Adding 3-legged auth for users getting started.

[dhermes]

Addresses final part of #335.

@tseaver Writing Test_get_credentials_from_user_flow.test_succeeds made me feel icky inside. Any suggestions on how to make this less massive?

@silvolu PTAL at the docstrings introduced and the print statements. Should we put this somewhere special in our documentation? We don't have an auth or a getting started section anywhere but I encourage you to clone my repo, check out the add-3LO branch and run

from gcloud import credentials
from gcloud.datastore import SCOPE
credentials = credentials.get_credentials_from_user_flow(SCOPE)

First without a client secrets file present (to test failure modes) and then with one (to test the messages printed, inputs requested).

@craigcitro Also PTAL / see what we could pull into oauth2client.

[coveralls]

Coverage remained the same when pulling ca14078 on dhermes:add-3LO into dcb73d3 on GoogleCloudPlatform:master.

[craigcitro]

substituting @anthmgoogle in my place, who has more feelings about 3LO

[silvolu]

@dhermes There is a getting started section on the landing page, that is currently explaining how to install the package, maybe we can add it there. Alternatively, we could add it to the " in 10 seconds" expandables of each top-level module (e.g. Cloud Datastore)

[coveralls]

Coverage remained the same when pulling d50cc57 on dhermes:add-3LO into 8a42ef5 on GoogleCloudPlatform:master.

[dhermes]

Now that I think about it, the process described in the docstring for get_credentials_from_user_flow() is not any simpler than the process required to set up the files / env vars needed for get_credentials() or get_for_service_account_p12().

@silvolu Do we really need / want user 3LO? I can see cases where someone would want to write a CLI application and have users go through a flow, but we support plugging in arbitrary credentials to our Connection classes so this doesn't preclude them. Instead it puts the onus on those users to define their own flow.

[anthmgoogle]

I provided some comments on the implementation.

I think a GCloud-specific wrapper for 3LO is relatively low priority, since
there is no user-owned data at stake, so you would typically just use it as
a way to reusing the user's permissions.

One thing that may not be widely known yet is that you can actually now use
the GCloud SDK for this. As of a release in late 2014, the Cloud SDK's
"gcloud auth login" command will also set up the Application Default
Credentials in the well-known-file location and it includes all Cloud API
scopes. This means you can use 3LO with your own credentials as a proxy at
development time, but you don't need to have an any actual 3LO related UI
in you application. We'd love to get feedback about whether this works for
scenarios like this.

That being said, I do belive there is a need for better 3L0 libraries,
primarily for APIs like that DO represent end user data (e.g. Calendar,
GMail). Ultimately I think we should provide a better wrapped
implementation of 3LO in oauth2client, such that writing code such as that
in this change list bcomes 95% UI logic only a few library calls instead of
needed this embedded auth and serialization logic.

On Wed, Jan 14, 2015 at 1:04 PM, Danny Hermes notifications@github.com
wrote:

Now that I think about it, the process described in the docstring for
get_credentials_from_user_flow() is not any simpler than the process
required to set up the files / env vars needed for get_credentials() or
get_for_service_account_p12().

@silvolu https://github.com/silvolu Do we really need / want user 3LO?
I can see cases where someone would want to write a CLI application and
have users go through a flow, but we support plugging in arbitrary
credentials to our Connection classes so this doesn't preclude them.
Instead it puts the onus on those users to define their own flow.

—
Reply to this email directly or view it on GitHub
#539 (comment)
.

[silvolu]

@dhermes all I wanted was support for application default credentials :)
@jgeewax you wanted this to make getting started with the demo easier, do you still think that's the case?

[dhermes]

@anthmgoogle that hits it exactly on the head! I somehow forgot that GoogleCredentials.get_default_credentials (which we already use) could use the well-known file.

I am going to close this and we can discuss the best way to document it in #335.