如何在不下载 Google Cloud Java SDK（不在 App Engine 上）的情况下验证服务帐户

Question

我正在尝试使用 Google Cloud SDK 在 Java 中以编程方式为 App/Compute 引擎上的非运行应用程序创建服务帐户密钥。与我的相似，但它在 App Engine 上是运行，因此我不能使用与 App Engine API 中的类相同的代码。

相关代码如下。我的问题是 AppIdentityCredential 是 AppEngine API 的一部分，因此不能在这里使用。我可以将什么作为参数传入？ new Builder() 方法中的第三个参数接受一个 HttpRequestInitializer，但我不明白我应该传入这个接口的什么实现。感谢任何帮助。

import com.google.api.services.iam.v1.Iam;
import com.google.api.services.iam.v1.model.CreateServiceAccountKeyRequest;
import com.google.api.services.iam.v1.model.ServiceAccountKey;

AppIdentityCredential credential = new AppIdentityCredential(
            Arrays.asList("https://www.googleapis.com/auth/cloud-platform"));
Iam iam = new Iam.Builder(httpTransport, JSON_FACTORY,credential)
         .setApplicationName(APPLICATION_NAME).build();
ServiceAccountKey key = iam.projects().serviceAccounts().keys()
     .create(SERVICE_ACCOUNT_RESOURCE_NAME, new CreateServiceAccountKeyRequest()).execute();

Answer 1

您可以使用 Application Default Credentials，这将允许您使用相同的代码根据应用程序所在的环境获取凭据运行。

例如，它允许您在系统上进行开发时使用 gcloud account credentials。当代码在 Google Compute Engine 或 Google App Engine 上运行时，代码将自动使用关联的服务帐户凭据在 API 中进行身份验证。如果需要从 JSON 文件加载凭据，您也可以使用 GOOGLE_APPLICATION_CREDENTIALS 环境变量覆盖它。

这是一个工作示例，它为现有服务帐户创建一个新密钥并打印它。

import com.google.api.client.googleapis.auth.oauth2.GoogleCredential;
import com.google.api.client.googleapis.javanet.GoogleNetHttpTransport;
import com.google.api.client.http.HttpTransport;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.jackson2.JacksonFactory;
import com.google.api.services.iam.v1.Iam;
import com.google.api.services.iam.v1.IamScopes;
import com.google.api.services.iam.v1.model.CreateServiceAccountKeyRequest;
import com.google.api.services.iam.v1.model.ServiceAccountKey;
import java.io.IOException;
import java.security.GeneralSecurityException;
import java.util.ArrayList;
import java.util.List;

public class IamDemo {
  /** Name of the application. */
  private static final String APPLICATION_NAME = "IamDemoJava";

  /** Project Name. */
  private static final String PROJECT_NAME = "MY_PROJECT_NAME";

  /** Name of the service account to create a new key for. */
  private static final String SERVICE_ACCOUNT_NAME = "dummy-sa";

  /** Full email address of the service account. */
  private static final String SERVICE_ACCOUNT_EMAIL =
      SERVICE_ACCOUNT_NAME + "@" + PROJECT_NAME + ".iam.gserviceaccount.com";

  /** Full service account resource string expected by the IAM API. */
  private static final String SERVICE_ACCOUNT_RESOURCE_NAME =
      "projects/" + PROJECT_NAME + "/serviceAccounts/" + SERVICE_ACCOUNT_EMAIL;

  /** Global instance of the HTTP transport. */
  private static HttpTransport httpTransport;

  /** Global instance of the JSON factory. */
  private static final JsonFactory JSON_FACTORY = JacksonFactory.getDefaultInstance();

  public static void main() throws IOException, GeneralSecurityException {
    Iam iam = initIam();
    ServiceAccountKey key = createServiceAccountKey(iam);

    // Print the key
    System.out.println(key.toString());
  }

  private static Iam initIam() throws IOException, GeneralSecurityException {
    httpTransport = GoogleNetHttpTransport.newTrustedTransport();

    // Authenticate using Google Application Default Credentials.
    GoogleCredential credential = GoogleCredential.getApplicationDefault();


    if (credential.createScopedRequired()) {
      List<String> scopes = new ArrayList<>();
      // Enable full Cloud Platform scope.
      scopes.add(IamScopes.CLOUD_PLATFORM);
      credential = credential.createScoped(scopes);
    }

    // Create IAM API object associated with the authenticated transport.
    return new Iam.Builder(httpTransport, JSON_FACTORY, credential)
        .setApplicationName(APPLICATION_NAME)
        .build();
  }

  private static ServiceAccountKey createServiceAccountKey(Iam iam)
      throws IOException, GeneralSecurityException {
    CreateServiceAccountKeyRequest request = new CreateServiceAccountKeyRequest();

    // Customize the request parameters if needed

    return iam.projects()
        .serviceAccounts()
        .keys()
        .create(SERVICE_ACCOUNT_RESOURCE_NAME, request)
        .execute();
  }
}

如何在不下载 Google Cloud Java SDK（不在 App Engine 上）的情况下验证服务帐户

How to authenticate a service account without download for the Google Cloud Java SDK (not on App Engine)

java

google-app-engine

google-oauth-java-client

google-cloud-platform

google-iam