public class ImpersonatedCredentials extends GoogleCredentials implements ServiceAccountSigner, IdTokenProvider, QuotaProjectIdProviderImpersonatedCredentials allowing credentials issued to a user or service account to impersonate another. The source project using ImpersonatedCredentials must enable the "IAMCredentials" API. Also, the target service account must grant the originating principal the "Service Account Token Creator" IAM role.
Usage:
String credPath = "/path/to/svc_account.json"; ServiceAccountCredentials sourceCredentials = ServiceAccountCredentials .fromStream(new FileInputStream(credPath)); sourceCredentials = (ServiceAccountCredentials) sourceCredentials .createScoped(Arrays.asList("https://www.googleapis.com/auth/iam"));
ImpersonatedCredentials targetCredentials = ImpersonatedCredentials.create(sourceCredentials, "impersonated-account@project.iam.gserviceaccount.com", null, Arrays.asList("https://www.googleapis.com/auth/devstorage.read_only"), 300);
Storage storage_service = StorageOptions.newBuilder().setProjectId("project-id") .setCredentials(targetCredentials).build().getService();
for (Bucket b : storage_service.list().iterateAll()) System.out.println(b);
Static Methods
create(GoogleCredentials sourceCredentials, String targetPrincipal, List<String> delegates, List<String> scopes, int lifetime)
public static ImpersonatedCredentials create(GoogleCredentials sourceCredentials, String targetPrincipal, List<String> delegates, List<String> scopes, int lifetime)| Name | Description |
| sourceCredentials | GoogleCredentialsthe source credential used to acquire the impersonated credentials. It should be either a user account credential or a service account credential. |
| targetPrincipal | Stringthe service account to impersonate |
| delegates | List<String>the chained list of delegates required to grant the final access_token. If set, the sequence of identities must have "Service Account Token Creator" capability granted to the preceding identity. For example, if set to [serviceAccountB, serviceAccountC], the sourceCredential must have the Token Creator role on serviceAccountB. serviceAccountB must have the Token Creator on serviceAccountC. Finally, C must have Token Creator on target_principal. If left unset, sourceCredential must have that role on targetPrincipal. |
| scopes | List<String>scopes to request during the authorization grant |
| lifetime | intnumber of seconds the delegated credential should be valid. By default this value should be at most 3600. However, you can follow these instructions to set up the service account and extend the maximum lifetime to 43200 (12 hours). https://cloud.google.com/iam/docs/creating-short-lived-service-account-credentials#sa-credentials-oauth If the given lifetime is 0, default value 3600 will be used instead when creating the credentials. |
| Type | Description |
| ImpersonatedCredentials | new credentials |
create(GoogleCredentials sourceCredentials, String targetPrincipal, List<String> delegates, List<String> scopes, int lifetime, HttpTransportFactory transportFactory)
public static ImpersonatedCredentials create(GoogleCredentials sourceCredentials, String targetPrincipal, List<String> delegates, List<String> scopes, int lifetime, HttpTransportFactory transportFactory)| Name | Description |
| sourceCredentials | GoogleCredentialsthe source credential used to acquire the impersonated credentials. It should be either a user account credential or a service account credential. |
| targetPrincipal | Stringthe service account to impersonate |
| delegates | List<String>the chained list of delegates required to grant the final access_token. If set, the sequence of identities must have "Service Account Token Creator" capability granted to the preceding identity. For example, if set to [serviceAccountB, serviceAccountC], the sourceCredential must have the Token Creator role on serviceAccountB. serviceAccountB must have the Token Creator on serviceAccountC. Finally, C must have Token Creator on target_principal. If unset, sourceCredential must have that role on targetPrincipal. |
| scopes | List<String>scopes to request during the authorization grant |
| lifetime | intnumber of seconds the delegated credential should be valid. By default this value should be at most 3600. However, you can follow these instructions to set up the service account and extend the maximum lifetime to 43200 (12 hours). If the given lifetime is 0, default value 3600 will be used instead when creating the credentials. |
| transportFactory | HttpTransportFactoryHTTP transport factory that creates the transport used to get access tokens |
| Type | Description |
| ImpersonatedCredentials | new credentials |
create(GoogleCredentials sourceCredentials, String targetPrincipal, List<String> delegates, List<String> scopes, int lifetime, HttpTransportFactory transportFactory, String quotaProjectId)
public static ImpersonatedCredentials create(GoogleCredentials sourceCredentials, String targetPrincipal, List<String> delegates, List<String> scopes, int lifetime, HttpTransportFactory transportFactory, String quotaProjectId)| Name | Description |
| sourceCredentials | GoogleCredentialsthe source credential used to acquire the impersonated credentials. It should be either a user account credential or a service account credential. |
| targetPrincipal | Stringthe service account to impersonate |
| delegates | List<String>the chained list of delegates required to grant the final access_token. If set, the sequence of identities must have "Service Account Token Creator" capability granted to the preceding identity. For example, if set to [serviceAccountB, serviceAccountC], the sourceCredential must have the Token Creator role on serviceAccountB. serviceAccountB must have the Token Creator on serviceAccountC. Finally, C must have Token Creator on target_principal. If unset, sourceCredential must have that role on targetPrincipal. |
| scopes | List<String>scopes to request during the authorization grant |
| lifetime | intnumber of seconds the delegated credential should be valid. By default this value should be at most 3600. However, you can follow these instructions to set up the service account and extend the maximum lifetime to 43200 (12 hours). If the given lifetime is 0, default value 3600 will be used instead when creating the credentials. |
| transportFactory | HttpTransportFactoryHTTP transport factory that creates the transport used to get access tokens. |
| quotaProjectId | Stringthe project used for quota and billing purposes. Should be null unless the caller wants to use a project different from the one that owns the impersonated credential for billing/quota purposes. |
| Type | Description |
| ImpersonatedCredentials | new credentials |
newBuilder()
public static ImpersonatedCredentials.Builder newBuilder()| Type | Description |
| ImpersonatedCredentials.Builder |
Methods
createScoped(Collection<String> scopes)
public GoogleCredentials createScoped(Collection<String> scopes)If the credentials support scopes, creates a copy of the identity with the specified scopes; otherwise, returns the same instance.
| Name | Description |
| scopes | Collection<String> |
| Type | Description |
| GoogleCredentials |
createScopedRequired()
public boolean createScopedRequired()Indicates whether the credentials require scopes to be specified via a call to GoogleCredentials#createScoped before use.
| Type | Description |
| boolean |
equals(Object obj)
public boolean equals(Object obj)| Name | Description |
| obj | Object |
| Type | Description |
| boolean |
getAccount()
public String getAccount()Returns the email field of the serviceAccount that is being impersonated.
| Type | Description |
| String | email address of the impersonated service account |
getAdditionalHeaders()
protected Map<String,List<String>> getAdditionalHeaders()Provide additional headers to return as request metadata.
| Type | Description |
| Map<String,List<String>> |
getQuotaProjectId()
public String getQuotaProjectId()| Type | Description |
| String |
getSourceCredentials()
public GoogleCredentials getSourceCredentials()| Type | Description |
| GoogleCredentials |
hashCode()
public int hashCode()| Type | Description |
| int |
idTokenWithAudience(String targetAudience, List<IdTokenProvider.Option> options)
public IdToken idTokenWithAudience(String targetAudience, List<IdTokenProvider.Option> options)Returns an IdToken for the current Credential.
| Name | Description |
| targetAudience | Stringthe audience field for the issued ID token |
| options | List<Option>credential specific options for for the token. For example, an ID token for an
ImpersonatedCredentials can return the email address within the token claims if
"ImpersonatedCredentials.INCLUDE_EMAIL" is provided as a list option. |
| Type | Description |
| IdToken | IdToken object which includes the raw id_token, expiration, and audience |
| Type | Description |
| IOException | if the attempt to get an ID token failed |
refreshAccessToken()
public AccessToken refreshAccessToken()Method to refresh the access token according to the specific type of credentials.
Throws IllegalStateException if not overridden since direct use of OAuth2Credentials is only for temporary or non-refreshing access tokens.
| Type | Description |
| AccessToken |
| Type | Description |
| IOException |
setTransportFactory(HttpTransportFactory httpTransportFactory)
public void setTransportFactory(HttpTransportFactory httpTransportFactory)| Name | Description |
| httpTransportFactory | HttpTransportFactory |
sign(byte[] toSign)
public byte[] sign(byte[] toSign)Signs the provided bytes using the private key associated with the impersonated service account See Also: Blob Signing
| Name | Description |
| toSign | byte[]bytes to sign |
| Type | Description |
| byte[] | signed bytes |
toBuilder()
public ImpersonatedCredentials.Builder toBuilder()| Type | Description |
| ImpersonatedCredentials.Builder |
toString()
public String toString()| Type | Description |
| String |