Skip to main content

A set of custom plugins for Google Authentication Library

Project description

Google Auth Plugins Python Library

CI PyPI version

This library (built on top of Google's official SDK) aims to provide features not implemented by the standard library for whatever reason.

Common reason is that the latter is not a priority in the SDK's roadmap.

⚠️ This project doesn't want or plan to replace the official SDK but rather to be a space for experimentation providing beta features (because security does have to wait).

I hope that the features available in this repo will be integrated in the official library for the common good.

Index

Main difference with google-auth

For security reasons, this project will always drop support for a python version as soon as security support ends.

As an example, the version 2.16.1 of google-auth launched on 2023-02-17 still supports python3.6^1.

Installation

google-auth-plugins requires Python 3.7 or newer, and can be installed directly via pip:

python3 -m venv venv && source venv/bin/activate
python -m pip install google-auth-plugins

Usage

Domain-wide delegation credentials

A bit of context

As stated in this issue currently it's not possible to produce a delegated credentials via an impersonated identity.

To put it another way, today the only way to obtain those credentials is with a service account key 🤯.

Given the importance of this kind of service accounts it seems relevant to limit as much as possible long-term credentials in order to protect against leaks.

Domain-wide delegation credentials allows that.

Please find below an example:

import google.auth
from google_auth_plugins import dwd_credentials

target_scopes = ['https://www.googleapis.com/auth/calendar.readonly']
subject = "john.doe@pamplemousse.com"

# The impersonated service account must grant `Service Account Token Creator` to the identity represented by source_credentials
source_credentials, _ = google.auth.default()

delegated_credentials = dwd_credentials.Credentials(
  subject=subject,
  source_credentials=source_credentials,
  target_principal='dwd-impersonated-account@_project_.iam.gserviceaccount.com',
  target_scopes = target_scopes,
)

Alternatively, if source_credentials is the service account with domain-wide delegation, you can skip target_principal definition.

source_credentials, _ = google.auth.default()

delegated_credentials = dwd_credentials.Credentials(
  subject=subject,
  source_credentials=source_credentials,
  target_scopes = target_scopes,
)

Finally, you can switch delegated credentials as defined below:

alice_delegated_creds = dwd_credentials.Credentials(
  subject="alice@example.com",
  source_credentials=source_credentials,
  target_scopes = target_scopes,
)

bob_delegated_creds = alice_delegated_creds.with_subject("bob@example.com")

Note: this module is heavily inspired by Johannes Passing blog post 🚀.

Tests

make test

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

google-auth-plugins-1.0.1.tar.gz (10.9 kB view details)

Uploaded Source

Built Distribution

google_auth_plugins-1.0.1-py3-none-any.whl (11.4 kB view details)

Uploaded Python 3

File details

Details for the file google-auth-plugins-1.0.1.tar.gz.

File metadata

  • Download URL: google-auth-plugins-1.0.1.tar.gz
  • Upload date:
  • Size: 10.9 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/4.0.1 CPython/3.11.2

File hashes

Hashes for google-auth-plugins-1.0.1.tar.gz
Algorithm Hash digest
SHA256 7b96f618bec899a7ca251ded5ffea6d22283970597a535fc614a06371f81c201
MD5 a912f0bcc2a80961536afbbc08fca571
BLAKE2b-256 d2061bd651b9e37557c2aeeb073c18e35ba81cde404cc4fd0d35618237778fdc

See more details on using hashes here.

File details

Details for the file google_auth_plugins-1.0.1-py3-none-any.whl.

File metadata

File hashes

Hashes for google_auth_plugins-1.0.1-py3-none-any.whl
Algorithm Hash digest
SHA256 41280ace51c13aeedf4bdf24cb05743fdad173fd0268d9eae0c953b4267061ed
MD5 c60018eb67f109f63ad7ffdab9c699c0
BLAKE2b-256 d9d322c0e69500ddfd4f2d7434d985f322ef469e3595f893af0db808346da166

See more details on using hashes here.

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page