Skip to content

Commit 6ecc915

Browse files
liminwliminw
committed
Auth samples for Endpoints.
Added three samples: 1. Use App Engine default service account client (without key file). 2. Use non-default service account client (without key file). 3. Use Google ID token client (without key file)
1 parent e3fcefd commit 6ecc915

File tree

10 files changed

+408
-8
lines changed

10 files changed

+408
-8
lines changed

‎appengine/flexible/endpoints/README.md

Lines changed: 73 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -57,9 +57,9 @@ With the API key, you can use the echo client to access the API:
5757

5858
$ python clients/echo-client.py https://YOUR-PROJECT-ID.appspot.com YOUR-API-KEY
5959

60-
### Using the JWT client.
60+
### Using the JWT client (with key file)
6161

62-
The JWT client demonstrates how to use service accounts to authenticate to endpoints. To use the client, you'll need both an API key (as described in the echo client section) and a service account. To create a service account:
62+
The JWT client demonstrates how to use a service account to authenticate to endpoints with the service account's private key file. To use the client, you'll need both an API key (as described in the echo client section) and a service account. To create a service account:
6363

6464
1. Open the Credentials page of the API Manager in the [Cloud Console](https://console.cloud.google.com/apis/credentials).
6565
2. Click 'Create credentials'.
@@ -76,7 +76,7 @@ Now you can use the JWT client to make requests to the API:
7676

7777
$ python clients/google-jwt-client.py https://YOUR-PROJECT-ID.appspot.com YOUR-API-KEY /path/to/service-account.json
7878

79-
### Using the ID Token client.
79+
### Using the ID Token client (with key file)
8080

8181
The ID Token client demonstrates how to use user credentials to authenticate to endpoints. To use the client, you'll need both an API key (as described in the echo client section) and a OAuth2 client ID. To create a client ID:
8282

@@ -93,3 +93,73 @@ To use the client ID for authentication:
9393
Now you can use the client ID to make requests to the API:
9494

9595
$ python clients/google-id-token-client.py https://YOUR-PROJECT-ID.appspot.com YOUR-API-KEY /path/to/client-id.json
96+
97+
### Using the App Engine default service account client (no key file needed)
98+
99+
The App Engine default service account client demonstrates how to use the Google App Engine default service account to authenticate to endpoints.
100+
We refer to the project that serves API requests as the server project. You also need to create a client project in the [Cloud Console](https://console.cloud.google.com).
101+
102+
To use the App Engine default service account for authentication:
103+
104+
1. Update the `gae_default_service_account`'s `x-issuer` and `x-jwks_uri` in `swagger.yaml` with your client project ID.
105+
2. Redeploy your server application.
106+
3. Update clients/service_to_service_gae_default/main.py, replace 'YOUR-CLIENT-PROJECT-ID' and 'YOUR-SERVER-PROJECT-ID' with your client project ID and your server project ID.
107+
4. Upload your application to Google App Engine by invoking the following command under clients/service_to_service_gae_default directory.
108+
This opens a browser window for you to sign in using your Google account. You'll be providing the project ID as the argument for -A. Use
109+
the -V argument to specify a version name. Additional information on how to deploy an app to Google Cloud App Engine can be found [here](https://cloud.google.com/appengine/docs/python/quickstart).
110+
111+
appcfg.py -A <YOUR-CLIENT-PROJECT-ID> -V v1 update .
112+
113+
Your client app is now deployed at https://<YOUR-CLIENT-PROJECT-ID>.appspot.com. When you access https://<YOUR-CLIENT-PROJECT-ID>.appspot.com, your client calls your server project API using
114+
the client's service account.
115+
116+
### Using the service account client (no key file needed)
117+
118+
The service account client demonstrates how to use a non-default service account to authenticate to endpoints.
119+
We refer to the project that serves API requests as the server project. You also need to create a client project in the [Cloud Console](https://console.cloud.google.com).
120+
121+
In the example, we use Google Cloud Identity and Access Management (IAM) API to create a JSON Web Token (JWT) for a service account, and use it to call an Endpoints API.
122+
123+
To use the client, you will need to enable "Service Account Actor" role for App Engine default service account:
124+
1. Go to [IAM page] of your client project (https://console.cloud.google.com/iam-admin/iam).
125+
2. For App Engine default service account, from “Role(s)” drop-down menu, select “Project”-“Service Account Actor”, and Save.
126+
127+
You also need to install Google API python library because the client code (main.py) uses googleapiclient,
128+
which is a python library that needs to be uploaded to App Engine with your application code. After you run "pip install -t lib -r requirements",
129+
Google API python client library should have already been installed under 'lib' directory. Additional information can be found
130+
[here](https://cloud.google.com/appengine/docs/python/tools/using-libraries-python-27#requesting_a_library).
131+
132+
To use the client for authentication:
133+
1. Update the `google_service_account`'s `x-issuer` and `x-jwks_uri` in `swagger.yaml` with your service account email.
134+
2. Redeploy your server application.
135+
3. Update clients/service_to_service_non_default/main.py, replace 'YOUR-SERVICE-ACCOUNT-EMAIL', 'YOUR-SERVER-PROJECT-ID' and 'YOUR-CLIENT-PROJECT-ID'
136+
with your service account email, your server project ID, and your client project ID.
137+
4. Upload your application to Google App Engine by invoking the following command under clients/service_to_service_non_default directory.
138+
This opens a browser window for you to sign in using your Google account. You'll be providing the project ID as the argument for -A. Use
139+
the -V argument to specify a version name. Additional information on how to deploy an app to Google Cloud App Engine can be found [here](https://cloud.google.com/appengine/docs/python/quickstart).
140+
141+
appcfg.py -A <YOUR-CLIENT-PROJECT-ID> -V v1 update .
142+
143+
Your client app is now deployed at https://<YOUR-CLIENT-PROJECT-ID>.appspot.com. When you access https://<YOUR-CLIENT-PROJECT-ID>.appspot.com, your client calls your server project API using
144+
the client's service account.
145+
146+
### Using the ID token client (no key file needed)
147+
148+
This example demonstrates how to authenticate to endpoints from Google App Engine default service account using Google ID token.
149+
In the example, we first create a JSON Web Token (JWT) using the App Engine default service account. We then request a Google
150+
ID token using the JWT, and call an Endpoints API using the Google ID token.
151+
152+
We refer to the project that serves API requests as the server project. You also need to create a client project in the [Cloud Console](https://console.cloud.google.com).
153+
154+
To use the client for authentication:
155+
1. Update the `google_id_token`'s audiences, replace `YOUR-SERVER-PROJECT-ID` with your server project ID.
156+
2. Redeploy your server application.
157+
3. Update clients/service_to_service_google_id_token/main.py, replace 'YOUR-CLIENT-PROJECT-ID' and 'YOUR-SERVER-PROJECT-ID' with your client project ID and your server project ID.
158+
4. Upload your application to Google App Engine by invoking the following command under clients/service_to_service_google_id_token directory.
159+
This opens a browser window for you to sign in using your Google account. You'll be providing the project ID as the argument for -A. Use
160+
the -V argument to specify a version name. Additional information on how to deploy an app to Google Cloud App Engine can be found [here](https://cloud.google.com/appengine/docs/python/quickstart).
161+
162+
appcfg.py -A <YOUR-CLIENT-PROJECT-ID> -V v1 update .
163+
164+
Your client app is now deployed at https://<YOUR-CLIENT-PROJECT-ID>.appspot.com. When you access https://<YOUR-CLIENT-PROJECT-ID>.appspot.com, your client calls your server project API from
165+
the client's service account using Google ID token.

‎appengine/flexible/endpoints/clients/service_to_service_gae_default/app.yaml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
runtime: python27
2+
api_version: 1
3+
threadsafe: true
4+
5+
handlers:
6+
- url: /.*
7+
script: main.app

‎appengine/flexible/endpoints/clients/service_to_service_gae_default/main.py

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
# Copyright 2016 Google Inc. All Rights Reserved.
2+
#
3+
# Licensed under the Apache License, Version 2.0(the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http: // www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
"""Example of calling a Google Cloud Endpoint API with a JWT signed by
16+
Google App Engine Default Service Account."""
17+
18+
import base64
19+
import httplib
20+
import json
21+
import time
22+
23+
from google.appengine.api import app_identity
24+
import webapp2
25+
26+
DEFAUTL_SERVICE_ACCOUNT = '[email protected]'
27+
HOST = "YOUR-SERVER-PROJECT-ID.appspot.com"
28+
29+
30+
def generate_jwt():
31+
"""Generates a signed JSON Web Token using the Google App Engine default
32+
service account."""
33+
now = int(time.time())
34+
35+
header_json = json.dumps({
36+
"typ": "JWT",
37+
"alg": "RS256"})
38+
39+
payload_json = json.dumps({
40+
'iat': now,
41+
# expires after one hour.
42+
"exp": now + 3600,
43+
# iss is the Google App Engine default service account email.
44+
'iss': DEFAUTL_SERVICE_ACCOUNT,
45+
'sub': DEFAUTL_SERVICE_ACCOUNT,
46+
# aud must match 'audience' in the security configuration in your
47+
# swagger spec.It can be any string.
48+
'aud': 'echo.endpoints.sample.google.com',
49+
"email": DEFAUTL_SERVICE_ACCOUNT
50+
})
51+
52+
headerAndPayload = '{}.{}'.format(base64.urlsafe_b64encode(header_json),
53+
base64.urlsafe_b64encode(payload_json))
54+
(key_name, signature) = app_identity.sign_blob(headerAndPayload)
55+
signed_jwt = '{}.{}'.format(headerAndPayload,
56+
base64.urlsafe_b64encode(signature))
57+
58+
return signed_jwt
59+
60+
61+
def make_request(signed_jwt):
62+
"""Makes a request to the auth info endpoint for Google JWTs."""
63+
headers = {'Authorization': 'Bearer {}'.format(signed_jwt)}
64+
conn = httplib.HTTPSConnection(HOST)
65+
conn.request("GET", '/auth/info/googlejwt', None, headers)
66+
res = conn.getresponse()
67+
conn.close()
68+
return res.read()
69+
70+
71+
class MainPage(webapp2.RequestHandler):
72+
def get(self):
73+
self.response.headers['Content-Type'] = 'text/plain'
74+
signed_jwt = generate_jwt()
75+
res = make_request(signed_jwt)
76+
self.response.write(res)
77+
78+
79+
app = webapp2.WSGIApplication([
80+
('/', MainPage),
81+
], debug=True)

‎appengine/flexible/endpoints/clients/service_to_service_google_id_token/app.yaml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
runtime: python27
2+
api_version: 1
3+
threadsafe: true
4+
5+
handlers:
6+
- url: /.*
7+
script: main.app

‎appengine/flexible/endpoints/clients/service_to_service_google_id_token/main.py

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
# Copyright 2016 Google Inc. All Rights Reserved.
2+
#
3+
# Licensed under the Apache License, Version 2.0(the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http: // www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
"""Example of calling a Google Cloud Endpoint API from Google App Engine
16+
Default Service Account using Google ID token."""
17+
18+
import base64
19+
import httplib
20+
import json
21+
import time
22+
import urllib
23+
24+
from google.appengine.api import app_identity
25+
import webapp2
26+
27+
DEFAUTL_SERVICE_ACCOUNT = "[email protected]"
28+
HOST = "YOUR-SERVER-PROJECT-ID.appspot.com"
29+
TARGET_AUD = "[email protected]"
30+
31+
32+
def generate_jwt():
33+
"""Generates a signed JSON Web Token using the Google App Engine default
34+
service account."""
35+
now = int(time.time())
36+
37+
header_json = json.dumps({
38+
"typ": "JWT",
39+
"alg": "RS256"})
40+
41+
payload_json = json.dumps({
42+
"iat": now,
43+
# expires after one hour.
44+
"exp": now + 3600,
45+
# iss is the Google App Engine default service account email.
46+
"iss": DEFAUTL_SERVICE_ACCOUNT,
47+
# scope must match 'audience' for google_id_token in the security
48+
# configuration in your swagger spec.
49+
"scope": TARGET_AUD,
50+
# aud must be Google token endpoints URL.
51+
"aud": "https://www.googleapis.com/oauth2/v4/token"
52+
})
53+
54+
headerAndPayload = '{}.{}'.format(base64.urlsafe_b64encode(header_json),
55+
base64.urlsafe_b64encode(payload_json))
56+
(key_name, signature) = app_identity.sign_blob(headerAndPayload)
57+
signed_jwt = '{}.{}'.format(headerAndPayload,
58+
base64.urlsafe_b64encode(signature))
59+
60+
return signed_jwt
61+
62+
63+
def get_id_token():
64+
"""Request a Google ID token using a JWT."""
65+
params = urllib.urlencode({
66+
'grant_type': 'urn:ietf:params:oauth:grant-type:jwt-bearer',
67+
'assertion': generate_jwt()})
68+
headers = {"Content-Type": "application/x-www-form-urlencoded"}
69+
conn = httplib.HTTPSConnection("www.googleapis.com")
70+
conn.request("POST", "/oauth2/v4/token", params, headers)
71+
res = json.loads(conn.getresponse().read())
72+
conn.close()
73+
return res['id_token']
74+
75+
76+
def make_request(token):
77+
"""Makes a request to the auth info endpoint for Google ID token."""
78+
headers = {'Authorization': 'Bearer {}'.format(token)}
79+
conn = httplib.HTTPSConnection(HOST)
80+
conn.request("GET", '/auth/info/googleidtoken', None, headers)
81+
res = conn.getresponse()
82+
conn.close()
83+
return res.read()
84+
85+
86+
class MainPage(webapp2.RequestHandler):
87+
def get(self):
88+
self.response.headers['Content-Type'] = 'text/plain'
89+
token = get_id_token()
90+
res = make_request(token)
91+
self.response.write(res)
92+
93+
94+
app = webapp2.WSGIApplication([
95+
('/', MainPage),
96+
], debug=True)

‎appengine/flexible/endpoints/clients/service_to_service_non_default/app.yaml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
runtime: python27
2+
api_version: 1
3+
threadsafe: true
4+
5+
handlers:
6+
- url: /.*
7+
script: main.app

‎appengine/flexible/endpoints/clients/service_to_service_non_default/appengine_config.py

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
from google.appengine.ext import vendor
2+
3+
vendor.add('lib')

‎appengine/flexible/endpoints/clients/service_to_service_non_default/main.py

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
# Copyright 2016 Google Inc. All Rights Reserved.
2+
#
3+
# Licensed under the Apache License, Version 2.0(the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http: // www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
"""Example of calling a Google Cloud Endpoint API with a JWT signed by a
16+
Service Account."""
17+
18+
import base64
19+
import httplib
20+
import json
21+
import time
22+
23+
from googleapiclient.discovery import build
24+
import httplib2
25+
from oauth2client.contrib.appengine import AppAssertionCredentials
26+
import webapp2
27+
28+
SERVICE_ACCOUNT_EMAIL = "YOUR-SERVICE-ACCOUNT-EMAIL"
29+
HOST = "YOUR-SERVER-PROJECT-ID.appspot.com"
30+
SERVICE_ACCOUNT = \
31+
"projects/YOUR-CLIENT-PROJECT-ID/serviceAccounts/YOUR-SERVICE-ACCOUNT-EMAIL"
32+
33+
34+
def generate_jwt():
35+
"""Generates a signed JSON Web Token using a service account."""
36+
credentials = AppAssertionCredentials(
37+
'https://www.googleapis.com/auth/iam')
38+
http_auth = credentials.authorize(httplib2.Http())
39+
service = build(serviceName='iam', version='v1', http=http_auth)
40+
41+
now = int(time.time())
42+
43+
header_json = json.dumps({
44+
"typ": "JWT",
45+
"alg": "RS256"})
46+
47+
payload_json = json.dumps({
48+
'iat': now,
49+
# expires after one hour.
50+
"exp": now + 3600,
51+
# iss is the service account email.
52+
'iss': SERVICE_ACCOUNT_EMAIL,
53+
'sub': SERVICE_ACCOUNT_EMAIL,
54+
# aud must match 'audience' in the security configuration in your
55+
# swagger spec.It can be any string.
56+
'aud': 'echo.endpoints.sample.google.com',
57+
"email": SERVICE_ACCOUNT_EMAIL
58+
})
59+
60+
headerAndPayload = '{}.{}'.format(base64.urlsafe_b64encode(header_json),
61+
base64.urlsafe_b64encode(payload_json))
62+
slist = service.projects().serviceAccounts().signBlob(
63+
name=SERVICE_ACCOUNT,
64+
body={'bytesToSign': base64.b64encode(headerAndPayload)})
65+
res = slist.execute()
66+
signature = base64.urlsafe_b64encode(
67+
base64.decodestring(res['signature']))
68+
signed_jwt = '{}.{}'.format(headerAndPayload, signature)
69+
70+
return signed_jwt
71+
72+
73+
def make_request(signed_jwt):
74+
"""Makes a request to the auth info endpoint for Google JWTs."""
75+
headers = {'Authorization': 'Bearer {}'.format(signed_jwt)}
76+
conn = httplib.HTTPSConnection(HOST)
77+
conn.request("GET", '/auth/info/googlejwt', None, headers)
78+
res = conn.getresponse()
79+
conn.close()
80+
return res.read()
81+
82+
83+
class MainPage(webapp2.RequestHandler):
84+
def get(self):
85+
self.response.headers['Content-Type'] = 'text/plain'
86+
signed_jwt = generate_jwt()
87+
res = make_request(signed_jwt)
88+
self.response.write(res)
89+
90+
91+
app = webapp2.WSGIApplication([
92+
('/', MainPage),
93+
], debug=True)

0 commit comments

Comments
 (0)