This package implements oauth2.TokenSource and signer which respects ADC with impersonation.
- Automatically uses
CLOUDSDK_AUTH_IMPERSONATE_SERVICE_ACCOUNT environment variable as an impersonation target and a delegation chain.
- It respects same variable and syntax of gcloud.
- Can override the impersonation target, the delegate chain and the source credential through functional options.
This package is EXPERIMENTAL.
- No responsibility.
- May be broken.
- Will do breaking changes.
| credential/impersonate |
yes |
no |
| authorized_user |
Credentials API |
Not Supported |
| service_account |
Credentials API |
Sign by JSON key |
| external_account |
Credentials API |
Credentials API as itself |
| compute_metadata |
Credentials API |
Credentials API as itself |
App Engine 1st gen(only if WithExperimentalAppEngineSigner(true)) |
Credentials API |
appengine.SignBytes() |
| credential/impersonate |
yes |
no |
| authorized_user |
Credentials API |
ADC(refresh token flow) |
| service_account |
Credentials API |
ADC(jwt-bearer token flow) |
| external_account |
Credentials API |
ADC(STS) |
| compute_metadata |
Credentials API |
ADC(token endpoint) |
| credential/impersonate |
yes |
no |
| authorized_user |
Credentials API |
Not Supported |
| service_account |
Credentials API |
ADC(jwt-bearer flow) |
| external_account |
Credentials API |
Not Supported(TODO: retrieve using STS) |
| compute_metadata |
Credentials API |
ADC(identity endpoint) |
- Support Self-signed JWT(AIP-4111) for service_account in SmartAccessTokenSource.
- Support to override underlying TokenSource.
- Support external_account in
tokensource.SmartIDTokenSource.
- Re-implement underlying TokenSource to avoid ReuseTokenSource in default.
- Add tests.
- Replace signJwtHelper with a reliable implementation.