mxiktdZddlZddlZddlmZddlmZddlZddlm Z ddlm Z ddlm Z ddlm Z ddlm Z dd lmZdd lmZdd lmZd Zd ZdZdZdZdZdZe j2dfdZGdde j6e j8e j:e j<ZGdde j8Z gfdZ!y)aGoogle Cloud Impersonated credentials. This module provides authentication for applications where local credentials impersonates a remote service account using `IAM Credentials API`_. This class can be used to impersonate a service account as long as the original Credential object has the "Service Account Token Creator" role on the target service account. .. _IAM Credentials API: https://cloud.google.com/iam/credentials/reference/rest/ N)datetime)_exponential_backoff)_helpers credentials) exceptions)iam)jwt)metrics)_clientz*Unable to acquire impersonated credentialsiz#https://oauth2.googleapis.com/tokenzKhttps://iamcredentials.{}/v1/projects/-/serviceAccounts/{}/allowedLocationsauthorized_userservice_account external_account_authorized_userc|xs=tjjtj|j |}t j|jd}||d||}t|jdr|jjdn |j}|jtjk7rtj t"| t j$|} | d} t'j(| dd} | | fS#t*t,f$r1} tj dj t"|} | | d } ~ wwxYw) aMakes a request to the Google Cloud IAM service for an access token. Args: request (Request): The Request object to use. principal (str): The principal to request an access token for. headers (Mapping[str, str]): Map of headers to transmit. body (Mapping[str, str]): JSON Payload body for the iamcredentials API call. iam_endpoint_override (Optiona[str]): The full IAM endpoint override with the target_principal embedded. This is useful when supporting impersonation with regional endpoints. Raises: google.auth.exceptions.TransportError: Raised if there is an underlying HTTP connection error google.auth.exceptions.RefreshError: Raised if the impersonated credentials are not available. Common reasons are `iamcredentials.googleapis.com` is not enabled or the `Service Account Token Creator` is not assigned utf-8POSTurlmethodheadersbodydecode accessToken expireTimez%Y-%m-%dT%H:%M:%SZz6{}: No access token or invalid expiration in response.N)r _IAM_ENDPOINTreplacerDEFAULT_UNIVERSE_DOMAINformatjsondumpsencodehasattrdatarstatus http_clientOKr RefreshError_REFRESH_ERRORloadsrstrptimeKeyError ValueError)request principalrruniverse_domainiam_endpoint_override iam_endpointresponse response_bodytoken_responsetokenexpiry caught_excnew_excs [/home/htdocs/ttos/venv/lib/python3.12/site-packages/google/auth/impersonated_credentials.py_make_iam_token_requestr:<s=6)C,=,=,E,E++_- fY ::d  " "7 +D<dSH 8==( +  W% ]] +..(%%nmDD&M2}-"">,#?AUVf} j !&)) D K K     :%&s'6DE-,EEceZdZdZddedddffd ZdZdZdZdZ e dZ e d Z e d Z e d Zej ej$d Zd Zej ej*dZej ej.dZej ej2ddZeddZxZS) Credentialsar This module defines impersonated credentials which are essentially impersonated identities. Impersonated Credentials allows credentials issued to a user or service account to impersonate another. The target service account must grant the originating credential principal the `Service Account Token Creator`_ IAM role: For more information about Token Creator IAM role and IAMCredentials API, see `Creating Short-Lived Service Account Credentials`_. .. _Service Account Token Creator: https://cloud.google.com/iam/docs/service-accounts#the_service_account_token_creator_role .. _Creating Short-Lived Service Account Credentials: https://cloud.google.com/iam/docs/creating-short-lived-service-account-credentials Usage: First grant source_credentials the `Service Account Token Creator` role on the target account to impersonate. In this example, the service account represented by svc_account.json has the token creator role on `impersonated-account@_project_.iam.gserviceaccount.com`. Enable the IAMCredentials API on the source project: `gcloud services enable iamcredentials.googleapis.com`. Initialize a source credential which does not have access to list bucket:: from google.oauth2 import service_account target_scopes = [ 'https://www.googleapis.com/auth/devstorage.read_only'] source_credentials = ( service_account.Credentials.from_service_account_file( '/path/to/svc_account.json', scopes=target_scopes)) Now use the source credentials to acquire credentials to impersonate another service account:: from google.auth import impersonated_credentials target_credentials = impersonated_credentials.Credentials( source_credentials=source_credentials, target_principal='impersonated-account@_project_.iam.gserviceaccount.com', target_scopes = target_scopes, lifetime=500) Resource access is granted:: client = storage.Client(credentials=target_credentials) buckets = client.list_buckets(project='your_project') for bucket in buckets: print(bucket.name) **IMPORTANT**: This class does not validate the credential configuration. A security risk occurs when a credential configuration configured with malicious urls is used. When the credential configuration is accepted from an untrusted source, you should validate it before using. Refer https://cloud.google.com/docs/authentication/external/externally-sourced-credentials for more details. Nc tt| tj||_t |jt jru|jjtj|_t|jdr1|jjr|jjd|j|_||_||_||_||_|xst(|_d|_t/j0|_||_||_d|_| |_y)ap Args: source_credentials (google.auth.Credentials): The source credential used as to acquire the impersonated credentials. target_principal (str): The service account to impersonate. target_scopes (Sequence[str]): Scopes to request during the authorization grant. delegates (Sequence[str]): The chained list of delegates required to grant the final access_token. If set, the sequence of identities must have "Service Account Token Creator" capability granted to the prceeding identity. For example, if set to [serviceAccountB, serviceAccountC], the source_credential must have the Token Creator role on serviceAccountB. serviceAccountB must have the Token Creator on serviceAccountC. Finally, C must have Token Creator on target_principal. If left unset, source_credential must have that role on target_principal. lifetime (int): Number of seconds the delegated credential should be valid for (upto 3600). quota_project_id (Optional[str]): The project ID used for quota and billing. This project may be different from the project used to create the credentials. iam_endpoint_override (Optional[str]): The full IAM endpoint override with the target_principal embedded. This is useful when supporting impersonation with regional endpoints. subject (Optional[str]): sub field of a JWT. This field should only be set if you wish to impersonate as a user. This feature is useful when using domain wide delegation. trust_boundary (Mapping[str,str]): A credential trust boundary. _create_self_signed_jwtN)superr<__init__copy_source_credentials isinstancerScoped with_scopesr _IAM_SCOPEr"_always_use_jwt_accessr>r/_universe_domain_target_principal_target_scopes _delegates_subject_DEFAULT_TOKEN_LIFETIME_SECS _lifetimer5rutcnowr6_quota_project_id_iam_endpoint_override_cred_file_path_trust_boundary) selfsource_credentialstarget_principal target_scopes delegatessubjectlifetimequota_project_idr0trust_boundary __class__s r9r@zCredentials.__init__sX k4)+#'99-?#@  d.. 0B0B C'+'?'?'K'K(D $ 002KL,,CC((@@F 2 B B!1+# !A%A oo' !1&;##-c"tjSN)r CRED_TYPE_SA_IMPERSONATErTs r9_metric_header_for_usagez$Credentials._metric_header_for_usages///r^cx|jjtjjk(s1|jjtjj k(r|jj ||j|jt|jdzd}ddtjtji}|jj||jr|j tj"k7rt%j&dt)j*}|j,t)j.|jxsd|jt0t)j2|t)j2|t4zd}t7||j,|||j}t9j:|t0|\|_|_}y tA||j,|||j |jB \|_|_y ) zUpdates credentials with a new access_token representing the impersonated account. Args: request (google.auth.transport.requests.Request): Request object to use for refreshing credentials. s)rXscoperZ Content-Typeapplication/jsonzNDomain-wide delegation is not supported in universes other than googleapis.com)issrfsubaudiatexp)r-r.rpayloadrXN)r-r.rrr/r0)"rB token_stater TokenStateSTALEINVALIDrefreshrKrJstrrNr API_CLIENT_HEADER&token_request_access_token_impersonateapplyrLr/rrGoogleAuthErrorrrOrIscopes_to_string_GOOGLE_OAUTH2_TOKEN_ENDPOINTdatetime_to_secsrM_sign_jwt_requestr jwt_grantr5r6r:rQ)rTr-rrnowro assertion_s r9_perform_refresh_tokenz"Credentials._perform_refresh_tokens  $ $ 0 0K4J4J4P4P P''33{7M7M7U7UU  $ $ , ,W 5((DNN+c1  .  % %w'U'U'W    &&w/ ==##{'J'JJ 00, //#C--!2243F3F3L"M}}40050058TT G*00// I*1):):6 * &DJ Q "9,, 00"&"="= #  DKr^c|js tdtj|j|jS)aBuilds and returns the URL for the trust boundary lookup API. This method constructs the specific URL for the IAM Credentials API's `allowedLocations` endpoint, using the credential's universe domain and service account email. Raises: ValueError: If `self.service_account_email` is None or an empty string, as it's required to form the URL. Returns: str: The URL for the trust boundary lookup endpoint. zIService account email is required to build the trust boundary lookup URL.)service_account_emailr,_TRUST_BOUNDARY_LOOKUP_ENDPOINTrr/rbs r9 _build_trust_boundary_lookup_urlz,Credentials._build_trust_boundary_lookup_url[sC))[ /55  $"<"<  r^cZddlm}tjj t j |jj|j}tj|jd|jd}ddi}||j} tj }|D]}|j#|||} | j$tj&vr4| j$t(j*k7r2t-j.dj| j1tj2| j1d c|j5S |j5t-j.d #|j5wxYw) NrAuthorizedSessionr)rorXrgrh)rrrzError calling sign_bytes: {} signedBlobz#exhausted signBlob endpoint retries)google.auth.transport.requestsrr _IAM_SIGN_ENDPOINTrrrr/rrIbase64 b64encoderrKrBrExponentialBackoffpost status_codeIAM_RETRY_CODESr%r&rTransportErrorr b64decodeclose) rTmessageriam_sign_endpointrrauthed_sessionretriesrr2s r9 sign_byteszCredentials.sign_bytesqsqD22::  / /1E1E &'' (  ''077@  "#56*4+C+CD #*==?G G)..)7/''3+>+>>'';>>9$336==hmmoN''  (EFF  " G  "''(MNN  "s CF1FF*c|jSr`rIrbs r9 signer_emailzCredentials.signer_email%%%r^c|jSr`rrbs r9rz!Credentials.service_account_emailrr^c|Sr`rirbs r9signerzCredentials.signers r^c|j Sr`)rJrbs r9requires_scopeszCredentials.requires_scopess&&&&r^cP|jr|jd|jdSy)Nzimpersonated credentials)credential_sourcecredential_typer.)rRrIrbs r9 get_cred_infozCredentials.get_cred_infos/   %)%9%9#=!33  r^c |j|j|j|j|j|j |j |j|j}|j|_ |S)N)rVrWrXrZr[r0r\) r]rBrIrJrKrNrPrQrSrR)rTcreds r9 _make_copyzCredentials._make_copysn~~  $ $!33--oo^^!33"&"="=//   $33 r^c4|j}||_|Sr`)rrS)rTr\rs r9with_trust_boundaryzCredentials.with_trust_boundarys - r^c4|j}||_|Sr`)rrP)rTr[rs r9with_quota_projectzCredentials.with_quota_projects !1 r^c<|j}|xs||_|Sr`)rrJ)rTscopesdefault_scopesrs r9rEzCredentials.with_scopess  $6 r^c|jd}|jd}|tk(r"ddlm}|jj |}nz|t k(r"ddlm}|jj|}nO|tk(r"ddl m }|jj|}n$tjdj||jd} | j!d } | j#d } | d k(s | d k(s| | kDr$tj$d j| | | d z| } |jd} |jd}|xs|jd}|jd}||| || ||S)aCreates a Credentials instance from parsed impersonated service account credentials info. **IMPORTANT**: This method does not validate the credential configuration. A security risk occurs when a credential configuration configured with malicious urls is used. When the credential configuration is accepted from an untrusted source, you should validate it before using with this method. Refer https://cloud.google.com/docs/authentication/external/externally-sourced-credentials for more details. Args: info (Mapping[str, str]): The impersonated service account credentials info in Google format. scopes (Sequence[str]): Optional list of scopes to include in the credentials. Returns: google.oauth2.credentials.Credentials: The constructed credentials. Raises: InvalidType: If the info["source_credentials"] are not a supported impersonation type InvalidValue: If the info["service_account_impersonation_url"] is not in the expected format. ValueError: If the info is not in the expected format. rUtyperr)r)rz.source credential of type {} is not supported.!service_account_impersonation_url/z:generateAccessTokenz'Cannot extract target principal from {}rXr[rr\)r[r\)get'_SOURCE_CREDENTIAL_AUTHORIZED_USER_TYPE google.oauth2rr<from_authorized_user_info'_SOURCE_CREDENTIAL_SERVICE_ACCOUNT_TYPErfrom_service_account_info8_SOURCE_CREDENTIAL_EXTERNAL_ACCOUNT_AUTHORIZED_USER_TYPE google.authr from_infor InvalidTyperrfindfind InvalidValue)clsinforsource_credentials_infosource_credentials_typerrUrrimpersonation_url start_index end_indexrVrXr[r\s r9&from_impersonated_service_account_infoz2Credentials.from_impersonated_service_account_infos8#'((+?"@"9"="=f"E "&M M 1!,!8!8!R!R'" %(O O 5!0!> 1)),33HMMOD  *}}w/H // JJx .u 5  !  "*% * --*HMMOGz )  *s$6G5GGH&'H  H)NFNr`)rrrrr@rrrrrrrrr<rtrrs@r9rrstE  26   X[DDE F X[4450 60 r^rcxtjj|}|tj|d}tj|j d}||d||}t |jdr|jjdn |j}|jtjk7rtjt| tj|} | d} | S#t t"f$r1} tjdjt|} | | d} ~ wwxYw) aMakes a request to the Google Cloud IAM service to sign a JWT using a service account's system-managed private key. Args: request (Request): The Request object to use. principal (str): The principal to request an access token for. headers (Mapping[str, str]): Map of headers to transmit. payload (Mapping[str, str]): The JWT payload to sign. Must be a serialized JSON object that contains a JWT Claims Set. delegates (Sequence[str]): The chained list of delegates required to grant the final access_token. If set, the sequence of identities must have "Service Account Token Creator" capability granted to the prceeding identity. For example, if set to [serviceAccountB, serviceAccountC], the source_credential must have the Token Creator role on serviceAccountB. serviceAccountB must have the Token Creator on serviceAccountC. Finally, C must have Token Creator on target_principal. If left unset, source_credential must have that role on target_principal. Raises: google.auth.exceptions.TransportError: Raised if there is an underlying HTTP connection error google.auth.exceptions.RefreshError: Raised if the impersonated credentials are not available. Common reasons are `iamcredentials.googleapis.com` is not enabled or the `Service Account Token Creator` is not assigned )rXrorrrr signedJwtz{}: No signed JWT in response.N)r _IAM_SIGNJWT_ENDPOINTrrr r!r"r#rr$r%r&rr'r(r)r+r,) r-r.rrorXr1rr2r3 jwt_response signed_jwtr7r8s r9r}r}s :,,33I>L"tzz'/B CD ::d  " "7 +D<dSH 8==( +  W% ]] +..(%%nmDD &zz-0 !+.  j !&)) , 3 3N C] :% &sC99D9,D44D9)"rrrAr http.clientclientr%rrrrrrr r r rr r(rMr{rrrrrr:rDrSigningrr<rr}rir^r9rs  ! , #"!># EQ +<'*;'&9 77 ;&|a ++,, a H p @@p fGI7&r^