Skip to content

Commit 694d83f

Browse files
authored
fix: migrate signBlob to iamcredentials.googleapis.com (#600)
Migrate signBlob from iam.googleapis.com to iamcredentials.googleapis.com. This API is deprecated and will be shutdown in one year. This is used google.auth.iam.Signer. Added a system_test to sanity check the implementation.
1 parent 892dc37 commit 694d83f

File tree

5 files changed

+30
-10
lines changed

5 files changed

+30
-10
lines changed

.gitignore

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,3 +41,6 @@ pylintrc.test
4141
pytype_output/
4242

4343
.python-version
44+
.DS_Store
45+
cert_path
46+
key_path

google/auth/iam.py

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828
from google.auth import crypt
2929
from google.auth import exceptions
3030

31-
_IAM_API_ROOT_URI = "https://iam.googleapis.com/v1"
31+
_IAM_API_ROOT_URI = "https://iamcredentials.googleapis.com/v1"
3232
_SIGN_BLOB_URI = _IAM_API_ROOT_URI + "/projects/-/serviceAccounts/{}:signBlob?alt=json"
3333

3434

@@ -71,7 +71,7 @@ def _make_signing_request(self, message):
7171
url = _SIGN_BLOB_URI.format(self._service_account_email)
7272
headers = {"Content-Type": "application/json"}
7373
body = json.dumps(
74-
{"bytesToSign": base64.b64encode(message).decode("utf-8")}
74+
{"payload": base64.b64encode(message).decode("utf-8")}
7575
).encode("utf-8")
7676

7777
self._credentials.before_request(self._request, method, url, headers)
@@ -97,4 +97,4 @@ def key_id(self):
9797
@_helpers.copy_docstring(crypt.Signer)
9898
def sign(self, message):
9999
response = self._make_signing_request(message)
100-
return base64.b64decode(response["signature"])
100+
return base64.b64decode(response["signedBlob"])

system_tests/test_service_account.py

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616

1717
from google.auth import _helpers
1818
from google.auth import exceptions
19+
from google.auth import iam
1920
from google.oauth2 import service_account
2021

2122

@@ -46,3 +47,19 @@ def test_refresh_success(http_request, credentials, token_info):
4647
"https://www.googleapis.com/auth/userinfo.profile",
4748
]
4849
)
50+
51+
def test_iam_signer(http_request, credentials):
52+
credentials = credentials.with_scopes(
53+
["https://www.googleapis.com/auth/iam"]
54+
)
55+
56+
# Verify iamcredentials signer.
57+
signer = iam.Signer(
58+
http_request,
59+
credentials,
60+
credentials.service_account_email
61+
)
62+
63+
signed_blob = signer.sign("message")
64+
65+
assert isinstance(signed_blob, bytes)

tests/compute_engine/test_credentials.py

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -363,11 +363,11 @@ def test_with_target_audience_integration(self):
363363
signature = base64.b64encode(b"some-signature").decode("utf-8")
364364
responses.add(
365365
responses.POST,
366-
"https://iam.googleapis.com/v1/projects/-/serviceAccounts/"
367-
"service-account@example.com:signBlob?alt=json",
366+
"https://iamcredentials.googleapis.com/v1/projects/-/"
367+
"serviceAccounts/service-account@example.com:signBlob?alt=json",
368368
status=200,
369369
content_type="application/json",
370-
json={"keyId": "some-key-id", "signature": signature},
370+
json={"keyId": "some-key-id", "signedBlob": signature},
371371
)
372372

373373
id_token = "{}.{}.{}".format(
@@ -477,11 +477,11 @@ def test_with_quota_project_integration(self):
477477
signature = base64.b64encode(b"some-signature").decode("utf-8")
478478
responses.add(
479479
responses.POST,
480-
"https://iam.googleapis.com/v1/projects/-/serviceAccounts/"
481-
"service-account@example.com:signBlob?alt=json",
480+
"https://iamcredentials.googleapis.com/v1/projects/-/"
481+
"serviceAccounts/service-account@example.com:signBlob?alt=json",
482482
status=200,
483483
content_type="application/json",
484-
json={"keyId": "some-key-id", "signature": signature},
484+
json={"keyId": "some-key-id", "signedBlob": signature},
485485
)
486486

487487
id_token = "{}.{}.{}".format(

tests/test_iam.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ def test_key_id(self):
8181
def test_sign_bytes(self):
8282
signature = b"DEADBEEF"
8383
encoded_signature = base64.b64encode(signature).decode("utf-8")
84-
request = make_request(http_client.OK, data={"signature": encoded_signature})
84+
request = make_request(http_client.OK, data={"signedBlob": encoded_signature})
8585
credentials = make_credentials()
8686

8787
signer = iam.Signer(request, credentials, mock.sentinel.service_account_email)

0 commit comments

Comments
 (0)