A set of custom plugins for Google Authentication Library
Project description
Google Auth Plugins Python Library
This library (built on top of Google's official SDK) aims to provide features not implemented by the standard library for whatever reason.
Common reason is that the latter is not a priority in the SDK's roadmap.
⚠️ This project doesn't want or plan to replace the official SDK but rather to be a space for experimentation providing beta features (because security does have to wait).
I hope that the features available in this repo will be integrated in the official library for the common good.
Index
Main difference with google-auth
For security reasons, this project will always drop support for a python version as soon as security support ends.
As an example, the version 2.16.1 of google-auth
launched on 2023-02-17 still supports python3.6^1.
Installation
google-auth-plugins
requires Python 3.7 or newer, and can be installed directly via pip
:
python3 -m venv venv && source venv/bin/activate
python -m pip install google-auth-plugins
Usage
Domain-wide delegation credentials
A bit of context
As stated in this issue currently it's not possible to produce a delegated credentials via an impersonated identity.
To put it another way, today the only way to obtain those credentials is with a service account key 🤯.
Given the importance of this kind of service accounts it seems relevant to limit as much as possible long-term credentials in order to protect against leaks.
Domain-wide delegation credentials allows that.
Please find below an example:
import google.auth
from google_auth_plugins import dwd_credentials
target_scopes = ['https://www.googleapis.com/auth/calendar.readonly']
subject = "john.doe@pamplemousse.com"
# The impersonated service account must grant `Service Account Token Creator` to the identity represented by source_credentials
source_credentials, _ = google.auth.default()
delegated_credentials = dwd_credentials.Credentials(
subject=subject,
source_credentials=source_credentials,
target_principal='dwd-impersonated-account@_project_.iam.gserviceaccount.com',
target_scopes = target_scopes,
)
Alternatively, if source_credentials
is the service account with domain-wide delegation, you can skip target_principal definition.
source_credentials, _ = google.auth.default()
delegated_credentials = dwd_credentials.Credentials(
subject=subject,
source_credentials=source_credentials,
target_scopes = target_scopes,
)
Finally, you can switch delegated credentials as defined below:
alice_delegated_creds = dwd_credentials.Credentials(
subject="alice@example.com",
source_credentials=source_credentials,
target_scopes = target_scopes,
)
bob_delegated_creds = alice_delegated_creds.with_subject("bob@example.com")
Note: this module is heavily inspired by Johannes Passing blog post 🚀.
Tests
make test
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
File details
Details for the file google-auth-plugins-1.0.1.tar.gz
.
File metadata
- Download URL: google-auth-plugins-1.0.1.tar.gz
- Upload date:
- Size: 10.9 kB
- Tags: Source
- Uploaded using Trusted Publishing? No
- Uploaded via: twine/4.0.1 CPython/3.11.2
File hashes
Algorithm | Hash digest | |
---|---|---|
SHA256 | 7b96f618bec899a7ca251ded5ffea6d22283970597a535fc614a06371f81c201 |
|
MD5 | a912f0bcc2a80961536afbbc08fca571 |
|
BLAKE2b-256 | d2061bd651b9e37557c2aeeb073c18e35ba81cde404cc4fd0d35618237778fdc |
File details
Details for the file google_auth_plugins-1.0.1-py3-none-any.whl
.
File metadata
- Download URL: google_auth_plugins-1.0.1-py3-none-any.whl
- Upload date:
- Size: 11.4 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? No
- Uploaded via: twine/4.0.1 CPython/3.11.2
File hashes
Algorithm | Hash digest | |
---|---|---|
SHA256 | 41280ace51c13aeedf4bdf24cb05743fdad173fd0268d9eae0c953b4267061ed |
|
MD5 | c60018eb67f109f63ad7ffdab9c699c0 |
|
BLAKE2b-256 | d9d322c0e69500ddfd4f2d7434d985f322ef469e3595f893af0db808346da166 |