Class ServiceAccountJwtAccessCredentials (1.7.0)

public class ServiceAccountJwtAccessCredentials extends Credentials implements JwtProvider, ServiceAccountSigner, QuotaProjectIdProvider

Service Account credentials for calling Google APIs using a JWT directly for access.

Uses a JSON Web Token (JWT) directly in the request metadata to provide authorization.

Inheritance

Object > Credentials > ServiceAccountJwtAccessCredentials

Static Methods

fromPkcs8(String clientId, String clientEmail, String privateKeyPkcs8, String privateKeyId)

public static ServiceAccountJwtAccessCredentials fromPkcs8(String clientId, String clientEmail, String privateKeyPkcs8, String privateKeyId)

Factory using PKCS#8 for the private key.

Parameters
NameDescription
clientIdString

Client ID of the service account from the console. May be null.

clientEmailString

Client email address of the service account from the console.

privateKeyPkcs8String

RSA private key object for the service account in PKCS#8 format.

privateKeyIdString

Private key identifier for the service account. May be null.

Returns
TypeDescription
ServiceAccountJwtAccessCredentials

New ServiceAccountJwtAcceessCredentials created from a private key.

Exceptions
TypeDescription
IOException

if the credential cannot be created from the private key.

fromPkcs8(String clientId, String clientEmail, String privateKeyPkcs8, String privateKeyId, URI defaultAudience)

public static ServiceAccountJwtAccessCredentials fromPkcs8(String clientId, String clientEmail, String privateKeyPkcs8, String privateKeyId, URI defaultAudience)

Factory using PKCS#8 for the private key.

Parameters
NameDescription
clientIdString

Client ID of the service account from the console. May be null.

clientEmailString

Client email address of the service account from the console.

privateKeyPkcs8String

RSA private key object for the service account in PKCS#8 format.

privateKeyIdString

Private key identifier for the service account. May be null.

defaultAudienceURI

Audience to use if not provided by transport. May be null.

Returns
TypeDescription
ServiceAccountJwtAccessCredentials

New ServiceAccountJwtAcceessCredentials created from a private key.

Exceptions
TypeDescription
IOException

if the credential cannot be created from the private key.

fromStream(InputStream credentialsStream)

public static ServiceAccountJwtAccessCredentials fromStream(InputStream credentialsStream)

Returns credentials defined by a Service Account key file in JSON format from the Google Developers Console.

Parameter
NameDescription
credentialsStreamInputStream

the stream with the credential definition.

Returns
TypeDescription
ServiceAccountJwtAccessCredentials

the credential defined by the credentialsStream.

Exceptions
TypeDescription
IOException

if the credential cannot be created from the stream.

fromStream(InputStream credentialsStream, URI defaultAudience)

public static ServiceAccountJwtAccessCredentials fromStream(InputStream credentialsStream, URI defaultAudience)

Returns credentials defined by a Service Account key file in JSON format from the Google Developers Console.

Parameters
NameDescription
credentialsStreamInputStream

the stream with the credential definition.

defaultAudienceURI

Audience to use if not provided by transport. May be null.

Returns
TypeDescription
ServiceAccountJwtAccessCredentials

the credential defined by the credentialsStream.

Exceptions
TypeDescription
IOException

if the credential cannot be created from the stream.

newBuilder()

public static ServiceAccountJwtAccessCredentials.Builder newBuilder()
Returns
TypeDescription
ServiceAccountJwtAccessCredentials.Builder

Methods

equals(Object obj)

public boolean equals(Object obj)
Parameter
NameDescription
objObject
Returns
TypeDescription
boolean
Overrides

getAccount()

public String getAccount()

Returns the service account associated with the signer.

Returns
TypeDescription
String

getAuthenticationType()

public String getAuthenticationType()

A constant string name describing the authentication technology.

E.g. \u201cOAuth2\u201d, \u201cSSL\u201d. For use by the transport layer to determine whether it supports the type of authentication in the case where Credentials#hasRequestMetadataOnly is false. Also serves as a debugging helper.

Returns
TypeDescription
String
Overrides

getClientEmail()

public final String getClientEmail()
Returns
TypeDescription
String

getClientId()

public final String getClientId()
Returns
TypeDescription
String

getPrivateKey()

public final PrivateKey getPrivateKey()
Returns
TypeDescription
PrivateKey

getPrivateKeyId()

public final String getPrivateKeyId()
Returns
TypeDescription
String

getQuotaProjectId()

public String getQuotaProjectId()
Returns
TypeDescription
String

getRequestMetadata(URI uri)

public Map<String,List<String>> getRequestMetadata(URI uri)

Provide the request metadata by putting an access JWT directly in the metadata.

Parameter
NameDescription
uriURI
Returns
TypeDescription
Map<String,List<String>>
Overrides
Exceptions
TypeDescription
IOException

getRequestMetadata(URI uri, Executor executor, RequestMetadataCallback callback)

public void getRequestMetadata(URI uri, Executor executor, RequestMetadataCallback callback)

Get the current request metadata without blocking.

This should be called by the transport layer on each request, and the data should be populated in headers or other context. The implementation can either call the callback inline or asynchronously. Either way it should never block in this method. The executor is provided for tasks that may block.

The default implementation will just call #getRequestMetadata(URI) then the callback from the given executor.

The convention for handling binary data is for the key in the returned map to end with "-bin" and for the corresponding values to be base64 encoded.

Parameters
NameDescription
uriURI
executorExecutor
callbackRequestMetadataCallback
Overrides

hasRequestMetadata()

public boolean hasRequestMetadata()

Whether the credentials have metadata entries that should be added to each request.

This should be called by the transport layer to see if Credentials#getRequestMetadata should be used for each request.

Returns
TypeDescription
boolean
Overrides

hasRequestMetadataOnly()

public boolean hasRequestMetadataOnly()

Indicates whether or not the Auth mechanism works purely by including request metadata.

This is meant for the transport layer. If this is true a transport does not need to take actions other than including the request metadata. If this is false, a transport must specifically know about the authentication technology to support it, and should fail to accept the credentials otherwise.

Returns
TypeDescription
boolean
Overrides

hashCode()

public int hashCode()
Returns
TypeDescription
int
Overrides

jwtWithClaims(JwtClaims newClaims)

public JwtCredentials jwtWithClaims(JwtClaims newClaims)

Returns a new JwtCredentials instance with modified claims.

Parameter
NameDescription
newClaimsJwtClaims

new claims. Any unspecified claim fields will default to the the current values.

Returns
TypeDescription
JwtCredentials

new credentials

refresh()

public void refresh()

Discard any cached data

Overrides

sign(byte[] toSign)

public byte[] sign(byte[] toSign)

Signs the provided bytes using the private key associated with the service account.

Parameter
NameDescription
toSignbyte[]
Returns
TypeDescription
byte[]

toBuilder()

public ServiceAccountJwtAccessCredentials.Builder toBuilder()
Returns
TypeDescription
ServiceAccountJwtAccessCredentials.Builder

toString()

public String toString()
Returns
TypeDescription
String
Overrides