signer

README

signer

This package is EXPERIMENTAL.

Underlying signing method

credential/impersonate	yes	no
service_account	Credentials API	Sign by JSON key
authorized_user	Credentials API	Not Supported
external_account	Credentials API	Credentials API as itself
compute_metadata	Credentials API	Credentials API as itself
App Engine 1st gen(only if WithExperimentalAppEngineSigner(true))	Credentials API	appengine.SignBytes()

• "Credentials API" is Service Account Credentials API (projects.serviceAccounts.signBlob, projects.serviceAccounts.signJwt)
  • Need Service Account Token Creator role(roles/iam.serviceAccountTokenCreator)

Documentation

Index

• func SignWithoutKeyAdaptor(ctx context.Context, signer Signer) func([]byte) ([]byte, error)
• type Option
  • func WithDelegates(delegates ...string) Option
  • func WithExperimentalAppEngineSigner(enable bool) Option
  • func WithTargetPrincipal(targetPrincipal string) Option
• type Signer
  • func AppEngineSigner() (Signer, error)
  • func IamCredentialsSigner(targetPrincipal string, delegates []string, ts oauth2.TokenSource) (Signer, error)
  • func ServiceAccountSigner(jsonKey []byte) (Signer, error)
  • func SmartSigner(ctx context.Context, options ...Option) (Signer, error)

Functions

func SignWithoutKeyAdaptor

func SignWithoutKeyAdaptor(ctx context.Context, signer Signer) func([]byte) ([]byte, error)

Types

type Option

type Option func(*smartSignerConfig) error

func WithDelegates

func WithDelegates(delegates ...string) Option

func WithExperimentalAppEngineSigner

func WithExperimentalAppEngineSigner(enable bool) Option

func WithTargetPrincipal

func WithTargetPrincipal(targetPrincipal string) Option

type Signer

type Signer interface {
	ServiceAccount(context.Context) string
	SignBlob(context.Context, []byte) (string, []byte, error)
	SignJwt(context.Context, string) (string, error)
}

func AppEngineSigner

func AppEngineSigner() (Signer, error)

func IamCredentialsSigner

func IamCredentialsSigner(targetPrincipal string, delegates []string, ts oauth2.TokenSource) (Signer, error)

IamCredentialsSigner makes new Signer. targetPrincipal and delegates is passed to iamcredentials.SignBlob. if ts is nil, ADC will be used.

func ServiceAccountSigner

func ServiceAccountSigner(jsonKey []byte) (Signer, error)

ServiceAccountSigner returns Signer which can sign without any network access.

func SmartSigner

func SmartSigner(ctx context.Context, options ...Option) (Signer, error)

SmartSigner create signer for ADC with optional impersonation. Impersonation setting is supplied from below in descending order of priority.

1. options e.g. signer.WithTargetPrincipal, signer.WithDelegates
2. `CLOUDSDK_AUTH_IMPERSONATE_SERVICE_ACCOUNT` environment variable

If impersonation is not applied, all credentials except App Engine 1st gen(only Go 1.11) and Service Account Key need a Token Creator role to themselves.

• https://cloud.google.com/iam/docs/creating-short-lived-service-account-credentials?hl=en
• https://cloud.google.com/iam/docs/impersonating-service-accounts?hl=en