Documentation
¶
Overview ¶
Package iam implements wrappers around some Google Cloud IAM APIs.
See https://cloud.google.com/iam/docs/ for general info.
DEPRECATED: Prefer to use cloud.google.com/go/iam instead.
Index ¶
- type ClaimSet
- type CredentialsClient
- func (cl *CredentialsClient) GenerateAccessToken(ctx context.Context, serviceAccount string, scopes []string, ...) (*oauth2.Token, error)
- func (cl *CredentialsClient) GenerateIDToken(ctx context.Context, serviceAccount string, audience string, includeEmail bool, ...) (string, error)
- func (cl *CredentialsClient) SignBlob(ctx context.Context, serviceAccount string, blob []byte) (keyName string, signature []byte, err error)
- func (cl *CredentialsClient) SignJWT(ctx context.Context, serviceAccount string, cs *ClaimSet) (keyName, signedJwt string, err error)
- type Signer
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type ClaimSet ¶
type ClaimSet struct {
Iss string `json:"iss"` // email address of the client_id of the application making the access token request
Scope string `json:"scope,omitempty"` // space-delimited list of the permissions the application requests
Aud string `json:"aud"` // descriptor of the intended target of the assertion (Optional).
Exp int64 `json:"exp"` // the expiration time of the assertion (seconds since Unix epoch)
Iat int64 `json:"iat"` // the time the assertion was issued (seconds since Unix epoch)
Typ string `json:"typ,omitempty"` // token type (Optional).
// Email for which the application is requesting delegated access (Optional).
Sub string `json:"sub,omitempty"`
}
ClaimSet contains information about the JWT signature including the permissions being requested (scopes), the target of the token, the issuer, the time the token was issued, and the lifetime of the token.
See RFC 7515.
type CredentialsClient ¶
type CredentialsClient struct {
Client *http.Client // the HTTP client to use to make calls
// contains filtered or unexported fields
}
CredentialsClient knows how to perform IAM Credentials API v1 calls.
DEPRECATED: Prefer to use cloud.google.com/go/iam/credentials/apiv1 instead if possible.
func (*CredentialsClient) GenerateAccessToken ¶
func (cl *CredentialsClient) GenerateAccessToken(ctx context.Context, serviceAccount string, scopes []string, delegates []string, lifetime time.Duration) (*oauth2.Token, error)
GenerateAccessToken creates a service account OAuth token using IAM's :generateAccessToken API.
On non-success HTTP status codes returns googleapi.Error.
func (*CredentialsClient) GenerateIDToken ¶
func (cl *CredentialsClient) GenerateIDToken(ctx context.Context, serviceAccount string, audience string, includeEmail bool, delegates []string) (string, error)
GenerateIDToken creates a service account OpenID Connect ID token using IAM's :generateIdToken API.
On non-success HTTP status codes returns googleapi.Error.
func (*CredentialsClient) SignBlob ¶
func (cl *CredentialsClient) SignBlob(ctx context.Context, serviceAccount string, blob []byte) (keyName string, signature []byte, err error)
SignBlob signs a blob using a service account's system-managed key.
The caller must have "roles/iam.serviceAccountTokenCreator" role in the service account's IAM policy and caller's OAuth token must have one of the scopes:
Returns ID of the signing key and the signature on success.
On API-level errors (e.g. insufficient permissions) returns *googleapi.Error.
func (*CredentialsClient) SignJWT ¶
func (cl *CredentialsClient) SignJWT(ctx context.Context, serviceAccount string, cs *ClaimSet) (keyName, signedJwt string, err error)
SignJWT signs a claim set using a service account's system-managed key.
It injects the key ID into the JWT header before singing. As a result, JWTs produced by SignJWT are slightly faster to verify, because we know what public key to use exactly and don't need to enumerate all active keys.
It also checks the expiration time and refuses to sign claim sets with 'exp' set to more than 12h from now. Otherwise it is similar to SignBlob.
The caller must have "roles/iam.serviceAccountTokenCreator" role in the service account's IAM policy and caller's OAuth token must have one of the scopes:
Returns ID of the signing key and the signed JWT on success.
On API-level errors (e.g. insufficient permissions) returns *googleapi.Error.
type Signer ¶
type Signer struct {
Client *CredentialsClient
ServiceAccount string
}
Signer implements SignBytes interface on top of IAM Credentials client.
It signs blobs using some service account's private key via 'signBlob' IAM call.
Source Files