}
req, err := http.NewRequest("POST", serviceAccountImpersonationURL, bytes.NewReader(b))
req, err := http.NewRequest("POST", its.url, bytes.NewReader(b))
if err != nil {
return nil, fmt.Errorf("impersonate: unable to create request: %v", err)
return nil, fmt.Errorf("oauth2/google: unable to create impersonation request: %v", err)
}
req = req.WithContext(ts.ctx)
req = req.WithContext(its.ctx)
req.Header.Set("Content-Type", "application/json")
resp, err := client.Do(req)
if err != nil {
return nil, fmt.Errorf("impersonate: unable to generate access token: %v", err)
return nil, fmt.Errorf("oauth2/google: unable to generate access token: %v", err)
}
defer resp.Body.Close()
body, err := ioutil.ReadAll(io.LimitReader(resp.Body, 1<<20))
if err != nil {
return nil, fmt.Errorf("impersonate: unable to read body: %v", err)
return nil, fmt.Errorf("oauth2/google: unable to read body: %v", err)
}
if c := resp.StatusCode; c < 200 || c > 299 {
return nil, fmt.Errorf("impersonate: status code %d: %s", c, body)
return nil, fmt.Errorf("oauth2/google: status code %d: %s", c, body)
}
var accessTokenResp impersonateTokenResponse
if err := json.Unmarshal(body, &accessTokenResp); err != nil {
return nil, fmt.Errorf("impersonate: unable to parse response: %v", err)
return nil, fmt.Errorf("oauth2/google: unable to parse response: %v", err)
}
expiry, err := time.Parse(time.RFC3339, accessTokenResp.ExpireTime)
if err != nil {
return nil, fmt.Errorf("impersonate: unable to parse expiry: %v", err)
return nil, fmt.Errorf("oauth2/google: unable to parse expiry: %v", err)
}
return &oauth2.Token{
AccessToken: accessTokenResp.AccessToken,