使用 Workload Identity Federation 对 Python 中的 Google-Cloud-Storage 进行身份验证

Question

Is it possible to use the OIDC method of Google's Workload Identity Federation to authenticate my Python Application's Google Cloud Storage package.

I want to do something like this:

import os
os.environ["GOOGLE_APPLICATION_CREDENTIALS"] = str(os.path.dirname(os.path.dirname(__file__))) + "/keys/credentials.json"
from google.cloud import storage

import google.oauth2.id_token
import google.auth.transport.requests

request = google.auth.transport.requests.Request()
target_audience = "https://pubsub.googleapis.com"

obtained_id_token = google.oauth2.id_token.fetch_id_token(request, target_audience)

storage_client = storage.Client(credentials=obtained_id_token)

This gives the following error:

ValueError: This library only supports credentials from google-auth-library-python. See https://google-auth.readthedocs.io/en/latest/ for help on authentication with this library.

Answer 1

Have a look at Automatic on Sal's Exchange Generic OIDC Credentials for GCP Credentials repo.

IIUC this gets your from federated credentials to Google Application Default Credentials (see below) that you can use with any Google SDK.

To @john-hanley's comment, you're using the auth library incorrectly.

See google.auth and specifically (after export GOOGLE_APPLICATION_CREDENTIALS=/path/to/your/key.json ) you can just:

import google.auth

credentials, project_id = google.auth.default()

Answer 2

can't reply to comments directly but

for reference, here are some of the links describing this more

• federation will exchange your ambient aws|oidc|azure credentials for one that GCP understands (theres's no svc account key involved) see gcp workload identity federation

• google issued oidc ( id_tokens ) are usually used here to access services you deploy on cloud run, etc see google id tokens

• finally and just for ref, google has very specific way certain services authenticate using a svc account jwt (its not oidc nor oauth but something google specific)...its not at all common but its described here see jwt access tokens

Answer 3

This does not solve the Workload Identity Federation part of the question, but does make the question code work correctly:

import google.oauth2.id_token
import google.auth.transport.requests

request = google.auth.transport.requests.Request()
target_audience = "https://storage.cloud.google.com/"

# Create ID token credentials.
credentials = google.oauth2.id_token.fetch_id_token_credentials(target_audience, request=request)

# Refresh the credential to obtain an ID token.
credentials.refresh(request)

id_token = credentials.token
id_token_expiry = credentials.expiry

storage_client = storage.Client(credentials=credentials)
bucket = storage_client.get_bucket(settings.GOOGLE_CLOUD_BUCKET_NAME)

Still need to see if its possible to authenticate without needing the Credentials json file in the repo.