Question

我正在尝试使用Google Cloud SDK以编程方式在Java中创建服务帐户密钥，以用于未在App / Compute引擎上运行的应用程序。 This question与我的相似，但是它在App引擎上运行，因此我不能使用与使用App Engine API中的类相同的代码。

相关代码如下。我的问题是AppIdentityCredential是AppEngine API的一部分，因此不能在这里使用。我可以作为参数传递什么？新的Builder（）方法中的第三个参数接受HttpRequestInitializer，但我不明白我应该传递哪个接口的实现。感谢任何帮助。

import com.google.api.services.iam.v1.Iam;
import com.google.api.services.iam.v1.model.CreateServiceAccountKeyRequest;
import com.google.api.services.iam.v1.model.ServiceAccountKey;

AppIdentityCredential credential = new AppIdentityCredential(
            Arrays.asList("https://www.googleapis.com/auth/cloud-platform"));
Iam iam = new Iam.Builder(httpTransport, JSON_FACTORY,credential)
         .setApplicationName(APPLICATION_NAME).build();
ServiceAccountKey key = iam.projects().serviceAccounts().keys()
     .create(SERVICE_ACCOUNT_RESOURCE_NAME, new CreateServiceAccountKeyRequest()).execute();

Answer 1

您可以使用Application Default Credentials，这将允许您使用相同的代码根据运行应用程序的环境获取凭据。

例如，它允许您在系统上进行开发时使用gcloud account credentials。当代码在Google Compute Engine或Google App Engine上运行时，代码将自动使用关联的服务帐户凭据在API中进行身份验证。如果需要从JSON文件加载凭据，您也可以使用GOOGLE_APPLICATION_CREDENTIALS环境变量覆盖它。

这是一个工作示例，它为现有服务帐户创建一个新密钥并将其打印出来。

import com.google.api.client.googleapis.auth.oauth2.GoogleCredential;
import com.google.api.client.googleapis.javanet.GoogleNetHttpTransport;
import com.google.api.client.http.HttpTransport;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.jackson2.JacksonFactory;
import com.google.api.services.iam.v1.Iam;
import com.google.api.services.iam.v1.IamScopes;
import com.google.api.services.iam.v1.model.CreateServiceAccountKeyRequest;
import com.google.api.services.iam.v1.model.ServiceAccountKey;
import java.io.IOException;
import java.security.GeneralSecurityException;
import java.util.ArrayList;
import java.util.List;

public class IamDemo {
  /** Name of the application. */
  private static final String APPLICATION_NAME = "IamDemoJava";

  /** Project Name. */
  private static final String PROJECT_NAME = "MY_PROJECT_NAME";

  /** Name of the service account to create a new key for. */
  private static final String SERVICE_ACCOUNT_NAME = "dummy-sa";

  /** Full email address of the service account. */
  private static final String SERVICE_ACCOUNT_EMAIL =
      SERVICE_ACCOUNT_NAME + "@" + PROJECT_NAME + ".iam.gserviceaccount.com";

  /** Full service account resource string expected by the IAM API. */
  private static final String SERVICE_ACCOUNT_RESOURCE_NAME =
      "projects/" + PROJECT_NAME + "/serviceAccounts/" + SERVICE_ACCOUNT_EMAIL;

  /** Global instance of the HTTP transport. */
  private static HttpTransport httpTransport;

  /** Global instance of the JSON factory. */
  private static final JsonFactory JSON_FACTORY = JacksonFactory.getDefaultInstance();

  public static void main() throws IOException, GeneralSecurityException {
    Iam iam = initIam();
    ServiceAccountKey key = createServiceAccountKey(iam);

    // Print the key
    System.out.println(key.toString());
  }

  private static Iam initIam() throws IOException, GeneralSecurityException {
    httpTransport = GoogleNetHttpTransport.newTrustedTransport();

    // Authenticate using Google Application Default Credentials.
    GoogleCredential credential = GoogleCredential.getApplicationDefault();


    if (credential.createScopedRequired()) {
      List<String> scopes = new ArrayList<>();
      // Enable full Cloud Platform scope.
      scopes.add(IamScopes.CLOUD_PLATFORM);
      credential = credential.createScoped(scopes);
    }

    // Create IAM API object associated with the authenticated transport.
    return new Iam.Builder(httpTransport, JSON_FACTORY, credential)
        .setApplicationName(APPLICATION_NAME)
        .build();
  }

  private static ServiceAccountKey createServiceAccountKey(Iam iam)
      throws IOException, GeneralSecurityException {
    CreateServiceAccountKeyRequest request = new CreateServiceAccountKeyRequest();

    // Customize the request parameters if needed

    return iam.projects()
        .serviceAccounts()
        .keys()
        .create(SERVICE_ACCOUNT_RESOURCE_NAME, request)
        .execute();
  }
}

如何在不下载Google Cloud Java SDK（不在App Engine上）的情况下对服务帐户进行身份验证

1 个答案: