Add GCE Signer

[dhermes]

See: https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts/signBlob

Relevant history:
googleapis/google-cloud-python#922

[sparhomenko]

@elibixby In the last update here you mentioned that the implementation is on hold as the GCE/GKE metadata server team plans to add blob signing support. Do you know if they had any progress, or if there is a public ticket for this effort that we can subscribe to?

[theacodes]

Slight update: the ability for the GCE metadata server to sign bytes is planned, but no word on timeline right now.

[elibixby]

@sparhomenko Sorry about the delay. There was some confusion on the eng team about the use case, but that has now been resolved.

[theacodes]

#108 adds IAM-backed signing which is a temporary workaround until GCE can sign directly.

[ThatsAMorais]

It appears that IAM-Signer is exactly what I need to sign from a GKE pod; I have token credentials, but don't have access to the private key, and I would like to use the environment's default credentials to accomplish the following.... but it feels like a hack to reach into the SDK like this.

    gcp_client = client.Client()
    credentials = gcp_client._credentials
    credentials.refresh(
        # What request object, and how do I init it with the Session??
    )
    signer = iam.Signer(requests.Request, credentials, credentials.service_account_email)
    string_to_sign = ('{0}\n{1}\n{2}\n{3}\n{4}'.format(
        method, md5, content_type,
        expiration, canonicalized_resource))
    signature = signer.sign(string_to_sign)

I originally tried to use something like this, but the _credentials are a mere token when deployed to GKE. Otherwise, this worked when I specified the GOOGLE_APPLICATION_CREDENTIALS in my local environment as a path to a service account key.

query_params = get_signed_query_params(
        client.Client()._credentials, expiration,
        string_to_sign=string_to_sign)

Am I missing some way to just call google.cloud.storage.sign_this(string_to_sign) (a purely hypothetical method) that just works automatically with the credentials supplied in the environment?

[theacodes]

but it feels like a hack to reach into the SDK like this

It is a bit and it's somewhat intentional. We want you to opt into this because it's non-trivial how it works.

Am I missing some way to just call google.cloud.storage.sign_this(string_to_sign) (a purely hypothetical method) that just works automatically with the credentials supplied in the environment?

This might actually be useful (google.auth.sign) perhaps file a new issue and we'll prioritize it?

[ygbr]

any updates on this? is it possible to sign download URLs using another method or do we still need to use the workaround mentioned above?

[theacodes]

Still need to use the workaround.

…

On Mon, May 21, 2018 at 11:18 AM Ygor Lemos ***@***.***> wrote: any updates on this? is it possible to sign download URLs using another method or do we still need to use the workaround mentioned above? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#50 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAPUc6sdgZEDJusbyj3kSnLucOlk0STMks5t0wT4gaJpZM4KfWsd> .