Class DownscopedCredentials (1.18.0)

publicfinalclass DownscopedCredentialsextendsOAuth2Credentials

DownscopedCredentials enables the ability to downscope, or restrict, the Identity and Access Management (IAM) permissions that a short-lived credential can use for Cloud Storage.

To downscope permissions you must define a CredentialAccessBoundary which specifies the upper bound of permissions that the credential can access. You must also provide a source credential which will be used to acquire the downscoped credential.

See for more information.

Usage:


GoogleCredentialssourceCredentials=GoogleCredentials.getApplicationDefault()
.createScoped("https://www.googleapis.com/auth/cloud-platform");
CredentialAccessBoundary.AccessBoundaryRulerule=
CredentialAccessBoundary.AccessBoundaryRule.newBuilder()
.setAvailableResource(
"//storage.googleapis.com/projects/_/buckets/bucket")
.addAvailablePermission("inRole:roles/storage.objectViewer")
.build();
DownscopedCredentialsdownscopedCredentials=
DownscopedCredentials.newBuilder()
.setSourceCredential(sourceCredentials)
.setCredentialAccessBoundary(
CredentialAccessBoundary.newBuilder().addRule(rule).build())
.build();
AccessTokenaccessToken=downscopedCredentials.refreshAccessToken();
OAuth2Credentialscredentials=OAuth2Credentials.create(accessToken);
Storagestorage=
StorageOptions.newBuilder().setCredentials(credentials).build().getService();
Blobblob=storage.get(BlobId.of("bucket","object"));
System.out.printf("Blob %s retrieved.",blob.getBlobId());

Note that OAuth2CredentialsWithRefresh can instead be used to consume the downscoped token, allowing for automatic token refreshes by providing a OAuth2CredentialsWithRefresh.OAuth2RefreshHandler.

Inheritance

java.lang.Object > Credentials > OAuth2Credentials > DownscopedCredentials

Inherited Members

Credentials.blockingGetToCallback(URI,RequestMetadataCallback)

Credentials.getRequestMetadata()

OAuth2Credentials.<T>getFromServiceLoader(Class<? extends T>,T)

OAuth2Credentials.<T>newInstance(String)

OAuth2Credentials.addChangeListener(OAuth2Credentials.CredentialsChangedListener)

OAuth2Credentials.create(AccessToken)

OAuth2Credentials.equals(Object)

OAuth2Credentials.getAccessToken()

OAuth2Credentials.getAdditionalHeaders()

OAuth2Credentials.getAuthenticationType()

OAuth2Credentials.getRequestMetadata(URI)

OAuth2Credentials.getRequestMetadata(URI,Executor,RequestMetadataCallback)

OAuth2Credentials.getRequestMetadataInternal()

OAuth2Credentials.hasRequestMetadata()

OAuth2Credentials.hasRequestMetadataOnly()

OAuth2Credentials.hashCode()

OAuth2Credentials.newBuilder()

OAuth2Credentials.refresh()

OAuth2Credentials.refreshAccessToken()

OAuth2Credentials.refreshIfExpired()

OAuth2Credentials.removeChangeListener(OAuth2Credentials.CredentialsChangedListener)

OAuth2Credentials.toBuilder()

OAuth2Credentials.toString()

Object.clone()

Object.notify()

Object.wait()

Object.wait(long,int)

Static Methods

newBuilder()

publicstaticDownscopedCredentials.BuildernewBuilder()

Returns
Type	Description
`DownscopedCredentials.Builder`

Methods

getCredentialAccessBoundary()

publicCredentialAccessBoundarygetCredentialAccessBoundary()

Returns
Type	Description
`CredentialAccessBoundary`

getSourceCredentials()

publicGoogleCredentialsgetSourceCredentials()

Returns
Type	Description
`GoogleCredentials`

refreshAccessToken()

publicAccessTokenrefreshAccessToken()

Method to refresh the access token according to the specific type of credentials.

Throws IllegalStateException if not overridden since direct use of OAuth2Credentials is only for temporary or non-refreshing access tokens.

Returns
Type	Description
`AccessToken`

Overrides