Class ExternalAccountCredentials (1.6.1)
Stay organized with collections
Save and categorize content based on your preferences.
publicabstractclass ExternalAccountCredentialsextendsGoogleCredentialsimplementsQuotaProjectIdProviderBase external account credentials class.
Handles initializing external credentials, calls to STS, and service account impersonation.
Inheritance
java.lang.Object > Credentials > OAuth2Credentials > GoogleCredentials > ExternalAccountCredentialsImplements
QuotaProjectIdProviderInherited Members
Static Methods
fromStream(InputStream credentialsStream)
publicstaticExternalAccountCredentialsfromStream(InputStreamcredentialsStream)Returns credentials defined by a JSON file stream.
Returns IdentityPoolCredentials or AwsCredentials.
ExternalAccountCredentials
the credential defined by the credentialsStream
IOException
if the credential cannot be created from the stream
fromStream(InputStream credentialsStream, HttpTransportFactory transportFactory)
publicstaticExternalAccountCredentialsfromStream(InputStreamcredentialsStream,HttpTransportFactorytransportFactory)Returns credentials defined by a JSON file stream.
Returns a IdentityPoolCredentials or AwsCredentials.
transportFactory
HttpTransportFactory the HTTP transport factory used to create the transport to get access tokens
ExternalAccountCredentials
the credential defined by the credentialsStream
IOException
if the credential cannot be created from the stream
Constructors
ExternalAccountCredentials(HttpTransportFactory transportFactory, String audience, String subjectTokenType, String tokenUrl, ExternalAccountCredentials.CredentialSource credentialSource, String tokenInfoUrl, String serviceAccountImpersonationUrl, String quotaProjectId, String clientId, String clientSecret, Collection<String> scopes)
protectedExternalAccountCredentials(HttpTransportFactorytransportFactory,Stringaudience,StringsubjectTokenType,StringtokenUrl,ExternalAccountCredentials.CredentialSourcecredentialSource,StringtokenInfoUrl,StringserviceAccountImpersonationUrl,StringquotaProjectId,StringclientId,StringclientSecret,Collection<String>scopes)Constructor with minimum identifying information and custom HTTP transport. Does not support workforce credentials.
transportFactory
HttpTransportFactory HTTP transport factory, creates the transport used to get access tokens
audience
String the STS audience which is usually the fully specified resource name of the workload/workforce pool provider
subjectTokenType
String the STS subject token type based on the OAuth 2.0 token exchange spec. Indicates the type of the security token in the credential file
credentialSource
com.google.auth.oauth2.ExternalAccountCredentials.CredentialSourcethe external credential source
tokenInfoUrl
String the endpoint used to retrieve account related information. Required for gCloud session account identification.
serviceAccountImpersonationUrl
String the URL for the service account impersonation request. This is only required for workload identity pools when APIs to be accessed have not integrated with UberMint. If this is not available, the STS returned GCP access token is directly used. May be null.
ExternalAccountCredentials(HttpTransportFactory transportFactory, String audience, String subjectTokenType, String tokenUrl, ExternalAccountCredentials.CredentialSource credentialSource, String tokenInfoUrl, String serviceAccountImpersonationUrl, String quotaProjectId, String clientId, String clientSecret, Collection<String> scopes, EnvironmentProvider environmentProvider)
protectedExternalAccountCredentials(HttpTransportFactorytransportFactory,Stringaudience,StringsubjectTokenType,StringtokenUrl,ExternalAccountCredentials.CredentialSourcecredentialSource,StringtokenInfoUrl,StringserviceAccountImpersonationUrl,StringquotaProjectId,StringclientId,StringclientSecret,Collection<String>scopes,EnvironmentProviderenvironmentProvider)See ExternalAccountCredentials#ExternalAccountCredentials(HttpTransportFactory, String, String, String, CredentialSource, String, String, String, String, String, Collection)
credentialSource
com.google.auth.oauth2.ExternalAccountCredentials.CredentialSourceenvironmentProvider
com.google.auth.oauth2.EnvironmentProviderthe environment provider. May be null. Defaults to SystemEnvironmentProvider.
ExternalAccountCredentials(ExternalAccountCredentials.Builder builder)
protectedExternalAccountCredentials(ExternalAccountCredentials.Builderbuilder)Internal constructor with minimum identifying information and custom HTTP transport. See ExternalAccountCredentials.Builder.
Fields
impersonatedCredentials
protectedfinalImpersonatedCredentialsimpersonatedCredentialstransportFactory
protectedtransientHttpTransportFactorytransportFactoryMethods
exchangeExternalCredentialForAccessToken(StsTokenExchangeRequest stsTokenExchangeRequest)
protectedAccessTokenexchangeExternalCredentialForAccessToken(StsTokenExchangeRequeststsTokenExchangeRequest)Exchanges the external credential for a GCP access token.
stsTokenExchangeRequest
com.google.auth.oauth2.StsTokenExchangeRequestthe STS token exchange request
AccessToken
the access token returned by STS
IOException
if the call to STS fails
getAudience()
publicStringgetAudience()getClientId()
publicStringgetClientId()getClientSecret()
publicStringgetClientSecret()getCredentialSource()
publicExternalAccountCredentials.CredentialSourcegetCredentialSource()com.google.auth.oauth2.ExternalAccountCredentials.CredentialSource
getQuotaProjectId()
publicStringgetQuotaProjectId()getRequestMetadata(URI uri)
publicMap<String,List<String>>getRequestMetadata(URIuri)Provide the request metadata by ensuring there is a current access token and providing it as an authorization bearer token.
getRequestMetadata(URI uri, Executor executor, RequestMetadataCallback callback)
publicvoidgetRequestMetadata(URIuri,Executorexecutor,RequestMetadataCallbackcallback)Get the current request metadata without blocking.
This should be called by the transport layer on each request, and the data should be populated in headers or other context. The implementation can either call the callback inline or asynchronously. Either way it should never block in this method. The executor is provided for tasks that may block.
The default implementation will just call #getRequestMetadata(URI) then the callback from the given executor.
The convention for handling binary data is for the key in the returned map to end with
"-bin" and for the corresponding values to be base64 encoded.
getScopes()
publicCollection<String>getScopes()getServiceAccountImpersonationUrl()
publicStringgetServiceAccountImpersonationUrl()getSubjectTokenType()
publicStringgetSubjectTokenType()getTokenInfoUrl()
publicStringgetTokenInfoUrl()getTokenUrl()
publicStringgetTokenUrl()getWorkforcePoolUserProject()
publicStringgetWorkforcePoolUserProject()isWorkforcePoolConfiguration()
publicbooleanisWorkforcePoolConfiguration()Returns whether or not the current configuration is for Workforce Pools (which enable 3p user identities, rather than workloads).
retrieveSubjectToken()
publicabstractStringretrieveSubjectToken()Retrieves the external subject token to be exchanged for a GCP access token.
Must be implemented by subclasses as the retrieval method is dependent on the credential source.
String
the external subject token