Wala shell

Advanced PHP File Manager

Server IP: 127.0.0.1 | PHP Version: 8.3.30 | Domains Hosted: 54

Name	Size	Last Modified	Actions
📁 ..	-	2025-05-25 12:27
📄 aws.go // Copyright 2021 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package externalaccount import ( "bytes" "context" "crypto/hmac" "crypto/sha256" "encoding/hex" "encoding/json" "errors" "fmt" "io" "io/ioutil" "net/http" "net/url" "os" "path" "sort" "strings" "time" "golang.org/x/oauth2" ) // AwsSecurityCredentials models AWS security credentials. type AwsSecurityCredentials struct { // AccessKeyId is the AWS Access Key ID - Required. AccessKeyID string `json:"AccessKeyID"` // SecretAccessKey is the AWS Secret Access Key - Required. SecretAccessKey string `json:"SecretAccessKey"` // SessionToken is the AWS Session token. This should be provided for temporary AWS security credentials - Optional. SessionToken string `json:"Token"` } // awsRequestSigner is a utility class to sign http requests using a AWS V4 signature. type awsRequestSigner struct { RegionName string AwsSecurityCredentials AwsSecurityCredentials } // getenv aliases os.Getenv for testing var getenv = os.Getenv const ( defaultRegionalCredentialVerificationUrl = "https://sts.{region}.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15" // AWS Signature Version 4 signing algorithm identifier. awsAlgorithm = "AWS4-HMAC-SHA256" // The termination string for the AWS credential scope value as defined in // https://docs.aws.amazon.com/general/latest/gr/sigv4-create-string-to-sign.html awsRequestType = "aws4_request" // The AWS authorization header name for the security session token if available. awsSecurityTokenHeader = "x-amz-security-token" // The name of the header containing the session token for metadata endpoint calls awsIMDSv2SessionTokenHeader = "X-aws-ec2-metadata-token" awsIMDSv2SessionTtlHeader = "X-aws-ec2-metadata-token-ttl-seconds" awsIMDSv2SessionTtl = "300" // The AWS authorization header name for the auto-generated date. awsDateHeader = "x-amz-date" // Supported AWS configuration environment variables. awsAccessKeyId = "AWS_ACCESS_KEY_ID" awsDefaultRegion = "AWS_DEFAULT_REGION" awsRegion = "AWS_REGION" awsSecretAccessKey = "AWS_SECRET_ACCESS_KEY" awsSessionToken = "AWS_SESSION_TOKEN" awsTimeFormatLong = "20060102T150405Z" awsTimeFormatShort = "20060102" ) func getSha256(input []byte) (string, error) { hash := sha256.New() if _, err := hash.Write(input); err != nil { return "", err } return hex.EncodeToString(hash.Sum(nil)), nil } func getHmacSha256(key, input []byte) ([]byte, error) { hash := hmac.New(sha256.New, key) if _, err := hash.Write(input); err != nil { return nil, err } return hash.Sum(nil), nil } func cloneRequest(r http.Request) http.Request { r2 := new(http.Request) r2 = r if r.Header != nil { r2.Header = make(http.Header, len(r.Header)) // Find total number of values. headerCount := 0 for _, headerValues := range r.Header { headerCount += len(headerValues) } copiedHeaders := make([]string, headerCount) // shared backing array for headers' values for headerKey, headerValues := range r.Header { headerCount = copy(copiedHeaders, headerValues) r2.Header[headerKey] = copiedHeaders[:headerCount:headerCount] copiedHeaders = copiedHeaders[headerCount:] } } return r2 } func canonicalPath(req http.Request) string { result := req.URL.EscapedPath() if result == "" { return "/" } return path.Clean(result) } func canonicalQuery(req http.Request) string { queryValues := req.URL.Query() for queryKey := range queryValues { sort.Strings(queryValues[queryKey]) } return queryValues.Encode() } func canonicalHeaders(req http.Request) (string, string) { // Header keys need to be sorted alphabetically. var headers []string lowerCaseHeaders := make(http.Header) for k, v := range req.Header { k := strings.ToLower(k) if _, ok := lowerCaseHeaders[k]; ok { // include additional values lowerCaseHeaders[k] = append(lowerCaseHeaders[k], v...) } else { headers = append(headers, k) lowerCaseHeaders[k] = v } } sort.Strings(headers) var fullHeaders bytes.Buffer for _, header := range headers { headerValue := strings.Join(lowerCaseHeaders[header], ",") fullHeaders.WriteString(header) fullHeaders.WriteRune(':') fullHeaders.WriteString(headerValue) fullHeaders.WriteRune('\n') } return strings.Join(headers, ";"), fullHeaders.String() } func requestDataHash(req http.Request) (string, error) { var requestData []byte if req.Body != nil { requestBody, err := req.GetBody() if err != nil { return "", err } defer requestBody.Close() requestData, err = ioutil.ReadAll(io.LimitReader(requestBody, 1<<20)) if err != nil { return "", err } } return getSha256(requestData) } func requestHost(req http.Request) string { if req.Host != "" { return req.Host } return req.URL.Host } func canonicalRequest(req http.Request, canonicalHeaderColumns, canonicalHeaderData string) (string, error) { dataHash, err := requestDataHash(req) if err != nil { return "", err } return fmt.Sprintf("%s\n%s\n%s\n%s\n%s\n%s", req.Method, canonicalPath(req), canonicalQuery(req), canonicalHeaderData, canonicalHeaderColumns, dataHash), nil } // SignRequest adds the appropriate headers to an http.Request // or returns an error if something prevented this. func (rs awsRequestSigner) SignRequest(req http.Request) error { signedRequest := cloneRequest(req) timestamp := now() signedRequest.Header.Add("host", requestHost(req)) if rs.AwsSecurityCredentials.SessionToken != "" { signedRequest.Header.Add(awsSecurityTokenHeader, rs.AwsSecurityCredentials.SessionToken) } if signedRequest.Header.Get("date") == "" { signedRequest.Header.Add(awsDateHeader, timestamp.Format(awsTimeFormatLong)) } authorizationCode, err := rs.generateAuthentication(signedRequest, timestamp) if err != nil { return err } signedRequest.Header.Set("Authorization", authorizationCode) req.Header = signedRequest.Header return nil } func (rs awsRequestSigner) generateAuthentication(req http.Request, timestamp time.Time) (string, error) { canonicalHeaderColumns, canonicalHeaderData := canonicalHeaders(req) dateStamp := timestamp.Format(awsTimeFormatShort) serviceName := "" if splitHost := strings.Split(requestHost(req), "."); len(splitHost) > 0 { serviceName = splitHost[0] } credentialScope := fmt.Sprintf("%s/%s/%s/%s", dateStamp, rs.RegionName, serviceName, awsRequestType) requestString, err := canonicalRequest(req, canonicalHeaderColumns, canonicalHeaderData) if err != nil { return "", err } requestHash, err := getSha256([]byte(requestString)) if err != nil { return "", err } stringToSign := fmt.Sprintf("%s\n%s\n%s\n%s", awsAlgorithm, timestamp.Format(awsTimeFormatLong), credentialScope, requestHash) signingKey := []byte("AWS4" + rs.AwsSecurityCredentials.SecretAccessKey) for _, signingInput := range []string{ dateStamp, rs.RegionName, serviceName, awsRequestType, stringToSign, } { signingKey, err = getHmacSha256(signingKey, []byte(signingInput)) if err != nil { return "", err } } return fmt.Sprintf("%s Credential=%s/%s, SignedHeaders=%s, Signature=%s", awsAlgorithm, rs.AwsSecurityCredentials.AccessKeyID, credentialScope, canonicalHeaderColumns, hex.EncodeToString(signingKey)), nil } type awsCredentialSource struct { environmentID string regionURL string regionalCredVerificationURL string credVerificationURL string imdsv2SessionTokenURL string targetResource string requestSigner awsRequestSigner region string ctx context.Context client http.Client awsSecurityCredentialsSupplier AwsSecurityCredentialsSupplier supplierOptions SupplierOptions } type awsRequestHeader struct { Key string `json:"key"` Value string `json:"value"` } type awsRequest struct { URL string `json:"url"` Method string `json:"method"` Headers []awsRequestHeader `json:"headers"` } func (cs awsCredentialSource) doRequest(req http.Request) (http.Response, error) { if cs.client == nil { cs.client = oauth2.NewClient(cs.ctx, nil) } return cs.client.Do(req.WithContext(cs.ctx)) } func canRetrieveRegionFromEnvironment() bool { // The AWS region can be provided through AWS_REGION or AWS_DEFAULT_REGION. Only one is // required. return getenv(awsRegion) != "" \|\| getenv(awsDefaultRegion) != "" } func canRetrieveSecurityCredentialFromEnvironment() bool { // Check if both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are available. return getenv(awsAccessKeyId) != "" && getenv(awsSecretAccessKey) != "" } func (cs awsCredentialSource) shouldUseMetadataServer() bool { return cs.awsSecurityCredentialsSupplier == nil && (!canRetrieveRegionFromEnvironment() \|\| !canRetrieveSecurityCredentialFromEnvironment()) } func (cs awsCredentialSource) credentialSourceType() string { if cs.awsSecurityCredentialsSupplier != nil { return "programmatic" } return "aws" } func (cs awsCredentialSource) subjectToken() (string, error) { // Set Defaults if cs.regionalCredVerificationURL == "" { cs.regionalCredVerificationURL = defaultRegionalCredentialVerificationUrl } if cs.requestSigner == nil { headers := make(map[string]string) if cs.shouldUseMetadataServer() { awsSessionToken, err := cs.getAWSSessionToken() if err != nil { return "", err } if awsSessionToken != "" { headers[awsIMDSv2SessionTokenHeader] = awsSessionToken } } awsSecurityCredentials, err := cs.getSecurityCredentials(headers) if err != nil { return "", err } cs.region, err = cs.getRegion(headers) if err != nil { return "", err } cs.requestSigner = &awsRequestSigner{ RegionName: cs.region, AwsSecurityCredentials: awsSecurityCredentials, } } // Generate the signed request to AWS STS GetCallerIdentity API. // Use the required regional endpoint. Otherwise, the request will fail. req, err := http.NewRequest("POST", strings.Replace(cs.regionalCredVerificationURL, "{region}", cs.region, 1), nil) if err != nil { return "", err } // The full, canonical resource name of the workload identity pool // provider, with or without the HTTPS prefix. // Including this header as part of the signature is recommended to // ensure data integrity. if cs.targetResource != "" { req.Header.Add("x-goog-cloud-target-resource", cs.targetResource) } cs.requestSigner.SignRequest(req) / The GCP STS endpoint expects the headers to be formatted as: # [ # {key: 'x-amz-date', value: '...'}, # {key: 'Authorization', value: '...'}, # ... # ] # And then serialized as: # quote(json.dumps({ # url: '...', # method: 'POST', # headers: [{key: 'x-amz-date', value: '...'}, ...] # })) / awsSignedReq := awsRequest{ URL: req.URL.String(), Method: "POST", } for headerKey, headerList := range req.Header { for _, headerValue := range headerList { awsSignedReq.Headers = append(awsSignedReq.Headers, awsRequestHeader{ Key: headerKey, Value: headerValue, }) } } sort.Slice(awsSignedReq.Headers, func(i, j int) bool { headerCompare := strings.Compare(awsSignedReq.Headers[i].Key, awsSignedReq.Headers[j].Key) if headerCompare == 0 { return strings.Compare(awsSignedReq.Headers[i].Value, awsSignedReq.Headers[j].Value) < 0 } return headerCompare < 0 }) result, err := json.Marshal(awsSignedReq) if err != nil { return "", err } return url.QueryEscape(string(result)), nil } func (cs awsCredentialSource) getAWSSessionToken() (string, error) { if cs.imdsv2SessionTokenURL == "" { return "", nil } req, err := http.NewRequest("PUT", cs.imdsv2SessionTokenURL, nil) if err != nil { return "", err } req.Header.Add(awsIMDSv2SessionTtlHeader, awsIMDSv2SessionTtl) resp, err := cs.doRequest(req) if err != nil { return "", err } defer resp.Body.Close() respBody, err := ioutil.ReadAll(io.LimitReader(resp.Body, 1<<20)) if err != nil { return "", err } if resp.StatusCode != 200 { return "", fmt.Errorf("oauth2/google/externalaccount: unable to retrieve AWS session token - %s", string(respBody)) } return string(respBody), nil } func (cs awsCredentialSource) getRegion(headers map[string]string) (string, error) { if cs.awsSecurityCredentialsSupplier != nil { return cs.awsSecurityCredentialsSupplier.AwsRegion(cs.ctx, cs.supplierOptions) } if canRetrieveRegionFromEnvironment() { if envAwsRegion := getenv(awsRegion); envAwsRegion != "" { cs.region = envAwsRegion return envAwsRegion, nil } return getenv("AWS_DEFAULT_REGION"), nil } if cs.regionURL == "" { return "", errors.New("oauth2/google/externalaccount: unable to determine AWS region") } req, err := http.NewRequest("GET", cs.regionURL, nil) if err != nil { return "", err } for name, value := range headers { req.Header.Add(name, value) } resp, err := cs.doRequest(req) if err != nil { return "", err } defer resp.Body.Close() respBody, err := ioutil.ReadAll(io.LimitReader(resp.Body, 1<<20)) if err != nil { return "", err } if resp.StatusCode != 200 { return "", fmt.Errorf("oauth2/google/externalaccount: unable to retrieve AWS region - %s", string(respBody)) } // This endpoint will return the region in format: us-east-2b. // Only the us-east-2 part should be used. respBodyEnd := 0 if len(respBody) > 1 { respBodyEnd = len(respBody) - 1 } return string(respBody[:respBodyEnd]), nil } func (cs awsCredentialSource) getSecurityCredentials(headers map[string]string) (result AwsSecurityCredentials, err error) { if cs.awsSecurityCredentialsSupplier != nil { return cs.awsSecurityCredentialsSupplier.AwsSecurityCredentials(cs.ctx, cs.supplierOptions) } if canRetrieveSecurityCredentialFromEnvironment() { return &AwsSecurityCredentials{ AccessKeyID: getenv(awsAccessKeyId), SecretAccessKey: getenv(awsSecretAccessKey), SessionToken: getenv(awsSessionToken), }, nil } roleName, err := cs.getMetadataRoleName(headers) if err != nil { return } credentials, err := cs.getMetadataSecurityCredentials(roleName, headers) if err != nil { return } if credentials.AccessKeyID == "" { return result, errors.New("oauth2/google/externalaccount: missing AccessKeyId credential") } if credentials.SecretAccessKey == "" { return result, errors.New("oauth2/google/externalaccount: missing SecretAccessKey credential") } return &credentials, nil } func (cs awsCredentialSource) getMetadataSecurityCredentials(roleName string, headers map[string]string) (AwsSecurityCredentials, error) { var result AwsSecurityCredentials req, err := http.NewRequest("GET", fmt.Sprintf("%s/%s", cs.credVerificationURL, roleName), nil) if err != nil { return result, err } for name, value := range headers { req.Header.Add(name, value) } resp, err := cs.doRequest(req) if err != nil { return result, err } defer resp.Body.Close() respBody, err := ioutil.ReadAll(io.LimitReader(resp.Body, 1<<20)) if err != nil { return result, err } if resp.StatusCode != 200 { return result, fmt.Errorf("oauth2/google/externalaccount: unable to retrieve AWS security credentials - %s", string(respBody)) } err = json.Unmarshal(respBody, &result) return result, err } func (cs *awsCredentialSource) getMetadataRoleName(headers map[string]string) (string, error) { if cs.credVerificationURL == "" { return "", errors.New("oauth2/google/externalaccount: unable to determine the AWS metadata server security credentials endpoint") } req, err := http.NewRequest("GET", cs.credVerificationURL, nil) if err != nil { return "", err } for name, value := range headers { req.Header.Add(name, value) } resp, err := cs.doRequest(req) if err != nil { return "", err } defer resp.Body.Close() respBody, err := ioutil.ReadAll(io.LimitReader(resp.Body, 1<<20)) if err != nil { return "", err } if resp.StatusCode != 200 { return "", fmt.Errorf("oauth2/google/externalaccount: unable to retrieve AWS role name - %s", string(respBody)) } return string(respBody), nil }	15.99 KB	2025-05-25 12:27
📄 aws_test.go // Copyright 2021 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package externalaccount import ( "context" "encoding/json" "errors" "fmt" "net/http" "net/http/httptest" neturl "net/url" "reflect" "strings" "testing" "time" ) var defaultTime = time.Date(2011, 9, 9, 23, 36, 0, 0, time.UTC) var secondDefaultTime = time.Date(2020, 8, 11, 6, 55, 22, 0, time.UTC) type validateHeaders func(r http.Request) func setTime(testTime time.Time) func() time.Time { return func() time.Time { return testTime } } func setEnvironment(env map[string]string) func(string) string { return func(key string) string { return env[key] } } var defaultRequestSigner = &awsRequestSigner{ RegionName: "us-east-1", AwsSecurityCredentials: &AwsSecurityCredentials{ AccessKeyID: "AKIDEXAMPLE", SecretAccessKey: "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY", }, } const ( accessKeyID = "ASIARD4OQDT6A77FR3CL" secretAccessKey = "Y8AfSaucF37G4PpvfguKZ3/l7Id4uocLXxX0+VTx" securityToken = "IQoJb3JpZ2luX2VjEIz//////////wEaCXVzLWVhc3QtMiJGMEQCIH7MHX/Oy/OB8OlLQa9GrqU1B914+iMikqWQW7vPCKlgAiA/Lsv8Jcafn14owfxXn95FURZNKaaphj0ykpmS+Ki+CSq0AwhlEAAaDDA3NzA3MTM5MTk5NiIMx9sAeP1ovlMTMKLjKpEDwuJQg41/QUKx0laTZYjPlQvjwSqS3OB9P1KAXPWSLkliVMMqaHqelvMF/WO/glv3KwuTfQsavRNs3v5pcSEm4SPO3l7mCs7KrQUHwGP0neZhIKxEXy+Ls//1C/Bqt53NL+LSbaGv6RPHaX82laz2qElphg95aVLdYgIFY6JWV5fzyjgnhz0DQmy62/Vi8pNcM2/VnxeCQ8CC8dRDSt52ry2v+nc77vstuI9xV5k8mPtnaPoJDRANh0bjwY5Sdwkbp+mGRUJBAQRlNgHUJusefXQgVKBCiyJY4w3Csd8Bgj9IyDV+Azuy1jQqfFZWgP68LSz5bURyIjlWDQunO82stZ0BgplKKAa/KJHBPCp8Qi6i99uy7qh76FQAqgVTsnDuU6fGpHDcsDSGoCls2HgZjZFPeOj8mmRhFk1Xqvkbjuz8V1cJk54d3gIJvQt8gD2D6yJQZecnuGWd5K2e2HohvCc8Fc9kBl1300nUJPV+k4tr/A5R/0QfEKOZL1/k5lf1g9CREnrM8LVkGxCgdYMxLQow1uTL+QU67AHRRSp5PhhGX4Rek+01vdYSnJCMaPhSEgcLqDlQkhk6MPsyT91QMXcWmyO+cAZwUPwnRamFepuP4K8k2KVXs/LIJHLELwAZ0ekyaS7CptgOqS7uaSTFG3U+vzFZLEnGvWQ7y9IPNQZ+Dffgh4p3vF4J68y9049sI6Sr5d5wbKkcbm8hdCDHZcv4lnqohquPirLiFQ3q7B17V9krMPu3mz1cg4Ekgcrn/E09NTsxAqD8NcZ7C7ECom9r+X3zkDOxaajW6hu3Az8hGlyylDaMiFfRbBJpTIlxp7jfa7CxikNgNtEKLH9iCzvuSg2vhA==" ) var requestSignerWithToken = &awsRequestSigner{ RegionName: "us-east-2", AwsSecurityCredentials: &AwsSecurityCredentials{ AccessKeyID: accessKeyID, SecretAccessKey: secretAccessKey, SessionToken: securityToken, }, } func setDefaultTime(req http.Request) { // Don't use time.Format for this // Our output signature expects this to be a Monday, even though Sept 9, 2011 is a Friday req.Header.Add("date", "Mon, 09 Sep 2011 23:36:00 GMT") } func testRequestSigner(t testing.T, rs awsRequestSigner, input, expectedOutput http.Request) { t.Helper() err := rs.SignRequest(input) if err != nil { t.Errorf("unexpected error: %q", err.Error()) } if got, want := input.URL.String(), expectedOutput.URL.String(); !reflect.DeepEqual(got, want) { t.Errorf("url = %q, want %q", got, want) } if got, want := input.Method, expectedOutput.Method; !reflect.DeepEqual(got, want) { t.Errorf("method = %q, want %q", got, want) } for header := range expectedOutput.Header { if got, want := input.Header[header], expectedOutput.Header[header]; !reflect.DeepEqual(got, want) { t.Errorf("header[%q] = %q, want %q", header, got, want) } } } func TestAWSv4Signature_GetRequest(t testing.T) { input, _ := http.NewRequest("GET", "https://host.foo.com", nil) setDefaultTime(input) output, _ := http.NewRequest("GET", "https://host.foo.com", nil) output.Header = http.Header{ "Host": []string{"host.foo.com"}, "Date": []string{"Mon, 09 Sep 2011 23:36:00 GMT"}, "Authorization": []string{"AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=b27ccfbfa7df52a200ff74193ca6e32d4b48b8856fab7ebf1c595d0670a7e470"}, } oldNow := now defer func() { now = oldNow }() now = setTime(defaultTime) testRequestSigner(t, defaultRequestSigner, input, output) } func TestAWSv4Signature_GetRequestWithRelativePath(t testing.T) { input, _ := http.NewRequest("GET", "https://host.foo.com/foo/bar/../..", nil) setDefaultTime(input) output, _ := http.NewRequest("GET", "https://host.foo.com/foo/bar/../..", nil) output.Header = http.Header{ "Host": []string{"host.foo.com"}, "Date": []string{"Mon, 09 Sep 2011 23:36:00 GMT"}, "Authorization": []string{"AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=b27ccfbfa7df52a200ff74193ca6e32d4b48b8856fab7ebf1c595d0670a7e470"}, } oldNow := now defer func() { now = oldNow }() now = setTime(defaultTime) testRequestSigner(t, defaultRequestSigner, input, output) } func TestAWSv4Signature_GetRequestWithDotPath(t testing.T) { input, _ := http.NewRequest("GET", "https://host.foo.com/./", nil) setDefaultTime(input) output, _ := http.NewRequest("GET", "https://host.foo.com/./", nil) output.Header = http.Header{ "Host": []string{"host.foo.com"}, "Date": []string{"Mon, 09 Sep 2011 23:36:00 GMT"}, "Authorization": []string{"AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=b27ccfbfa7df52a200ff74193ca6e32d4b48b8856fab7ebf1c595d0670a7e470"}, } oldNow := now defer func() { now = oldNow }() now = setTime(defaultTime) testRequestSigner(t, defaultRequestSigner, input, output) } func TestAWSv4Signature_GetRequestWithPointlessDotPath(t testing.T) { input, _ := http.NewRequest("GET", "https://host.foo.com/./foo", nil) setDefaultTime(input) output, _ := http.NewRequest("GET", "https://host.foo.com/./foo", nil) output.Header = http.Header{ "Host": []string{"host.foo.com"}, "Date": []string{"Mon, 09 Sep 2011 23:36:00 GMT"}, "Authorization": []string{"AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=910e4d6c9abafaf87898e1eb4c929135782ea25bb0279703146455745391e63a"}, } oldNow := now defer func() { now = oldNow }() now = setTime(defaultTime) testRequestSigner(t, defaultRequestSigner, input, output) } func TestAWSv4Signature_GetRequestWithUtf8Path(t testing.T) { input, _ := http.NewRequest("GET", "https://host.foo.com/%E1%88%B4", nil) setDefaultTime(input) output, _ := http.NewRequest("GET", "https://host.foo.com/%E1%88%B4", nil) output.Header = http.Header{ "Host": []string{"host.foo.com"}, "Date": []string{"Mon, 09 Sep 2011 23:36:00 GMT"}, "Authorization": []string{"AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=8d6634c189aa8c75c2e51e106b6b5121bed103fdb351f7d7d4381c738823af74"}, } oldNow := now defer func() { now = oldNow }() now = setTime(defaultTime) testRequestSigner(t, defaultRequestSigner, input, output) } func TestAWSv4Signature_GetRequestWithDuplicateQuery(t testing.T) { input, _ := http.NewRequest("GET", "https://host.foo.com/?foo=Zoo&foo=aha", nil) setDefaultTime(input) output, _ := http.NewRequest("GET", "https://host.foo.com/?foo=Zoo&foo=aha", nil) output.Header = http.Header{ "Host": []string{"host.foo.com"}, "Date": []string{"Mon, 09 Sep 2011 23:36:00 GMT"}, "Authorization": []string{"AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=be7148d34ebccdc6423b19085378aa0bee970bdc61d144bd1a8c48c33079ab09"}, } oldNow := now defer func() { now = oldNow }() now = setTime(defaultTime) testRequestSigner(t, defaultRequestSigner, input, output) } func TestAWSv4Signature_GetRequestWithMisorderedQuery(t testing.T) { input, _ := http.NewRequest("GET", "https://host.foo.com/?foo=b&foo=a", nil) setDefaultTime(input) output, _ := http.NewRequest("GET", "https://host.foo.com/?foo=b&foo=a", nil) output.Header = http.Header{ "Host": []string{"host.foo.com"}, "Date": []string{"Mon, 09 Sep 2011 23:36:00 GMT"}, "Authorization": []string{"AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=feb926e49e382bec75c9d7dcb2a1b6dc8aa50ca43c25d2bc51143768c0875acc"}, } oldNow := now defer func() { now = oldNow }() now = setTime(defaultTime) testRequestSigner(t, defaultRequestSigner, input, output) } func TestAWSv4Signature_GetRequestWithUtf8Query(t testing.T) { input, _ := http.NewRequest("GET", "https://host.foo.com/?ሴ=bar", nil) setDefaultTime(input) output, _ := http.NewRequest("GET", "https://host.foo.com/?ሴ=bar", nil) output.Header = http.Header{ "Host": []string{"host.foo.com"}, "Date": []string{"Mon, 09 Sep 2011 23:36:00 GMT"}, "Authorization": []string{"AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=6fb359e9a05394cc7074e0feb42573a2601abc0c869a953e8c5c12e4e01f1a8c"}, } oldNow := now defer func() { now = oldNow }() now = setTime(defaultTime) testRequestSigner(t, defaultRequestSigner, input, output) } func TestAWSv4Signature_PostRequest(t testing.T) { input, _ := http.NewRequest("POST", "https://host.foo.com/", nil) setDefaultTime(input) input.Header.Add("ZOO", "zoobar") output, _ := http.NewRequest("POST", "https://host.foo.com/", nil) output.Header = http.Header{ "Host": []string{"host.foo.com"}, "Date": []string{"Mon, 09 Sep 2011 23:36:00 GMT"}, "Authorization": []string{"AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host;zoo, Signature=b7a95a52518abbca0964a999a880429ab734f35ebbf1235bd79a5de87756dc4a"}, "Zoo": []string{"zoobar"}, } oldNow := now defer func() { now = oldNow }() now = setTime(defaultTime) testRequestSigner(t, defaultRequestSigner, input, output) } func TestAWSv4Signature_PostRequestWithCapitalizedHeaderValue(t testing.T) { input, _ := http.NewRequest("POST", "https://host.foo.com/", nil) setDefaultTime(input) input.Header.Add("zoo", "ZOOBAR") output, _ := http.NewRequest("POST", "https://host.foo.com/", nil) output.Header = http.Header{ "Host": []string{"host.foo.com"}, "Date": []string{"Mon, 09 Sep 2011 23:36:00 GMT"}, "Authorization": []string{"AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host;zoo, Signature=273313af9d0c265c531e11db70bbd653f3ba074c1009239e8559d3987039cad7"}, "Zoo": []string{"ZOOBAR"}, } oldNow := now defer func() { now = oldNow }() now = setTime(defaultTime) testRequestSigner(t, defaultRequestSigner, input, output) } func TestAWSv4Signature_PostRequestPhfft(t testing.T) { input, _ := http.NewRequest("POST", "https://host.foo.com/", nil) setDefaultTime(input) input.Header.Add("p", "phfft") output, _ := http.NewRequest("POST", "https://host.foo.com/", nil) output.Header = http.Header{ "Host": []string{"host.foo.com"}, "Date": []string{"Mon, 09 Sep 2011 23:36:00 GMT"}, "Authorization": []string{"AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host;p, Signature=debf546796015d6f6ded8626f5ce98597c33b47b9164cf6b17b4642036fcb592"}, "P": []string{"phfft"}, } oldNow := now defer func() { now = oldNow }() now = setTime(defaultTime) testRequestSigner(t, defaultRequestSigner, input, output) } func TestAWSv4Signature_PostRequestWithBody(t testing.T) { input, _ := http.NewRequest("POST", "https://host.foo.com/", strings.NewReader("foo=bar")) setDefaultTime(input) input.Header.Add("Content-Type", "application/x-www-form-urlencoded") output, _ := http.NewRequest("POST", "https://host.foo.com/", nil) output.Header = http.Header{ "Host": []string{"host.foo.com"}, "Date": []string{"Mon, 09 Sep 2011 23:36:00 GMT"}, "Content-Type": []string{"application/x-www-form-urlencoded"}, "Authorization": []string{"AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=content-type;date;host, Signature=5a15b22cf462f047318703b92e6f4f38884e4a7ab7b1d6426ca46a8bd1c26cbc"}, } oldNow := now defer func() { now = oldNow }() now = setTime(defaultTime) testRequestSigner(t, defaultRequestSigner, input, output) } func TestAWSv4Signature_PostRequestWithQueryString(t testing.T) { input, _ := http.NewRequest("POST", "https://host.foo.com/?foo=bar", nil) setDefaultTime(input) output, _ := http.NewRequest("POST", "https://host.foo.com/?foo=bar", nil) output.Header = http.Header{ "Host": []string{"host.foo.com"}, "Date": []string{"Mon, 09 Sep 2011 23:36:00 GMT"}, "Authorization": []string{"AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=b6e3b79003ce0743a491606ba1035a804593b0efb1e20a11cba83f8c25a57a92"}, } oldNow := now defer func() { now = oldNow }() now = setTime(defaultTime) testRequestSigner(t, defaultRequestSigner, input, output) } func TestAWSv4Signature_GetRequestWithSecurityToken(t testing.T) { input, _ := http.NewRequest("GET", "https://ec2.us-east-2.amazonaws.com?Action=DescribeRegions&Version=2013-10-15", nil) output, _ := http.NewRequest("GET", "https://ec2.us-east-2.amazonaws.com?Action=DescribeRegions&Version=2013-10-15", nil) output.Header = http.Header{ "Host": []string{"ec2.us-east-2.amazonaws.com"}, "Authorization": []string{"AWS4-HMAC-SHA256 Credential=" + accessKeyID + "/20200811/us-east-2/ec2/aws4_request, SignedHeaders=host;x-amz-date;x-amz-security-token, Signature=631ea80cddfaa545fdadb120dc92c9f18166e38a5c47b50fab9fce476e022855"}, "X-Amz-Date": []string{"20200811T065522Z"}, "X-Amz-Security-Token": []string{securityToken}, } oldNow := now defer func() { now = oldNow }() now = setTime(secondDefaultTime) testRequestSigner(t, requestSignerWithToken, input, output) } func TestAWSv4Signature_PostRequestWithSecurityToken(t testing.T) { input, _ := http.NewRequest("POST", "https://sts.us-east-2.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15", nil) output, _ := http.NewRequest("POST", "https://sts.us-east-2.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15", nil) output.Header = http.Header{ "Authorization": []string{"AWS4-HMAC-SHA256 Credential=" + accessKeyID + "/20200811/us-east-2/sts/aws4_request, SignedHeaders=host;x-amz-date;x-amz-security-token, Signature=73452984e4a880ffdc5c392355733ec3f5ba310d5e0609a89244440cadfe7a7a"}, "Host": []string{"sts.us-east-2.amazonaws.com"}, "X-Amz-Date": []string{"20200811T065522Z"}, "X-Amz-Security-Token": []string{securityToken}, } oldNow := now defer func() { now = oldNow }() now = setTime(secondDefaultTime) testRequestSigner(t, requestSignerWithToken, input, output) } func TestAWSv4Signature_PostRequestWithSecurityTokenAndAdditionalHeaders(t testing.T) { requestParams := "{\"KeySchema\":[{\"KeyType\":\"HASH\",\"AttributeName\":\"Id\"}],\"TableName\":\"TestTable\",\"AttributeDefinitions\":[{\"AttributeName\":\"Id\",\"AttributeType\":\"S\"}],\"ProvisionedThroughput\":{\"WriteCapacityUnits\":5,\"ReadCapacityUnits\":5}}" input, _ := http.NewRequest("POST", "https://dynamodb.us-east-2.amazonaws.com/", strings.NewReader(requestParams)) input.Header.Add("Content-Type", "application/x-amz-json-1.0") input.Header.Add("x-amz-target", "DynamoDB_20120810.CreateTable") output, _ := http.NewRequest("POST", "https://dynamodb.us-east-2.amazonaws.com/", strings.NewReader(requestParams)) output.Header = http.Header{ "Authorization": []string{"AWS4-HMAC-SHA256 Credential=" + accessKeyID + "/20200811/us-east-2/dynamodb/aws4_request, SignedHeaders=content-type;host;x-amz-date;x-amz-security-token;x-amz-target, Signature=fdaa5b9cc9c86b80fe61eaf504141c0b3523780349120f2bd8145448456e0385"}, "Host": []string{"dynamodb.us-east-2.amazonaws.com"}, "X-Amz-Date": []string{"20200811T065522Z"}, "Content-Type": []string{"application/x-amz-json-1.0"}, "X-Amz-Target": []string{"DynamoDB_20120810.CreateTable"}, "X-Amz-Security-Token": []string{securityToken}, } oldNow := now defer func() { now = oldNow }() now = setTime(secondDefaultTime) testRequestSigner(t, requestSignerWithToken, input, output) } func TestAWSv4Signature_PostRequestWithAmzDateButNoSecurityToken(t testing.T) { var requestSigner = &awsRequestSigner{ RegionName: "us-east-2", AwsSecurityCredentials: &AwsSecurityCredentials{ AccessKeyID: accessKeyID, SecretAccessKey: secretAccessKey, }, } input, _ := http.NewRequest("POST", "https://sts.us-east-2.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15", nil) output, _ := http.NewRequest("POST", "https://sts.us-east-2.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15", nil) output.Header = http.Header{ "Authorization": []string{"AWS4-HMAC-SHA256 Credential=" + accessKeyID + "/20200811/us-east-2/sts/aws4_request, SignedHeaders=host;x-amz-date, Signature=d095ba304919cd0d5570ba8a3787884ee78b860f268ed040ba23831d55536d56"}, "Host": []string{"sts.us-east-2.amazonaws.com"}, "X-Amz-Date": []string{"20200811T065522Z"}, } oldNow := now defer func() { now = oldNow }() now = setTime(secondDefaultTime) testRequestSigner(t, requestSigner, input, output) } type testAwsServer struct { url string securityCredentialURL string regionURL string regionalCredVerificationURL string imdsv2SessionTokenUrl string Credentials map[string]string WriteRolename func(http.ResponseWriter, http.Request) WriteSecurityCredentials func(http.ResponseWriter, http.Request) WriteRegion func(http.ResponseWriter, http.Request) WriteIMDSv2SessionToken func(http.ResponseWriter, http.Request) } func createAwsTestServer(url, regionURL, regionalCredVerificationURL, imdsv2SessionTokenUrl string, rolename, region string, credentials map[string]string, imdsv2SessionToken string, validateHeaders validateHeaders) testAwsServer { server := &testAwsServer{ url: url, securityCredentialURL: fmt.Sprintf("%s/%s", url, rolename), regionURL: regionURL, regionalCredVerificationURL: regionalCredVerificationURL, imdsv2SessionTokenUrl: imdsv2SessionTokenUrl, Credentials: credentials, WriteRolename: func(w http.ResponseWriter, r http.Request) { validateHeaders(r) w.Write([]byte(rolename)) }, WriteRegion: func(w http.ResponseWriter, r http.Request) { validateHeaders(r) w.Write([]byte(region)) }, WriteIMDSv2SessionToken: func(w http.ResponseWriter, r http.Request) { validateHeaders(r) w.Write([]byte(imdsv2SessionToken)) }, } server.WriteSecurityCredentials = func(w http.ResponseWriter, r http.Request) { validateHeaders(r) jsonCredentials, _ := json.Marshal(server.Credentials) w.Write(jsonCredentials) } return server } func createDefaultAwsTestServer() testAwsServer { return createAwsTestServer( "/latest/meta-data/iam/security-credentials", "/latest/meta-data/placement/availability-zone", "https://sts.{region}.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15", "", "gcp-aws-role", "us-east-2b", map[string]string{ "SecretAccessKey": secretAccessKey, "AccessKeyId": accessKeyID, "Token": securityToken, }, "", noHeaderValidation, ) } func createDefaultAwsTestServerWithImdsv2(t testing.T) testAwsServer { validateSessionTokenHeaders := func(r http.Request) { if r.URL.Path == "/latest/api/token" { headerValue := r.Header.Get(awsIMDSv2SessionTtlHeader) if headerValue != awsIMDSv2SessionTtl { t.Errorf("%q = \n%q\n want \n%q", awsIMDSv2SessionTtlHeader, headerValue, awsIMDSv2SessionTtl) } } else { headerValue := r.Header.Get(awsIMDSv2SessionTokenHeader) if headerValue != "sessiontoken" { t.Errorf("%q = \n%q\n want \n%q", awsIMDSv2SessionTokenHeader, headerValue, "sessiontoken") } } } return createAwsTestServer( "/latest/meta-data/iam/security-credentials", "/latest/meta-data/placement/availability-zone", "https://sts.{region}.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15", "/latest/api/token", "gcp-aws-role", "us-east-2b", map[string]string{ "SecretAccessKey": secretAccessKey, "AccessKeyId": accessKeyID, "Token": securityToken, }, "sessiontoken", validateSessionTokenHeaders, ) } func (server testAwsServer) ServeHTTP(w http.ResponseWriter, r http.Request) { switch p := r.URL.Path; p { case server.url: server.WriteRolename(w, r) case server.securityCredentialURL: server.WriteSecurityCredentials(w, r) case server.regionURL: server.WriteRegion(w, r) case server.imdsv2SessionTokenUrl: server.WriteIMDSv2SessionToken(w, r) } } func notFound(w http.ResponseWriter, r http.Request) { w.WriteHeader(404) w.Write([]byte("Not Found")) } func noHeaderValidation(r http.Request) {} func (server testAwsServer) getCredentialSource(url string) CredentialSource { return &CredentialSource{ EnvironmentID: "aws1", URL: url + server.url, RegionURL: url + server.regionURL, RegionalCredVerificationURL: server.regionalCredVerificationURL, IMDSv2SessionTokenURL: url + server.imdsv2SessionTokenUrl, } } func getExpectedSubjectToken(url, region, accessKeyID, secretAccessKey, securityToken string) string { req, _ := http.NewRequest("POST", url, nil) req.Header.Add("x-goog-cloud-target-resource", testFileConfig.Audience) signer := &awsRequestSigner{ RegionName: region, AwsSecurityCredentials: &AwsSecurityCredentials{ AccessKeyID: accessKeyID, SecretAccessKey: secretAccessKey, SessionToken: securityToken, }, } signer.SignRequest(req) result := awsRequest{ URL: url, Method: "POST", Headers: []awsRequestHeader{ { Key: "Authorization", Value: req.Header.Get("Authorization"), }, { Key: "Host", Value: req.Header.Get("Host"), }, { Key: "X-Amz-Date", Value: req.Header.Get("X-Amz-Date"), }, }, } if securityToken != "" { result.Headers = append(result.Headers, awsRequestHeader{ Key: "X-Amz-Security-Token", Value: securityToken, }) } result.Headers = append(result.Headers, awsRequestHeader{ Key: "X-Goog-Cloud-Target-Resource", Value: testFileConfig.Audience, }) str, _ := json.Marshal(result) return neturl.QueryEscape(string(str)) } func TestAWSCredential_BasicRequest(t testing.T) { server := createDefaultAwsTestServer() ts := httptest.NewServer(server) tfc := testFileConfig tfc.CredentialSource = server.getCredentialSource(ts.URL) oldGetenv := getenv oldNow := now defer func() { getenv = oldGetenv now = oldNow }() getenv = setEnvironment(map[string]string{}) now = setTime(defaultTime) base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } out, err := base.subjectToken() if err != nil { t.Fatalf("retrieveSubjectToken() failed: %v", err) } expected := getExpectedSubjectToken( "https://sts.us-east-2.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15", "us-east-2", accessKeyID, secretAccessKey, securityToken, ) if got, want := out, expected; !reflect.DeepEqual(got, want) { t.Errorf("subjectToken = \n%q\n want \n%q", got, want) } } func TestAWSCredential_IMDSv2(t testing.T) { server := createDefaultAwsTestServerWithImdsv2(t) ts := httptest.NewServer(server) tfc := testFileConfig tfc.CredentialSource = server.getCredentialSource(ts.URL) oldGetenv := getenv oldNow := now defer func() { getenv = oldGetenv now = oldNow }() getenv = setEnvironment(map[string]string{}) now = setTime(defaultTime) base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } out, err := base.subjectToken() if err != nil { t.Fatalf("retrieveSubjectToken() failed: %v", err) } expected := getExpectedSubjectToken( "https://sts.us-east-2.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15", "us-east-2", accessKeyID, secretAccessKey, securityToken, ) if got, want := out, expected; !reflect.DeepEqual(got, want) { t.Errorf("subjectToken = \n%q\n want \n%q", got, want) } } func TestAWSCredential_BasicRequestWithoutSecurityToken(t testing.T) { server := createDefaultAwsTestServer() ts := httptest.NewServer(server) delete(server.Credentials, "Token") tfc := testFileConfig tfc.CredentialSource = server.getCredentialSource(ts.URL) oldGetenv := getenv oldNow := now defer func() { getenv = oldGetenv now = oldNow }() getenv = setEnvironment(map[string]string{}) now = setTime(defaultTime) base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } out, err := base.subjectToken() if err != nil { t.Fatalf("retrieveSubjectToken() failed: %v", err) } expected := getExpectedSubjectToken( "https://sts.us-east-2.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15", "us-east-2", accessKeyID, secretAccessKey, "", ) if got, want := out, expected; !reflect.DeepEqual(got, want) { t.Errorf("subjectToken = \n%q\n want \n%q", got, want) } } func TestAWSCredential_BasicRequestWithEnv(t testing.T) { server := createDefaultAwsTestServer() ts := httptest.NewServer(server) tfc := testFileConfig tfc.CredentialSource = server.getCredentialSource(ts.URL) oldGetenv := getenv oldNow := now defer func() { getenv = oldGetenv now = oldNow }() getenv = setEnvironment(map[string]string{ "AWS_ACCESS_KEY_ID": "AKIDEXAMPLE", "AWS_SECRET_ACCESS_KEY": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY", "AWS_REGION": "us-west-1", }) now = setTime(defaultTime) base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } out, err := base.subjectToken() if err != nil { t.Fatalf("retrieveSubjectToken() failed: %v", err) } expected := getExpectedSubjectToken( "https://sts.us-west-1.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15", "us-west-1", "AKIDEXAMPLE", "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY", "", ) if got, want := out, expected; !reflect.DeepEqual(got, want) { t.Errorf("subjectToken = \n%q\n want \n%q", got, want) } } func TestAWSCredential_BasicRequestWithDefaultEnv(t testing.T) { server := createDefaultAwsTestServer() ts := httptest.NewServer(server) tfc := testFileConfig tfc.CredentialSource = server.getCredentialSource(ts.URL) oldGetenv := getenv oldNow := now defer func() { getenv = oldGetenv now = oldNow }() getenv = setEnvironment(map[string]string{ "AWS_ACCESS_KEY_ID": "AKIDEXAMPLE", "AWS_SECRET_ACCESS_KEY": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY", "AWS_REGION": "us-west-1", }) now = setTime(defaultTime) base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } out, err := base.subjectToken() if err != nil { t.Fatalf("retrieveSubjectToken() failed: %v", err) } expected := getExpectedSubjectToken( "https://sts.us-west-1.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15", "us-west-1", "AKIDEXAMPLE", "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY", "", ) if got, want := out, expected; !reflect.DeepEqual(got, want) { t.Errorf("subjectToken = \n%q\n want \n%q", got, want) } } func TestAWSCredential_BasicRequestWithTwoRegions(t testing.T) { server := createDefaultAwsTestServer() ts := httptest.NewServer(server) tfc := testFileConfig tfc.CredentialSource = server.getCredentialSource(ts.URL) oldGetenv := getenv oldNow := now defer func() { getenv = oldGetenv now = oldNow }() getenv = setEnvironment(map[string]string{ "AWS_ACCESS_KEY_ID": "AKIDEXAMPLE", "AWS_SECRET_ACCESS_KEY": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY", "AWS_REGION": "us-west-1", "AWS_DEFAULT_REGION": "us-east-1", }) now = setTime(defaultTime) base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } out, err := base.subjectToken() if err != nil { t.Fatalf("retrieveSubjectToken() failed: %v", err) } expected := getExpectedSubjectToken( "https://sts.us-west-1.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15", "us-west-1", "AKIDEXAMPLE", "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY", "", ) if got, want := out, expected; !reflect.DeepEqual(got, want) { t.Errorf("subjectToken = \n%q\n want \n%q", got, want) } } func TestAWSCredential_RequestWithBadVersion(t testing.T) { server := createDefaultAwsTestServer() ts := httptest.NewServer(server) tfc := testFileConfig tfc.CredentialSource = server.getCredentialSource(ts.URL) tfc.CredentialSource.EnvironmentID = "aws3" oldGetenv := getenv defer func() { getenv = oldGetenv }() getenv = setEnvironment(map[string]string{}) _, err := tfc.parse(context.Background()) if err == nil { t.Fatalf("parse() should have failed") } if got, want := err.Error(), "oauth2/google/externalaccount: aws version '3' is not supported in the current build"; !reflect.DeepEqual(got, want) { t.Errorf("subjectToken = %q, want %q", got, want) } } func TestAWSCredential_RequestWithNoRegionURL(t testing.T) { server := createDefaultAwsTestServer() ts := httptest.NewServer(server) tfc := testFileConfig tfc.CredentialSource = server.getCredentialSource(ts.URL) tfc.CredentialSource.RegionURL = "" oldGetenv := getenv defer func() { getenv = oldGetenv }() getenv = setEnvironment(map[string]string{}) base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } _, err = base.subjectToken() if err == nil { t.Fatalf("retrieveSubjectToken() should have failed") } if got, want := err.Error(), "oauth2/google/externalaccount: unable to determine AWS region"; !reflect.DeepEqual(got, want) { t.Errorf("subjectToken = %q, want %q", got, want) } } func TestAWSCredential_RequestWithBadRegionURL(t testing.T) { server := createDefaultAwsTestServer() ts := httptest.NewServer(server) server.WriteRegion = notFound tfc := testFileConfig tfc.CredentialSource = server.getCredentialSource(ts.URL) oldGetenv := getenv defer func() { getenv = oldGetenv }() getenv = setEnvironment(map[string]string{}) base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } _, err = base.subjectToken() if err == nil { t.Fatalf("retrieveSubjectToken() should have failed") } if got, want := err.Error(), "oauth2/google/externalaccount: unable to retrieve AWS region - Not Found"; !reflect.DeepEqual(got, want) { t.Errorf("subjectToken = %q, want %q", got, want) } } func TestAWSCredential_RequestWithMissingCredential(t testing.T) { server := createDefaultAwsTestServer() ts := httptest.NewServer(server) server.WriteSecurityCredentials = func(w http.ResponseWriter, r http.Request) { w.Write([]byte("{}")) } tfc := testFileConfig tfc.CredentialSource = server.getCredentialSource(ts.URL) oldGetenv := getenv defer func() { getenv = oldGetenv }() getenv = setEnvironment(map[string]string{}) base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } _, err = base.subjectToken() if err == nil { t.Fatalf("retrieveSubjectToken() should have failed") } if got, want := err.Error(), "oauth2/google/externalaccount: missing AccessKeyId credential"; !reflect.DeepEqual(got, want) { t.Errorf("subjectToken = %q, want %q", got, want) } } func TestAWSCredential_RequestWithIncompleteCredential(t testing.T) { server := createDefaultAwsTestServer() ts := httptest.NewServer(server) server.WriteSecurityCredentials = func(w http.ResponseWriter, r http.Request) { w.Write([]byte(`{"AccessKeyId":"FOOBARBAS"}`)) } tfc := testFileConfig tfc.CredentialSource = server.getCredentialSource(ts.URL) oldGetenv := getenv defer func() { getenv = oldGetenv }() getenv = setEnvironment(map[string]string{}) base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } _, err = base.subjectToken() if err == nil { t.Fatalf("retrieveSubjectToken() should have failed") } if got, want := err.Error(), "oauth2/google/externalaccount: missing SecretAccessKey credential"; !reflect.DeepEqual(got, want) { t.Errorf("subjectToken = %q, want %q", got, want) } } func TestAWSCredential_RequestWithNoCredentialURL(t testing.T) { server := createDefaultAwsTestServer() ts := httptest.NewServer(server) tfc := testFileConfig tfc.CredentialSource = server.getCredentialSource(ts.URL) tfc.CredentialSource.URL = "" oldGetenv := getenv defer func() { getenv = oldGetenv }() getenv = setEnvironment(map[string]string{}) base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } _, err = base.subjectToken() if err == nil { t.Fatalf("retrieveSubjectToken() should have failed") } if got, want := err.Error(), "oauth2/google/externalaccount: unable to determine the AWS metadata server security credentials endpoint"; !reflect.DeepEqual(got, want) { t.Errorf("subjectToken = %q, want %q", got, want) } } func TestAWSCredential_RequestWithBadCredentialURL(t testing.T) { server := createDefaultAwsTestServer() ts := httptest.NewServer(server) server.WriteRolename = notFound tfc := testFileConfig tfc.CredentialSource = server.getCredentialSource(ts.URL) oldGetenv := getenv defer func() { getenv = oldGetenv }() getenv = setEnvironment(map[string]string{}) base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } _, err = base.subjectToken() if err == nil { t.Fatalf("retrieveSubjectToken() should have failed") } if got, want := err.Error(), "oauth2/google/externalaccount: unable to retrieve AWS role name - Not Found"; !reflect.DeepEqual(got, want) { t.Errorf("subjectToken = %q, want %q", got, want) } } func TestAWSCredential_RequestWithBadFinalCredentialURL(t testing.T) { server := createDefaultAwsTestServer() ts := httptest.NewServer(server) server.WriteSecurityCredentials = notFound tfc := testFileConfig tfc.CredentialSource = server.getCredentialSource(ts.URL) oldGetenv := getenv defer func() { getenv = oldGetenv }() getenv = setEnvironment(map[string]string{}) base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } _, err = base.subjectToken() if err == nil { t.Fatalf("retrieveSubjectToken() should have failed") } if got, want := err.Error(), "oauth2/google/externalaccount: unable to retrieve AWS security credentials - Not Found"; !reflect.DeepEqual(got, want) { t.Errorf("subjectToken = %q, want %q", got, want) } } func TestAWSCredential_ShouldNotCallMetadataEndpointWhenCredsAreInEnv(t testing.T) { server := createDefaultAwsTestServer() ts := httptest.NewServer(server) metadataTs := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { t.Error("Metadata server should not have been called.") })) tfc := testFileConfig tfc.CredentialSource = server.getCredentialSource(ts.URL) tfc.CredentialSource.IMDSv2SessionTokenURL = metadataTs.URL oldGetenv := getenv oldNow := now defer func() { getenv = oldGetenv now = oldNow }() getenv = setEnvironment(map[string]string{ "AWS_ACCESS_KEY_ID": "AKIDEXAMPLE", "AWS_SECRET_ACCESS_KEY": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY", "AWS_REGION": "us-west-1", }) now = setTime(defaultTime) base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } out, err := base.subjectToken() if err != nil { t.Fatalf("retrieveSubjectToken() failed: %v", err) } expected := getExpectedSubjectToken( "https://sts.us-west-1.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15", "us-west-1", "AKIDEXAMPLE", "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY", "", ) if got, want := out, expected; !reflect.DeepEqual(got, want) { t.Errorf("subjectToken = \n%q\n want \n%q", got, want) } } func TestAWSCredential_ShouldCallMetadataEndpointWhenNoRegion(t testing.T) { server := createDefaultAwsTestServerWithImdsv2(t) ts := httptest.NewServer(server) tfc := testFileConfig tfc.CredentialSource = server.getCredentialSource(ts.URL) oldGetenv := getenv oldNow := now defer func() { getenv = oldGetenv now = oldNow }() getenv = setEnvironment(map[string]string{ "AWS_ACCESS_KEY_ID": accessKeyID, "AWS_SECRET_ACCESS_KEY": secretAccessKey, }) now = setTime(defaultTime) base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } out, err := base.subjectToken() if err != nil { t.Fatalf("retrieveSubjectToken() failed: %v", err) } expected := getExpectedSubjectToken( "https://sts.us-east-2.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15", "us-east-2", accessKeyID, secretAccessKey, "", ) if got, want := out, expected; !reflect.DeepEqual(got, want) { t.Errorf("subjectToken = \n%q\n want \n%q", got, want) } } func TestAWSCredential_ShouldCallMetadataEndpointWhenNoAccessKey(t testing.T) { server := createDefaultAwsTestServerWithImdsv2(t) ts := httptest.NewServer(server) tfc := testFileConfig tfc.CredentialSource = server.getCredentialSource(ts.URL) oldGetenv := getenv oldNow := now defer func() { getenv = oldGetenv now = oldNow }() getenv = setEnvironment(map[string]string{ "AWS_SECRET_ACCESS_KEY": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY", "AWS_REGION": "us-west-1", }) now = setTime(defaultTime) base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } out, err := base.subjectToken() if err != nil { t.Fatalf("retrieveSubjectToken() failed: %v", err) } expected := getExpectedSubjectToken( "https://sts.us-west-1.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15", "us-west-1", accessKeyID, secretAccessKey, securityToken, ) if got, want := out, expected; !reflect.DeepEqual(got, want) { t.Errorf("subjectToken = \n%q\n want \n%q", got, want) } } func TestAWSCredential_ShouldCallMetadataEndpointWhenNoSecretAccessKey(t testing.T) { server := createDefaultAwsTestServerWithImdsv2(t) ts := httptest.NewServer(server) tfc := testFileConfig tfc.CredentialSource = server.getCredentialSource(ts.URL) oldGetenv := getenv oldNow := now defer func() { getenv = oldGetenv now = oldNow }() getenv = setEnvironment(map[string]string{ "AWS_ACCESS_KEY_ID": "AKIDEXAMPLE", "AWS_REGION": "us-west-1", }) now = setTime(defaultTime) base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } out, err := base.subjectToken() if err != nil { t.Fatalf("retrieveSubjectToken() failed: %v", err) } expected := getExpectedSubjectToken( "https://sts.us-west-1.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15", "us-west-1", accessKeyID, secretAccessKey, securityToken, ) if got, want := out, expected; !reflect.DeepEqual(got, want) { t.Errorf("subjectToken = \n%q\n want \n%q", got, want) } } func TestAWSCredential_ProgrammaticAuth(t testing.T) { tfc := testFileConfig securityCredentials := AwsSecurityCredentials{ AccessKeyID: accessKeyID, SecretAccessKey: secretAccessKey, SessionToken: securityToken, } tfc.AwsSecurityCredentialsSupplier = testAwsSupplier{ awsRegion: "us-east-2", err: nil, credentials: &securityCredentials, } oldNow := now defer func() { now = oldNow }() now = setTime(defaultTime) base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } out, err := base.subjectToken() if err != nil { t.Fatalf("retrieveSubjectToken() failed: %v", err) } expected := getExpectedSubjectToken( "https://sts.us-east-2.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15", "us-east-2", accessKeyID, secretAccessKey, securityToken, ) if got, want := out, expected; !reflect.DeepEqual(got, want) { t.Errorf("subjectToken = \n%q\n want \n%q", got, want) } } func TestAWSCredential_ProgrammaticAuthNoSessionToken(t testing.T) { tfc := testFileConfig securityCredentials := AwsSecurityCredentials{ AccessKeyID: accessKeyID, SecretAccessKey: secretAccessKey, } tfc.AwsSecurityCredentialsSupplier = testAwsSupplier{ awsRegion: "us-east-2", err: nil, credentials: &securityCredentials, } oldNow := now defer func() { now = oldNow }() now = setTime(defaultTime) base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } out, err := base.subjectToken() if err != nil { t.Fatalf("retrieveSubjectToken() failed: %v", err) } expected := getExpectedSubjectToken( "https://sts.us-east-2.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15", "us-east-2", accessKeyID, secretAccessKey, "", ) if got, want := out, expected; !reflect.DeepEqual(got, want) { t.Errorf("subjectToken = \n%q\n want \n%q", got, want) } } func TestAWSCredential_ProgrammaticAuthError(t testing.T) { tfc := testFileConfig testErr := errors.New("test error") tfc.AwsSecurityCredentialsSupplier = testAwsSupplier{ awsRegion: "us-east-2", err: testErr, credentials: nil, } base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } _, err = base.subjectToken() if err == nil { t.Fatalf("subjectToken() should have failed") } if err != testErr { t.Errorf("error = %e, want %e", err, testErr) } } func TestAWSCredential_ProgrammaticAuthRegionError(t testing.T) { tfc := testFileConfig securityCredentials := AwsSecurityCredentials{ AccessKeyID: accessKeyID, SecretAccessKey: secretAccessKey, } testErr := errors.New("test") tfc.AwsSecurityCredentialsSupplier = testAwsSupplier{ awsRegion: "", regionErr: testErr, credentials: &securityCredentials, } base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } _, err = base.subjectToken() if err == nil { t.Fatalf("subjectToken() should have failed") } if err != testErr { t.Errorf("error = %e, want %e", err, testErr) } } func TestAWSCredential_ProgrammaticAuthOptions(t testing.T) { tfc := testFileConfig securityCredentials := AwsSecurityCredentials{ AccessKeyID: accessKeyID, SecretAccessKey: secretAccessKey, } expectedOptions := SupplierOptions{Audience: tfc.Audience, SubjectTokenType: tfc.SubjectTokenType} tfc.AwsSecurityCredentialsSupplier = testAwsSupplier{ awsRegion: "us-east-2", credentials: &securityCredentials, expectedOptions: &expectedOptions, } base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } _, err = base.subjectToken() if err != nil { t.Fatalf("subjectToken() failed %v", err) } } func TestAWSCredential_ProgrammaticAuthContext(t testing.T) { tfc := testFileConfig securityCredentials := AwsSecurityCredentials{ AccessKeyID: accessKeyID, SecretAccessKey: secretAccessKey, } ctx := context.Background() tfc.AwsSecurityCredentialsSupplier = testAwsSupplier{ awsRegion: "us-east-2", credentials: &securityCredentials, expectedContext: ctx, } base, err := tfc.parse(ctx) if err != nil { t.Fatalf("parse() failed %v", err) } _, err = base.subjectToken() if err != nil { t.Fatalf("subjectToken() failed %v", err) } } func TestAwsCredential_CredentialSourceType(t testing.T) { server := createDefaultAwsTestServer() ts := httptest.NewServer(server) tfc := testFileConfig tfc.CredentialSource = server.getCredentialSource(ts.URL) base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } if got, want := base.credentialSourceType(), "aws"; got != want { t.Errorf("got %v but want %v", got, want) } } type testAwsSupplier struct { err error regionErr error awsRegion string credentials AwsSecurityCredentials expectedOptions SupplierOptions expectedContext context.Context } func (supp testAwsSupplier) AwsRegion(ctx context.Context, options SupplierOptions) (string, error) { if supp.regionErr != nil { return "", supp.regionErr } if supp.expectedOptions != nil { if supp.expectedOptions.Audience != options.Audience { return "", errors.New("Audience does not match") } if supp.expectedOptions.SubjectTokenType != options.SubjectTokenType { return "", errors.New("Audience does not match") } } if supp.expectedContext != nil { if supp.expectedContext != ctx { return "", errors.New("Context does not match") } } return supp.awsRegion, nil } func (supp testAwsSupplier) AwsSecurityCredentials(ctx context.Context, options SupplierOptions) (AwsSecurityCredentials, error) { if supp.err != nil { return nil, supp.err } if supp.expectedOptions != nil { if supp.expectedOptions.Audience != options.Audience { return nil, errors.New("Audience does not match") } if supp.expectedOptions.SubjectTokenType != options.SubjectTokenType { return nil, errors.New("Audience does not match") } } if supp.expectedContext != nil { if supp.expectedContext != ctx { return nil, errors.New("Context does not match") } } return supp.credentials, nil }	44.8 KB	2025-05-25 12:27
📄 basecredentials.go // Copyright 2020 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. /* Package externalaccount provides support for creating workload identity federation and workforce identity federation token sources that can be used to access Google Cloud resources from external identity providers. # Workload Identity Federation Using workload identity federation, your application can access Google Cloud resources from Amazon Web Services (AWS), Microsoft Azure or any identity provider that supports OpenID Connect (OIDC) or SAML 2.0. Traditionally, applications running outside Google Cloud have used service account keys to access Google Cloud resources. Using identity federation, you can allow your workload to impersonate a service account. This lets you access Google Cloud resources directly, eliminating the maintenance and security burden associated with service account keys. Follow the detailed instructions on how to configure Workload Identity Federation in various platforms: Amazon Web Services (AWS): https://cloud.google.com/iam/docs/workload-identity-federation-with-other-clouds#aws Microsoft Azure: https://cloud.google.com/iam/docs/workload-identity-federation-with-other-clouds#azure OIDC identity provider: https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#oidc SAML 2.0 identity provider: https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#saml For OIDC and SAML providers, the library can retrieve tokens in fours ways: from a local file location (file-sourced credentials), from a server (URL-sourced credentials), from a local executable (executable-sourced credentials), or from a user defined function that returns an OIDC or SAML token. For file-sourced credentials, a background process needs to be continuously refreshing the file location with a new OIDC/SAML token prior to expiration. For tokens with one hour lifetimes, the token needs to be updated in the file every hour. The token can be stored directly as plain text or in JSON format. For URL-sourced credentials, a local server needs to host a GET endpoint to return the OIDC/SAML token. The response can be in plain text or JSON. Additional required request headers can also be specified. For executable-sourced credentials, an application needs to be available to output the OIDC/SAML token and other information in a JSON format. For more information on how these work (and how to implement executable-sourced credentials), please check out: https://cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#create_a_credential_configuration To use a custom function to supply the token, define a struct that implements the [SubjectTokenSupplier] interface for OIDC/SAML providers, or one that implements [AwsSecurityCredentialsSupplier] for AWS providers. This can then be used when building a [Config]. The [golang.org/x/oauth2.TokenSource] created from the config using [NewTokenSource] can then be used to access Google Cloud resources. For instance, you can create a new client from the [cloud.google.com/go/storage] package and pass in option.WithTokenSource(yourTokenSource)) Note that this library does not perform any validation on the token_url, token_info_url, or service_account_impersonation_url fields of the credential configuration. It is not recommended to use a credential configuration that you did not generate with the gcloud CLI unless you verify that the URL fields point to a googleapis.com domain. # Workforce Identity Federation Workforce identity federation lets you use an external identity provider (IdP) to authenticate and authorize a workforce—a group of users, such as employees, partners, and contractors—using IAM, so that the users can access Google Cloud services. Workforce identity federation extends Google Cloud's identity capabilities to support syncless, attribute-based single sign on. With workforce identity federation, your workforce can access Google Cloud resources using an external identity provider (IdP) that supports OpenID Connect (OIDC) or SAML 2.0 such as Azure Active Directory (Azure AD), Active Directory Federation Services (AD FS), Okta, and others. Follow the detailed instructions on how to configure Workload Identity Federation in various platforms: Azure AD: https://cloud.google.com/iam/docs/workforce-sign-in-azure-ad Okta: https://cloud.google.com/iam/docs/workforce-sign-in-okta OIDC identity provider: https://cloud.google.com/iam/docs/configuring-workforce-identity-federation#oidc SAML 2.0 identity provider: https://cloud.google.com/iam/docs/configuring-workforce-identity-federation#saml For workforce identity federation, the library can retrieve tokens in four ways: from a local file location (file-sourced credentials), from a server (URL-sourced credentials), from a local executable (executable-sourced credentials), or from a user supplied function that returns an OIDC or SAML token. For file-sourced credentials, a background process needs to be continuously refreshing the file location with a new OIDC/SAML token prior to expiration. For tokens with one hour lifetimes, the token needs to be updated in the file every hour. The token can be stored directly as plain text or in JSON format. For URL-sourced credentials, a local server needs to host a GET endpoint to return the OIDC/SAML token. The response can be in plain text or JSON. Additional required request headers can also be specified. For executable-sourced credentials, an application needs to be available to output the OIDC/SAML token and other information in a JSON format. For more information on how these work (and how to implement executable-sourced credentials), please check out: https://cloud.google.com/iam/docs/workforce-obtaining-short-lived-credentials#generate_a_configuration_file_for_non-interactive_sign-in To use a custom function to supply the token, define a struct that implements the [SubjectTokenSupplier] interface for OIDC/SAML providers. This can then be used when building a [Config]. The [golang.org/x/oauth2.TokenSource] created from the config using [NewTokenSource] can then be used access Google Cloud resources. For instance, you can create a new client from the [cloud.google.com/go/storage] package and pass in option.WithTokenSource(yourTokenSource)) # Security considerations Note that this library does not perform any validation on the token_url, token_info_url, or service_account_impersonation_url fields of the credential configuration. It is not recommended to use a credential configuration that you did not generate with the gcloud CLI unless you verify that the URL fields point to a googleapis.com domain. / package externalaccount import ( "context" "fmt" "net/http" "regexp" "strconv" "strings" "time" "golang.org/x/oauth2" "golang.org/x/oauth2/google/internal/impersonate" "golang.org/x/oauth2/google/internal/stsexchange" ) const ( universeDomainPlaceholder = "UNIVERSE_DOMAIN" defaultTokenURL = "https://sts.UNIVERSE_DOMAIN/v1/token" defaultUniverseDomain = "googleapis.com" ) // now aliases time.Now for testing var now = func() time.Time { return time.Now().UTC() } // Config stores the configuration for fetching tokens with external credentials. type Config struct { // Audience is the Secure Token Service (STS) audience which contains the resource name for the workload // identity pool or the workforce pool and the provider identifier in that pool. Required. Audience string // SubjectTokenType is the STS token type based on the Oauth2.0 token exchange spec. // Expected values include: // “urn:ietf:params:oauth:token-type:jwt” // “urn:ietf:params:oauth:token-type:id-token” // “urn:ietf:params:oauth:token-type:saml2” // “urn:ietf:params:aws:token-type:aws4_request” // Required. SubjectTokenType string // TokenURL is the STS token exchange endpoint. If not provided, will default to // https://sts.UNIVERSE_DOMAIN/v1/token, with UNIVERSE_DOMAIN set to the // default service domain googleapis.com unless UniverseDomain is set. // Optional. TokenURL string // TokenInfoURL is the token_info endpoint used to retrieve the account related information ( // user attributes like account identifier, eg. email, username, uid, etc). This is // needed for gCloud session account identification. Optional. TokenInfoURL string // ServiceAccountImpersonationURL is the URL for the service account impersonation request. This is only // required for workload identity pools when APIs to be accessed have not integrated with UberMint. Optional. ServiceAccountImpersonationURL string // ServiceAccountImpersonationLifetimeSeconds is the number of seconds the service account impersonation // token will be valid for. If not provided, it will default to 3600. Optional. ServiceAccountImpersonationLifetimeSeconds int // ClientSecret is currently only required if token_info endpoint also // needs to be called with the generated GCP access token. When provided, STS will be // called with additional basic authentication using ClientId as username and ClientSecret as password. Optional. ClientSecret string // ClientID is only required in conjunction with ClientSecret, as described above. Optional. ClientID string // CredentialSource contains the necessary information to retrieve the token itself, as well // as some environmental information. One of SubjectTokenSupplier, AWSSecurityCredentialSupplier or // CredentialSource must be provided. Optional. CredentialSource CredentialSource // QuotaProjectID is injected by gCloud. If the value is non-empty, the Auth libraries // will set the x-goog-user-project header which overrides the project associated with the credentials. Optional. QuotaProjectID string // Scopes contains the desired scopes for the returned access token. Optional. Scopes []string // WorkforcePoolUserProject is the workforce pool user project number when the credential // corresponds to a workforce pool and not a workload identity pool. // The underlying principal must still have serviceusage.services.use IAM // permission to use the project for billing/quota. Optional. WorkforcePoolUserProject string // SubjectTokenSupplier is an optional token supplier for OIDC/SAML credentials. // One of SubjectTokenSupplier, AWSSecurityCredentialSupplier or CredentialSource must be provided. Optional. SubjectTokenSupplier SubjectTokenSupplier // AwsSecurityCredentialsSupplier is an AWS Security Credential supplier for AWS credentials. // One of SubjectTokenSupplier, AWSSecurityCredentialSupplier or CredentialSource must be provided. Optional. AwsSecurityCredentialsSupplier AwsSecurityCredentialsSupplier // UniverseDomain is the default service domain for a given Cloud universe. // This value will be used in the default STS token URL. The default value // is "googleapis.com". It will not be used if TokenURL is set. Optional. UniverseDomain string } var ( validWorkforceAudiencePattern regexp.Regexp = regexp.MustCompile(`//iam\.googleapis\.com/locations/[^/]+/workforcePools/`) ) func validateWorkforceAudience(input string) bool { return validWorkforceAudiencePattern.MatchString(input) } // NewTokenSource Returns an external account TokenSource using the provided external account config. func NewTokenSource(ctx context.Context, conf Config) (oauth2.TokenSource, error) { if conf.Audience == "" { return nil, fmt.Errorf("oauth2/google/externalaccount: Audience must be set") } if conf.SubjectTokenType == "" { return nil, fmt.Errorf("oauth2/google/externalaccount: Subject token type must be set") } if conf.WorkforcePoolUserProject != "" { valid := validateWorkforceAudience(conf.Audience) if !valid { return nil, fmt.Errorf("oauth2/google/externalaccount: Workforce pool user project should not be set for non-workforce pool credentials") } } count := 0 if conf.CredentialSource != nil { count++ } if conf.SubjectTokenSupplier != nil { count++ } if conf.AwsSecurityCredentialsSupplier != nil { count++ } if count == 0 { return nil, fmt.Errorf("oauth2/google/externalaccount: One of CredentialSource, SubjectTokenSupplier, or AwsSecurityCredentialsSupplier must be set") } if count > 1 { return nil, fmt.Errorf("oauth2/google/externalaccount: Only one of CredentialSource, SubjectTokenSupplier, or AwsSecurityCredentialsSupplier must be set") } return conf.tokenSource(ctx, "https") } // tokenSource is a private function that's directly called by some of the tests, // because the unit test URLs are mocked, and would otherwise fail the // validity check. func (c Config) tokenSource(ctx context.Context, scheme string) (oauth2.TokenSource, error) { ts := tokenSource{ ctx: ctx, conf: c, } if c.ServiceAccountImpersonationURL == "" { return oauth2.ReuseTokenSource(nil, ts), nil } scopes := c.Scopes ts.conf.Scopes = []string{"https://www.googleapis.com/auth/cloud-platform"} imp := impersonate.ImpersonateTokenSource{ Ctx: ctx, URL: c.ServiceAccountImpersonationURL, Scopes: scopes, Ts: oauth2.ReuseTokenSource(nil, ts), TokenLifetimeSeconds: c.ServiceAccountImpersonationLifetimeSeconds, } return oauth2.ReuseTokenSource(nil, imp), nil } // Subject token file types. const ( fileTypeText = "text" fileTypeJSON = "json" ) // Format contains information needed to retireve a subject token for URL or File sourced credentials. type Format struct { // Type should be either "text" or "json". This determines whether the file or URL sourced credentials // expect a simple text subject token or if the subject token will be contained in a JSON object. // When not provided "text" type is assumed. Type string `json:"type"` // SubjectTokenFieldName is only required for JSON format. This is the field name that the credentials will check // for the subject token in the file or URL response. This would be "access_token" for azure. SubjectTokenFieldName string `json:"subject_token_field_name"` } // CredentialSource stores the information necessary to retrieve the credentials for the STS exchange. type CredentialSource struct { // File is the location for file sourced credentials. // One field amongst File, URL, Executable, or EnvironmentID should be provided, depending on the kind of credential in question. File string `json:"file"` // Url is the URL to call for URL sourced credentials. // One field amongst File, URL, Executable, or EnvironmentID should be provided, depending on the kind of credential in question. URL string `json:"url"` // Headers are the headers to attach to the request for URL sourced credentials. Headers map[string]string `json:"headers"` // Executable is the configuration object for executable sourced credentials. // One field amongst File, URL, Executable, or EnvironmentID should be provided, depending on the kind of credential in question. Executable ExecutableConfig `json:"executable"` // EnvironmentID is the EnvironmentID used for AWS sourced credentials. This should start with "AWS". // One field amongst File, URL, Executable, or EnvironmentID should be provided, depending on the kind of credential in question. EnvironmentID string `json:"environment_id"` // RegionURL is the metadata URL to retrieve the region from for EC2 AWS credentials. RegionURL string `json:"region_url"` // RegionalCredVerificationURL is the AWS regional credential verification URL, will default to // "https://sts.{region}.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15" if not provided." RegionalCredVerificationURL string `json:"regional_cred_verification_url"` // IMDSv2SessionTokenURL is the URL to retrieve the session token when using IMDSv2 in AWS. IMDSv2SessionTokenURL string `json:"imdsv2_session_token_url"` // Format is the format type for the subject token. Used for File and URL sourced credentials. Expected values are "text" or "json". Format Format `json:"format"` } // ExecutableConfig contains information needed for executable sourced credentials. type ExecutableConfig struct { // Command is the the full command to run to retrieve the subject token. // This can include arguments. Must be an absolute path for the program. Required. Command string `json:"command"` // TimeoutMillis is the timeout duration, in milliseconds. Defaults to 30000 milliseconds when not provided. Optional. TimeoutMillis int `json:"timeout_millis"` // OutputFile is the absolute path to the output file where the executable will cache the response. // If specified the auth libraries will first check this location before running the executable. Optional. OutputFile string `json:"output_file"` } // SubjectTokenSupplier can be used to supply a subject token to exchange for a GCP access token. type SubjectTokenSupplier interface { // SubjectToken should return a valid subject token or an error. // The external account token source does not cache the returned subject token, so caching // logic should be implemented in the supplier to prevent multiple requests for the same subject token. SubjectToken(ctx context.Context, options SupplierOptions) (string, error) } // AWSSecurityCredentialsSupplier can be used to supply AwsSecurityCredentials and an AWS Region to // exchange for a GCP access token. type AwsSecurityCredentialsSupplier interface { // AwsRegion should return the AWS region or an error. AwsRegion(ctx context.Context, options SupplierOptions) (string, error) // GetAwsSecurityCredentials should return a valid set of AwsSecurityCredentials or an error. // The external account token source does not cache the returned security credentials, so caching // logic should be implemented in the supplier to prevent multiple requests for the same security credentials. AwsSecurityCredentials(ctx context.Context, options SupplierOptions) (AwsSecurityCredentials, error) } // SupplierOptions contains information about the requested subject token or AWS security credentials from the // Google external account credential. type SupplierOptions struct { // Audience is the requested audience for the external account credential. Audience string // Subject token type is the requested subject token type for the external account credential. Expected values include: // “urn:ietf:params:oauth:token-type:jwt” // “urn:ietf:params:oauth:token-type:id-token” // “urn:ietf:params:oauth:token-type:saml2” // “urn:ietf:params:aws:token-type:aws4_request” SubjectTokenType string } // tokenURL returns the default STS token endpoint with the configured universe // domain. func (c Config) tokenURL() string { if c.UniverseDomain == "" { return strings.Replace(defaultTokenURL, universeDomainPlaceholder, defaultUniverseDomain, 1) } return strings.Replace(defaultTokenURL, universeDomainPlaceholder, c.UniverseDomain, 1) } // parse determines the type of CredentialSource needed. func (c Config) parse(ctx context.Context) (baseCredentialSource, error) { //set Defaults if c.TokenURL == "" { c.TokenURL = c.tokenURL() } supplierOptions := SupplierOptions{Audience: c.Audience, SubjectTokenType: c.SubjectTokenType} if c.AwsSecurityCredentialsSupplier != nil { awsCredSource := awsCredentialSource{ awsSecurityCredentialsSupplier: c.AwsSecurityCredentialsSupplier, targetResource: c.Audience, supplierOptions: supplierOptions, ctx: ctx, } return awsCredSource, nil } else if c.SubjectTokenSupplier != nil { return programmaticRefreshCredentialSource{subjectTokenSupplier: c.SubjectTokenSupplier, supplierOptions: supplierOptions, ctx: ctx}, nil } else if len(c.CredentialSource.EnvironmentID) > 3 && c.CredentialSource.EnvironmentID[:3] == "aws" { if awsVersion, err := strconv.Atoi(c.CredentialSource.EnvironmentID[3:]); err == nil { if awsVersion != 1 { return nil, fmt.Errorf("oauth2/google/externalaccount: aws version '%d' is not supported in the current build", awsVersion) } awsCredSource := awsCredentialSource{ environmentID: c.CredentialSource.EnvironmentID, regionURL: c.CredentialSource.RegionURL, regionalCredVerificationURL: c.CredentialSource.RegionalCredVerificationURL, credVerificationURL: c.CredentialSource.URL, targetResource: c.Audience, ctx: ctx, } if c.CredentialSource.IMDSv2SessionTokenURL != "" { awsCredSource.imdsv2SessionTokenURL = c.CredentialSource.IMDSv2SessionTokenURL } return awsCredSource, nil } } else if c.CredentialSource.File != "" { return fileCredentialSource{File: c.CredentialSource.File, Format: c.CredentialSource.Format}, nil } else if c.CredentialSource.URL != "" { return urlCredentialSource{URL: c.CredentialSource.URL, Headers: c.CredentialSource.Headers, Format: c.CredentialSource.Format, ctx: ctx}, nil } else if c.CredentialSource.Executable != nil { return createExecutableCredential(ctx, c.CredentialSource.Executable, c) } return nil, fmt.Errorf("oauth2/google/externalaccount: unable to parse credential source") } type baseCredentialSource interface { credentialSourceType() string subjectToken() (string, error) } // tokenSource is the source that handles external credentials. It is used to retrieve Tokens. type tokenSource struct { ctx context.Context conf Config } func getMetricsHeaderValue(conf Config, credSource baseCredentialSource) string { return fmt.Sprintf("gl-go/%s auth/%s google-byoid-sdk source/%s sa-impersonation/%t config-lifetime/%t", goVersion(), "unknown", credSource.credentialSourceType(), conf.ServiceAccountImpersonationURL != "", conf.ServiceAccountImpersonationLifetimeSeconds != 0) } // Token allows tokenSource to conform to the oauth2.TokenSource interface. func (ts tokenSource) Token() (oauth2.Token, error) { conf := ts.conf credSource, err := conf.parse(ts.ctx) if err != nil { return nil, err } subjectToken, err := credSource.subjectToken() if err != nil { return nil, err } stsRequest := stsexchange.TokenExchangeRequest{ GrantType: "urn:ietf:params:oauth:grant-type:token-exchange", Audience: conf.Audience, Scope: conf.Scopes, RequestedTokenType: "urn:ietf:params:oauth:token-type:access_token", SubjectToken: subjectToken, SubjectTokenType: conf.SubjectTokenType, } header := make(http.Header) header.Add("Content-Type", "application/x-www-form-urlencoded") header.Add("x-goog-api-client", getMetricsHeaderValue(conf, credSource)) clientAuth := stsexchange.ClientAuthentication{ AuthStyle: oauth2.AuthStyleInHeader, ClientID: conf.ClientID, ClientSecret: conf.ClientSecret, } var options map[string]interface{} // Do not pass workforce_pool_user_project when client authentication is used. // The client ID is sufficient for determining the user project. if conf.WorkforcePoolUserProject != "" && conf.ClientID == "" { options = map[string]interface{}{ "userProject": conf.WorkforcePoolUserProject, } } stsResp, err := stsexchange.ExchangeToken(ts.ctx, conf.TokenURL, &stsRequest, clientAuth, header, options) if err != nil { return nil, err } accessToken := &oauth2.Token{ AccessToken: stsResp.AccessToken, TokenType: stsResp.TokenType, } // The RFC8693 doesn't define the explicit 0 of "expires_in" field behavior. if stsResp.ExpiresIn <= 0 { return nil, fmt.Errorf("oauth2/google/externalaccount: got invalid expiry from security token service") } accessToken.Expiry = now().Add(time.Duration(stsResp.ExpiresIn) * time.Second) if stsResp.RefreshToken != "" { accessToken.RefreshToken = stsResp.RefreshToken } return accessToken, nil }	23.37 KB	2025-05-25 12:27
📄 basecredentials_test.go // Copyright 2020 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package externalaccount import ( "context" "encoding/json" "fmt" "io/ioutil" "net/http" "net/http/httptest" "testing" "time" "golang.org/x/oauth2" ) const ( textBaseCredPath = "testdata/3pi_cred.txt" jsonBaseCredPath = "testdata/3pi_cred.json" baseImpersonateCredsReqBody = "audience=32555940559.apps.googleusercontent.com&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Atoken-exchange&requested_token_type=urn%3Aietf%3Aparams%3Aoauth%3Atoken-type%3Aaccess_token&scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fcloud-platform&subject_token=street123&subject_token_type=urn%3Aietf%3Aparams%3Aoauth%3Atoken-type%3Ajwt" baseImpersonateCredsRespBody = `{"accessToken":"Second.Access.Token","expireTime":"2020-12-28T15:01:23Z"}` ) var testBaseCredSource = CredentialSource{ File: textBaseCredPath, Format: Format{Type: fileTypeText}, } var testConfig = Config{ Audience: "32555940559.apps.googleusercontent.com", SubjectTokenType: "urn:ietf:params:oauth:token-type:jwt", TokenInfoURL: "http://localhost:8080/v1/tokeninfo", ClientSecret: "notsosecret", ClientID: "rbrgnognrhongo3bi4gb9ghg9g", CredentialSource: &testBaseCredSource, Scopes: []string{"https://www.googleapis.com/auth/devstorage.full_control"}, } var ( baseCredsRequestBody = "audience=32555940559.apps.googleusercontent.com&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Atoken-exchange&requested_token_type=urn%3Aietf%3Aparams%3Aoauth%3Atoken-type%3Aaccess_token&scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fdevstorage.full_control&subject_token=street123&subject_token_type=urn%3Aietf%3Aparams%3Aoauth%3Atoken-type%3Aid_token" baseCredsResponseBody = `{"access_token":"Sample.Access.Token","issued_token_type":"urn:ietf:params:oauth:token-type:access_token","token_type":"Bearer","expires_in":3600,"scope":"https://www.googleapis.com/auth/cloud-platform"}` workforcePoolRequestBodyWithClientId = "audience=%2F%2Fiam.googleapis.com%2Flocations%2Feu%2FworkforcePools%2Fpool-id%2Fproviders%2Fprovider-id&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Atoken-exchange&requested_token_type=urn%3Aietf%3Aparams%3Aoauth%3Atoken-type%3Aaccess_token&scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fdevstorage.full_control&subject_token=street123&subject_token_type=urn%3Aietf%3Aparams%3Aoauth%3Atoken-type%3Aid_token" workforcePoolRequestBodyWithoutClientId = "audience=%2F%2Fiam.googleapis.com%2Flocations%2Feu%2FworkforcePools%2Fpool-id%2Fproviders%2Fprovider-id&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Atoken-exchange&options=%7B%22userProject%22%3A%22myProject%22%7D&requested_token_type=urn%3Aietf%3Aparams%3Aoauth%3Atoken-type%3Aaccess_token&scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fdevstorage.full_control&subject_token=street123&subject_token_type=urn%3Aietf%3Aparams%3Aoauth%3Atoken-type%3Aid_token" correctAT = "Sample.Access.Token" expiry int64 = 234852 ) var ( testNow = func() time.Time { return time.Unix(expiry, 0) } ) type testExchangeTokenServer struct { url string authorization string contentType string metricsHeader string body string response string } func run(t testing.T, config Config, tets testExchangeTokenServer) (oauth2.Token, error) { server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { if got, want := r.URL.String(), tets.url; got != want { t.Errorf("URL.String(): got %v but want %v", got, want) } headerAuth := r.Header.Get("Authorization") if got, want := headerAuth, tets.authorization; got != want { t.Errorf("got %v but want %v", got, want) } headerContentType := r.Header.Get("Content-Type") if got, want := headerContentType, tets.contentType; got != want { t.Errorf("got %v but want %v", got, want) } headerMetrics := r.Header.Get("x-goog-api-client") if got, want := headerMetrics, tets.metricsHeader; got != want { t.Errorf("got %v but want %v", got, want) } body, err := ioutil.ReadAll(r.Body) if err != nil { t.Fatalf("Failed reading request body: %s.", err) } if got, want := string(body), tets.body; got != want { t.Errorf("Unexpected exchange payload: got %v but want %v", got, want) } w.Header().Set("Content-Type", "application/json") w.Write([]byte(tets.response)) })) defer server.Close() config.TokenURL = server.URL oldNow := now defer func() { now = oldNow }() now = testNow ts := tokenSource{ ctx: context.Background(), conf: config, } return ts.Token() } func validateToken(t testing.T, tok oauth2.Token, expectToken oauth2.Token) { if expectToken == nil { return } if got, want := tok.AccessToken, expectToken.AccessToken; got != want { t.Errorf("Unexpected access token: got %v, but wanted %v", got, want) } if got, want := tok.TokenType, expectToken.TokenType; got != want { t.Errorf("Unexpected TokenType: got %v, but wanted %v", got, want) } if got, want := tok.Expiry, expectToken.Expiry; got != want { t.Errorf("Unexpected Expiry: got %v, but wanted %v", got, want) } } func createImpersonationServer(urlWanted, authWanted, bodyWanted, response string, t testing.T) httptest.Server { return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { if got, want := r.URL.String(), urlWanted; got != want { t.Errorf("URL.String(): got %v but want %v", got, want) } headerAuth := r.Header.Get("Authorization") if got, want := headerAuth, authWanted; got != want { t.Errorf("got %v but want %v", got, want) } headerContentType := r.Header.Get("Content-Type") if got, want := headerContentType, "application/json"; got != want { t.Errorf("got %v but want %v", got, want) } body, err := ioutil.ReadAll(r.Body) if err != nil { t.Fatalf("Failed reading request body: %v.", err) } if got, want := string(body), bodyWanted; got != want { t.Errorf("Unexpected impersonation payload: got %v but want %v", got, want) } w.Header().Set("Content-Type", "application/json") w.Write([]byte(response)) })) } func createTargetServer(metricsHeaderWanted string, t testing.T) httptest.Server { return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { if got, want := r.URL.String(), "/"; got != want { t.Errorf("URL.String(): got %v but want %v", got, want) } headerAuth := r.Header.Get("Authorization") if got, want := headerAuth, "Basic cmJyZ25vZ25yaG9uZ28zYmk0Z2I5Z2hnOWc6bm90c29zZWNyZXQ="; got != want { t.Errorf("got %v but want %v", got, want) } headerContentType := r.Header.Get("Content-Type") if got, want := headerContentType, "application/x-www-form-urlencoded"; got != want { t.Errorf("got %v but want %v", got, want) } headerMetrics := r.Header.Get("x-goog-api-client") if got, want := headerMetrics, metricsHeaderWanted; got != want { t.Errorf("got %v but want %v", got, want) } body, err := ioutil.ReadAll(r.Body) if err != nil { t.Fatalf("Failed reading request body: %v.", err) } if got, want := string(body), baseImpersonateCredsReqBody; got != want { t.Errorf("Unexpected exchange payload: got %v but want %v", got, want) } w.Header().Set("Content-Type", "application/json") w.Write([]byte(baseCredsResponseBody)) })) } func getExpectedMetricsHeader(source string, saImpersonation bool, configLifetime bool) string { return fmt.Sprintf("gl-go/%s auth/unknown google-byoid-sdk source/%s sa-impersonation/%t config-lifetime/%t", goVersion(), source, saImpersonation, configLifetime) } func TestToken(t testing.T) { type MockSTSResponse struct { AccessToken string `json:"access_token"` IssuedTokenType string `json:"issued_token_type"` TokenType string `json:"token_type"` ExpiresIn int32 `json:"expires_in,omitempty"` Scope string `json:"scopre,omitenpty"` } testCases := []struct { name string responseBody MockSTSResponse expectToken oauth2.Token expectErrorMsg string }{ { name: "happy case", responseBody: MockSTSResponse{ AccessToken: correctAT, IssuedTokenType: "urn:ietf:params:oauth:token-type:access_token", TokenType: "Bearer", ExpiresIn: 3600, Scope: "https://www.googleapis.com/auth/cloud-platform", }, expectToken: &oauth2.Token{ AccessToken: correctAT, TokenType: "Bearer", Expiry: testNow().Add(time.Duration(3600) * time.Second), }, }, { name: "no expiry time on token", responseBody: MockSTSResponse{ AccessToken: correctAT, IssuedTokenType: "urn:ietf:params:oauth:token-type:access_token", TokenType: "Bearer", Scope: "https://www.googleapis.com/auth/cloud-platform", }, expectToken: nil, expectErrorMsg: "oauth2/google/externalaccount: got invalid expiry from security token service", }, { name: "negative expiry time", responseBody: MockSTSResponse{ AccessToken: correctAT, IssuedTokenType: "urn:ietf:params:oauth:token-type:access_token", TokenType: "Bearer", ExpiresIn: -1, Scope: "https://www.googleapis.com/auth/cloud-platform", }, expectToken: nil, expectErrorMsg: "oauth2/google/externalaccount: got invalid expiry from security token service", }, } for _, testCase := range testCases { config := Config{ Audience: "32555940559.apps.googleusercontent.com", SubjectTokenType: "urn:ietf:params:oauth:token-type:id_token", ClientSecret: "notsosecret", ClientID: "rbrgnognrhongo3bi4gb9ghg9g", CredentialSource: &testBaseCredSource, Scopes: []string{"https://www.googleapis.com/auth/devstorage.full_control"}, } responseBody, err := json.Marshal(testCase.responseBody) if err != nil { t.Errorf("Invalid response received.") } server := testExchangeTokenServer{ url: "/", authorization: "Basic cmJyZ25vZ25yaG9uZ28zYmk0Z2I5Z2hnOWc6bm90c29zZWNyZXQ=", contentType: "application/x-www-form-urlencoded", metricsHeader: getExpectedMetricsHeader("file", false, false), body: baseCredsRequestBody, response: string(responseBody), } tok, err := run(t, &config, &server) if err != nil && err.Error() != testCase.expectErrorMsg { t.Errorf("Error not as expected: got = %v, and want = %v", err, testCase.expectErrorMsg) } validateToken(t, tok, testCase.expectToken) } } func TestWorkforcePoolTokenWithClientID(t testing.T) { config := Config{ Audience: "//iam.googleapis.com/locations/eu/workforcePools/pool-id/providers/provider-id", SubjectTokenType: "urn:ietf:params:oauth:token-type:id_token", ClientSecret: "notsosecret", ClientID: "rbrgnognrhongo3bi4gb9ghg9g", CredentialSource: &testBaseCredSource, Scopes: []string{"https://www.googleapis.com/auth/devstorage.full_control"}, WorkforcePoolUserProject: "myProject", } server := testExchangeTokenServer{ url: "/", authorization: "Basic cmJyZ25vZ25yaG9uZ28zYmk0Z2I5Z2hnOWc6bm90c29zZWNyZXQ=", contentType: "application/x-www-form-urlencoded", metricsHeader: getExpectedMetricsHeader("file", false, false), body: workforcePoolRequestBodyWithClientId, response: baseCredsResponseBody, } tok, err := run(t, &config, &server) if err != nil { t.Fatalf("Unexpected error: %e", err) } expectToken := oauth2.Token{ AccessToken: correctAT, TokenType: "Bearer", Expiry: testNow().Add(time.Duration(3600) time.Second), } validateToken(t, tok, &expectToken) } func TestWorkforcePoolTokenWithoutClientID(t testing.T) { config := Config{ Audience: "//iam.googleapis.com/locations/eu/workforcePools/pool-id/providers/provider-id", SubjectTokenType: "urn:ietf:params:oauth:token-type:id_token", ClientSecret: "notsosecret", CredentialSource: &testBaseCredSource, Scopes: []string{"https://www.googleapis.com/auth/devstorage.full_control"}, WorkforcePoolUserProject: "myProject", } server := testExchangeTokenServer{ url: "/", authorization: "", contentType: "application/x-www-form-urlencoded", metricsHeader: getExpectedMetricsHeader("file", false, false), body: workforcePoolRequestBodyWithoutClientId, response: baseCredsResponseBody, } tok, err := run(t, &config, &server) if err != nil { t.Fatalf("Unexpected error: %e", err) } expectToken := oauth2.Token{ AccessToken: correctAT, TokenType: "Bearer", Expiry: testNow().Add(time.Duration(3600) time.Second), } validateToken(t, tok, &expectToken) } func TestNonworkforceWithWorkforcePoolUserProject(t testing.T) { config := Config{ Audience: "32555940559.apps.googleusercontent.com", SubjectTokenType: "urn:ietf:params:oauth:token-type:id_token", TokenURL: "https://sts.googleapis.com", ClientSecret: "notsosecret", ClientID: "rbrgnognrhongo3bi4gb9ghg9g", CredentialSource: &testBaseCredSource, Scopes: []string{"https://www.googleapis.com/auth/devstorage.full_control"}, WorkforcePoolUserProject: "myProject", } _, err := NewTokenSource(context.Background(), config) if err == nil { t.Fatalf("Expected error but found none") } if got, want := err.Error(), "oauth2/google/externalaccount: Workforce pool user project should not be set for non-workforce pool credentials"; got != want { t.Errorf("Incorrect error received.\nExpected: %s\nRecieved: %s", want, got) } } func TestWorkforcePoolCreation(t testing.T) { var audienceValidatyTests = []struct { audience string expectSuccess bool }{ {"//iam.googleapis.com/locations/global/workforcePools/pool-id/providers/provider-id", true}, {"//iam.googleapis.com/locations/eu/workforcePools/pool-id/providers/provider-id", true}, {"//iam.googleapis.com/locations/eu/workforcePools/workloadIdentityPools/providers/provider-id", true}, {"identitynamespace:1f12345:my_provider", false}, {"//iam.googleapis.com/projects/123456/locations/global/workloadIdentityPools/pool-id/providers/provider-id", false}, {"//iam.googleapis.com/projects/123456/locations/eu/workloadIdentityPools/pool-id/providers/provider-id", false}, {"//iam.googleapis.com/projects/123456/locations/global/workloadIdentityPools/workforcePools/providers/provider-id", false}, {"//iamgoogleapis.com/locations/eu/workforcePools/pool-id/providers/provider-id", false}, {"//iam.googleapiscom/locations/eu/workforcePools/pool-id/providers/provider-id", false}, {"//iam.googleapis.com/locations/workforcePools/pool-id/providers/provider-id", false}, {"//iam.googleapis.com/locations/eu/workforcePool/pool-id/providers/provider-id", false}, {"//iam.googleapis.com/locations//workforcePool/pool-id/providers/provider-id", false}, } ctx := context.Background() for _, tt := range audienceValidatyTests { t.Run(" "+tt.audience, func(t testing.T) { // We prepend a space ahead of the test input when outputting for sake of readability. config := testConfig config.TokenURL = "https://sts.googleapis.com" // Setting the most basic acceptable tokenURL config.ServiceAccountImpersonationURL = "https://iamcredentials.googleapis.com" config.Audience = tt.audience config.WorkforcePoolUserProject = "myProject" _, err := NewTokenSource(ctx, config) if tt.expectSuccess && err != nil { t.Errorf("got %v but want nil", err) } else if !tt.expectSuccess && err == nil { t.Errorf("got nil but expected an error") } }) } } var impersonationTests = []struct { name string config Config expectedImpersonationBody string expectedMetricsHeader string }{ { name: "Base Impersonation", config: Config{ Audience: "32555940559.apps.googleusercontent.com", SubjectTokenType: "urn:ietf:params:oauth:token-type:jwt", TokenInfoURL: "http://localhost:8080/v1/tokeninfo", ClientSecret: "notsosecret", ClientID: "rbrgnognrhongo3bi4gb9ghg9g", CredentialSource: &testBaseCredSource, Scopes: []string{"https://www.googleapis.com/auth/devstorage.full_control"}, }, expectedImpersonationBody: "{\"lifetime\":\"3600s\",\"scope\":[\"https://www.googleapis.com/auth/devstorage.full_control\"]}", expectedMetricsHeader: getExpectedMetricsHeader("file", true, false), }, { name: "With TokenLifetime Set", config: Config{ Audience: "32555940559.apps.googleusercontent.com", SubjectTokenType: "urn:ietf:params:oauth:token-type:jwt", TokenInfoURL: "http://localhost:8080/v1/tokeninfo", ClientSecret: "notsosecret", ClientID: "rbrgnognrhongo3bi4gb9ghg9g", CredentialSource: &testBaseCredSource, Scopes: []string{"https://www.googleapis.com/auth/devstorage.full_control"}, ServiceAccountImpersonationLifetimeSeconds: 10000, }, expectedImpersonationBody: "{\"lifetime\":\"10000s\",\"scope\":[\"https://www.googleapis.com/auth/devstorage.full_control\"]}", expectedMetricsHeader: getExpectedMetricsHeader("file", true, true), }, } func TestImpersonation(t testing.T) { for _, tt := range impersonationTests { t.Run(tt.name, func(t testing.T) { testImpersonateConfig := tt.config impersonateServer := createImpersonationServer("/", "Bearer Sample.Access.Token", tt.expectedImpersonationBody, baseImpersonateCredsRespBody, t) defer impersonateServer.Close() testImpersonateConfig.ServiceAccountImpersonationURL = impersonateServer.URL targetServer := createTargetServer(tt.expectedMetricsHeader, t) defer targetServer.Close() testImpersonateConfig.TokenURL = targetServer.URL ourTS, err := testImpersonateConfig.tokenSource(context.Background(), "http") if err != nil { t.Fatalf("Failed to create TokenSource: %v", err) } oldNow := now defer func() { now = oldNow }() now = testNow tok, err := ourTS.Token() if err != nil { t.Fatalf("Unexpected error: %e", err) } if got, want := tok.AccessToken, "Second.Access.Token"; got != want { t.Errorf("Unexpected access token: got %v, but wanted %v", got, want) } if got, want := tok.TokenType, "Bearer"; got != want { t.Errorf("Unexpected TokenType: got %v, but wanted %v", got, want) } }) } } var newTokenTests = []struct { name string config Config }{ { name: "Missing Audience", config: Config{ SubjectTokenType: "urn:ietf:params:oauth:token-type:jwt", TokenInfoURL: "http://localhost:8080/v1/tokeninfo", ClientSecret: "notsosecret", ClientID: "rbrgnognrhongo3bi4gb9ghg9g", CredentialSource: &testBaseCredSource, Scopes: []string{"https://www.googleapis.com/auth/devstorage.full_control"}, ServiceAccountImpersonationLifetimeSeconds: 10000, }, }, { name: "Missing Subject Token Type", config: Config{ Audience: "32555940559.apps.googleusercontent.com", TokenInfoURL: "http://localhost:8080/v1/tokeninfo", ClientSecret: "notsosecret", ClientID: "rbrgnognrhongo3bi4gb9ghg9g", CredentialSource: &testBaseCredSource, Scopes: []string{"https://www.googleapis.com/auth/devstorage.full_control"}, ServiceAccountImpersonationLifetimeSeconds: 10000, }, }, { name: "No Cred Source", config: Config{ Audience: "32555940559.apps.googleusercontent.com", SubjectTokenType: "urn:ietf:params:oauth:token-type:jwt", TokenInfoURL: "http://localhost:8080/v1/tokeninfo", ClientSecret: "notsosecret", ClientID: "rbrgnognrhongo3bi4gb9ghg9g", Scopes: []string{"https://www.googleapis.com/auth/devstorage.full_control"}, ServiceAccountImpersonationLifetimeSeconds: 10000, }, }, { name: "Cred Source and Supplier", config: Config{ Audience: "32555940559.apps.googleusercontent.com", SubjectTokenType: "urn:ietf:params:oauth:token-type:jwt", TokenInfoURL: "http://localhost:8080/v1/tokeninfo", CredentialSource: &testBaseCredSource, AwsSecurityCredentialsSupplier: testAwsSupplier{}, ClientSecret: "notsosecret", ClientID: "rbrgnognrhongo3bi4gb9ghg9g", Scopes: []string{"https://www.googleapis.com/auth/devstorage.full_control"}, ServiceAccountImpersonationLifetimeSeconds: 10000, }, }, } func TestNewToken(t testing.T) { for _, tt := range newTokenTests { t.Run(tt.name, func(t testing.T) { testConfig := tt.config _, err := NewTokenSource(context.Background(), testConfig) if err == nil { t.Fatalf("expected error when calling NewToken()") } }) } } func TestConfig_TokenURL(t testing.T) { tests := []struct { tokenURL string universeDomain string want string }{ { tokenURL: "https://sts.googleapis.com/v1/token", universeDomain: "", want: "https://sts.googleapis.com/v1/token", }, { tokenURL: "", universeDomain: "", want: "https://sts.googleapis.com/v1/token", }, { tokenURL: "", universeDomain: "googleapis.com", want: "https://sts.googleapis.com/v1/token", }, { tokenURL: "", universeDomain: "example.com", want: "https://sts.example.com/v1/token", }, } for _, tt := range tests { config := &Config{ Audience: "//iam.googleapis.com/locations/eu/workforcePools/pool-id/providers/provider-id", SubjectTokenType: "urn:ietf:params:oauth:token-type:id_token", CredentialSource: &testBaseCredSource, Scopes: []string{"https://www.googleapis.com/auth/devstorage.full_control"}, } config.TokenURL = tt.tokenURL config.UniverseDomain = tt.universeDomain config.parse(context.Background()) if got := config.TokenURL; got != tt.want { t.Errorf("got %q, want %q", got, tt.want) } } }	21.88 KB	2025-05-25 12:27
📄 executablecredsource.go // Copyright 2022 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package externalaccount import ( "bytes" "context" "encoding/json" "errors" "fmt" "io" "io/ioutil" "os" "os/exec" "regexp" "strings" "time" ) var serviceAccountImpersonationRE = regexp.MustCompile("https://iamcredentials\\..+/v1/projects/-/serviceAccounts/(.@.):generateAccessToken") const ( executableSupportedMaxVersion = 1 defaultTimeout = 30 * time.Second timeoutMinimum = 5 * time.Second timeoutMaximum = 120 * time.Second executableSource = "response" outputFileSource = "output file" ) type nonCacheableError struct { message string } func (nce nonCacheableError) Error() string { return nce.message } func missingFieldError(source, field string) error { return fmt.Errorf("oauth2/google/externalaccount: %v missing `%q` field", source, field) } func jsonParsingError(source, data string) error { return fmt.Errorf("oauth2/google/externalaccount: unable to parse %v\nResponse: %v", source, data) } func malformedFailureError() error { return nonCacheableError{"oauth2/google/externalaccount: response must include `error` and `message` fields when unsuccessful"} } func userDefinedError(code, message string) error { return nonCacheableError{fmt.Sprintf("oauth2/google/externalaccount: response contains unsuccessful response: (%v) %v", code, message)} } func unsupportedVersionError(source string, version int) error { return fmt.Errorf("oauth2/google/externalaccount: %v contains unsupported version: %v", source, version) } func tokenExpiredError() error { return nonCacheableError{"oauth2/google/externalaccount: the token returned by the executable is expired"} } func tokenTypeError(source string) error { return fmt.Errorf("oauth2/google/externalaccount: %v contains unsupported token type", source) } func exitCodeError(exitCode int) error { return fmt.Errorf("oauth2/google/externalaccount: executable command failed with exit code %v", exitCode) } func executableError(err error) error { return fmt.Errorf("oauth2/google/externalaccount: executable command failed: %v", err) } func executablesDisallowedError() error { return errors.New("oauth2/google/externalaccount: executables need to be explicitly allowed (set GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES to '1') to run") } func timeoutRangeError() error { return errors.New("oauth2/google/externalaccount: invalid `timeout_millis` field — executable timeout must be between 5 and 120 seconds") } func commandMissingError() error { return errors.New("oauth2/google/externalaccount: missing `command` field — executable command must be provided") } type environment interface { existingEnv() []string getenv(string) string run(ctx context.Context, command string, env []string) ([]byte, error) now() time.Time } type runtimeEnvironment struct{} func (r runtimeEnvironment) existingEnv() []string { return os.Environ() } func (r runtimeEnvironment) getenv(key string) string { return os.Getenv(key) } func (r runtimeEnvironment) now() time.Time { return time.Now().UTC() } func (r runtimeEnvironment) run(ctx context.Context, command string, env []string) ([]byte, error) { splitCommand := strings.Fields(command) cmd := exec.CommandContext(ctx, splitCommand[0], splitCommand[1:]...) cmd.Env = env var stdout, stderr bytes.Buffer cmd.Stdout = &stdout cmd.Stderr = &stderr if err := cmd.Run(); err != nil { if ctx.Err() == context.DeadlineExceeded { return nil, context.DeadlineExceeded } if exitError, ok := err.(exec.ExitError); ok { return nil, exitCodeError(exitError.ExitCode()) } return nil, executableError(err) } bytesStdout := bytes.TrimSpace(stdout.Bytes()) if len(bytesStdout) > 0 { return bytesStdout, nil } return bytes.TrimSpace(stderr.Bytes()), nil } type executableCredentialSource struct { Command string Timeout time.Duration OutputFile string ctx context.Context config Config env environment } // CreateExecutableCredential creates an executableCredentialSource given an ExecutableConfig. // It also performs defaulting and type conversions. func createExecutableCredential(ctx context.Context, ec ExecutableConfig, config Config) (executableCredentialSource, error) { if ec.Command == "" { return executableCredentialSource{}, commandMissingError() } result := executableCredentialSource{} result.Command = ec.Command if ec.TimeoutMillis == nil { result.Timeout = defaultTimeout } else { result.Timeout = time.Duration(ec.TimeoutMillis) time.Millisecond if result.Timeout < timeoutMinimum \|\| result.Timeout > timeoutMaximum { return executableCredentialSource{}, timeoutRangeError() } } result.OutputFile = ec.OutputFile result.ctx = ctx result.config = config result.env = runtimeEnvironment{} return result, nil } type executableResponse struct { Version int `json:"version,omitempty"` Success bool `json:"success,omitempty"` TokenType string `json:"token_type,omitempty"` ExpirationTime int64 `json:"expiration_time,omitempty"` IdToken string `json:"id_token,omitempty"` SamlResponse string `json:"saml_response,omitempty"` Code string `json:"code,omitempty"` Message string `json:"message,omitempty"` } func (cs executableCredentialSource) parseSubjectTokenFromSource(response []byte, source string, now int64) (string, error) { var result executableResponse if err := json.Unmarshal(response, &result); err != nil { return "", jsonParsingError(source, string(response)) } if result.Version == 0 { return "", missingFieldError(source, "version") } if result.Success == nil { return "", missingFieldError(source, "success") } if !result.Success { if result.Code == "" \|\| result.Message == "" { return "", malformedFailureError() } return "", userDefinedError(result.Code, result.Message) } if result.Version > executableSupportedMaxVersion \|\| result.Version < 0 { return "", unsupportedVersionError(source, result.Version) } if result.ExpirationTime == 0 && cs.OutputFile != "" { return "", missingFieldError(source, "expiration_time") } if result.TokenType == "" { return "", missingFieldError(source, "token_type") } if result.ExpirationTime != 0 && result.ExpirationTime < now { return "", tokenExpiredError() } if result.TokenType == "urn:ietf:params:oauth:token-type:jwt" \|\| result.TokenType == "urn:ietf:params:oauth:token-type:id_token" { if result.IdToken == "" { return "", missingFieldError(source, "id_token") } return result.IdToken, nil } if result.TokenType == "urn:ietf:params:oauth:token-type:saml2" { if result.SamlResponse == "" { return "", missingFieldError(source, "saml_response") } return result.SamlResponse, nil } return "", tokenTypeError(source) } func (cs executableCredentialSource) credentialSourceType() string { return "executable" } func (cs executableCredentialSource) subjectToken() (string, error) { if token, err := cs.getTokenFromOutputFile(); token != "" \|\| err != nil { return token, err } return cs.getTokenFromExecutableCommand() } func (cs executableCredentialSource) getTokenFromOutputFile() (token string, err error) { if cs.OutputFile == "" { // This ExecutableCredentialSource doesn't use an OutputFile. return "", nil } file, err := os.Open(cs.OutputFile) if err != nil { // No OutputFile found. Hasn't been created yet, so skip it. return "", nil } defer file.Close() data, err := ioutil.ReadAll(io.LimitReader(file, 1<<20)) if err != nil \|\| len(data) == 0 { // Cachefile exists, but no data found. Get new credential. return "", nil } token, err = cs.parseSubjectTokenFromSource(data, outputFileSource, cs.env.now().Unix()) if err != nil { if _, ok := err.(nonCacheableError); ok { // If the cached token is expired we need a new token, // and if the cache contains a failure, we need to try again. return "", nil } // There was an error in the cached token, and the developer should be aware of it. return "", err } // Token parsing succeeded. Use found token. return token, nil } func (cs executableCredentialSource) executableEnvironment() []string { result := cs.env.existingEnv() result = append(result, fmt.Sprintf("GOOGLE_EXTERNAL_ACCOUNT_AUDIENCE=%v", cs.config.Audience)) result = append(result, fmt.Sprintf("GOOGLE_EXTERNAL_ACCOUNT_TOKEN_TYPE=%v", cs.config.SubjectTokenType)) result = append(result, "GOOGLE_EXTERNAL_ACCOUNT_INTERACTIVE=0") if cs.config.ServiceAccountImpersonationURL != "" { matches := serviceAccountImpersonationRE.FindStringSubmatch(cs.config.ServiceAccountImpersonationURL) if matches != nil { result = append(result, fmt.Sprintf("GOOGLE_EXTERNAL_ACCOUNT_IMPERSONATED_EMAIL=%v", matches[1])) } } if cs.OutputFile != "" { result = append(result, fmt.Sprintf("GOOGLE_EXTERNAL_ACCOUNT_OUTPUT_FILE=%v", cs.OutputFile)) } return result } func (cs executableCredentialSource) getTokenFromExecutableCommand() (string, error) { // For security reasons, we need our consumers to set this environment variable to allow executables to be run. if cs.env.getenv("GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES") != "1" { return "", executablesDisallowedError() } ctx, cancel := context.WithDeadline(cs.ctx, cs.env.now().Add(cs.Timeout)) defer cancel() output, err := cs.env.run(ctx, cs.Command, cs.executableEnvironment()) if err != nil { return "", err } return cs.parseSubjectTokenFromSource(output, executableSource, cs.env.now().Unix()) }	9.5 KB	2025-05-25 12:27
📄 executablecredsource_test.go // Copyright 2022 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package externalaccount import ( "context" "encoding/json" "fmt" "io/ioutil" "os" "sort" "testing" "time" "github.com/google/go-cmp/cmp" ) type testEnvironment struct { envVars map[string]string deadline time.Time deadlineSet bool byteResponse []byte jsonResponse executableResponse } var executablesAllowed = map[string]string{ "GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES": "1", } func (t testEnvironment) existingEnv() []string { result := []string{} for k, v := range t.envVars { result = append(result, fmt.Sprintf("%v=%v", k, v)) } return result } func (t testEnvironment) getenv(key string) string { return t.envVars[key] } func (t testEnvironment) run(ctx context.Context, command string, env []string) ([]byte, error) { t.deadline, t.deadlineSet = ctx.Deadline() if t.jsonResponse != nil { return json.Marshal(t.jsonResponse) } return t.byteResponse, nil } func (t testEnvironment) getDeadline() (time.Time, bool) { return t.deadline, t.deadlineSet } func (t testEnvironment) now() time.Time { return defaultTime } func Bool(b bool) bool { return &b } func Int(i int) int { return &i } var creationTests = []struct { name string executableConfig ExecutableConfig expectedErr error expectedTimeout time.Duration }{ { name: "Basic Creation", executableConfig: ExecutableConfig{ Command: "blarg", TimeoutMillis: Int(50000), }, expectedTimeout: 50000 * time.Millisecond, }, { name: "Without Timeout", executableConfig: ExecutableConfig{ Command: "blarg", }, expectedTimeout: 30000 * time.Millisecond, }, { name: "Without Command", executableConfig: ExecutableConfig{}, expectedErr: commandMissingError(), }, { name: "Timeout Too Low", executableConfig: ExecutableConfig{ Command: "blarg", TimeoutMillis: Int(4999), }, expectedErr: timeoutRangeError(), }, { name: "Timeout Lower Bound", executableConfig: ExecutableConfig{ Command: "blarg", TimeoutMillis: Int(5000), }, expectedTimeout: 5000 * time.Millisecond, }, { name: "Timeout Upper Bound", executableConfig: ExecutableConfig{ Command: "blarg", TimeoutMillis: Int(120000), }, expectedTimeout: 120000 * time.Millisecond, }, { name: "Timeout Too High", executableConfig: ExecutableConfig{ Command: "blarg", TimeoutMillis: Int(120001), }, expectedErr: timeoutRangeError(), }, } func TestCreateExecutableCredential(t testing.T) { for _, tt := range creationTests { t.Run(tt.name, func(t testing.T) { ecs, err := createExecutableCredential(context.Background(), &tt.executableConfig, nil) if tt.expectedErr != nil { if err == nil { t.Fatalf("Expected error but found none") } if got, want := err.Error(), tt.expectedErr.Error(); got != want { t.Errorf("Incorrect error received.\nReceived: %s\nExpected: %s", got, want) } } else if err != nil { ecJson := "{???}" if ecBytes, err2 := json.Marshal(tt.executableConfig); err2 != nil { ecJson = string(ecBytes) } t.Fatalf("CreateExecutableCredential with %v returned error: %v", ecJson, err) } else { if ecs.Command != "blarg" { t.Errorf("ecs.Command got %v but want %v", ecs.Command, "blarg") } if ecs.Timeout != tt.expectedTimeout { t.Errorf("ecs.Timeout got %v but want %v", ecs.Timeout, tt.expectedTimeout) } if ecs.credentialSourceType() != "executable" { t.Errorf("ecs.CredentialSourceType() got %s but want executable", ecs.credentialSourceType()) } } }) } } var getEnvironmentTests = []struct { name string config Config environment testEnvironment expectedEnvironment []string }{ { name: "Minimal Executable Config", config: Config{ Audience: "//iam.googleapis.com/projects/123/locations/global/workloadIdentityPools/pool/providers/oidc", SubjectTokenType: "urn:ietf:params:oauth:token-type:jwt", CredentialSource: &CredentialSource{ Executable: &ExecutableConfig{ Command: "blarg", }, }, }, environment: testEnvironment{ envVars: map[string]string{ "A": "B", }, }, expectedEnvironment: []string{ "A=B", "GOOGLE_EXTERNAL_ACCOUNT_AUDIENCE=//iam.googleapis.com/projects/123/locations/global/workloadIdentityPools/pool/providers/oidc", "GOOGLE_EXTERNAL_ACCOUNT_TOKEN_TYPE=urn:ietf:params:oauth:token-type:jwt", "GOOGLE_EXTERNAL_ACCOUNT_INTERACTIVE=0", }, }, { name: "Full Impersonation URL", config: Config{ Audience: "//iam.googleapis.com/projects/123/locations/global/workloadIdentityPools/pool/providers/oidc", ServiceAccountImpersonationURL: "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/test@project.iam.gserviceaccount.com:generateAccessToken", SubjectTokenType: "urn:ietf:params:oauth:token-type:jwt", CredentialSource: &CredentialSource{ Executable: &ExecutableConfig{ Command: "blarg", OutputFile: "/path/to/generated/cached/credentials", }, }, }, environment: testEnvironment{ envVars: map[string]string{ "A": "B", }, }, expectedEnvironment: []string{ "A=B", "GOOGLE_EXTERNAL_ACCOUNT_AUDIENCE=//iam.googleapis.com/projects/123/locations/global/workloadIdentityPools/pool/providers/oidc", "GOOGLE_EXTERNAL_ACCOUNT_TOKEN_TYPE=urn:ietf:params:oauth:token-type:jwt", "GOOGLE_EXTERNAL_ACCOUNT_IMPERSONATED_EMAIL=test@project.iam.gserviceaccount.com", "GOOGLE_EXTERNAL_ACCOUNT_INTERACTIVE=0", "GOOGLE_EXTERNAL_ACCOUNT_OUTPUT_FILE=/path/to/generated/cached/credentials", }, }, { name: "Impersonation Email", config: Config{ Audience: "//iam.googleapis.com/projects/123/locations/global/workloadIdentityPools/pool/providers/oidc", ServiceAccountImpersonationURL: "test@project.iam.gserviceaccount.com", SubjectTokenType: "urn:ietf:params:oauth:token-type:jwt", CredentialSource: &CredentialSource{ Executable: &ExecutableConfig{ Command: "blarg", OutputFile: "/path/to/generated/cached/credentials", }, }, }, environment: testEnvironment{ envVars: map[string]string{ "A": "B", }, }, expectedEnvironment: []string{ "A=B", "GOOGLE_EXTERNAL_ACCOUNT_AUDIENCE=//iam.googleapis.com/projects/123/locations/global/workloadIdentityPools/pool/providers/oidc", "GOOGLE_EXTERNAL_ACCOUNT_TOKEN_TYPE=urn:ietf:params:oauth:token-type:jwt", "GOOGLE_EXTERNAL_ACCOUNT_INTERACTIVE=0", "GOOGLE_EXTERNAL_ACCOUNT_OUTPUT_FILE=/path/to/generated/cached/credentials", }, }, } func TestExecutableCredentialGetEnvironment(t testing.T) { for _, tt := range getEnvironmentTests { t.Run(tt.name, func(t testing.T) { config := tt.config ecs, err := createExecutableCredential(context.Background(), config.CredentialSource.Executable, &config) if err != nil { t.Fatalf("creation failed %v", err) } ecs.env = &tt.environment // This Transformer sorts a []string. sorter := cmp.Transformer("Sort", func(in []string) []string { out := append([]string(nil), in...) // Copy input to avoid mutating it sort.Strings(out) return out }) if got, want := ecs.executableEnvironment(), tt.expectedEnvironment; !cmp.Equal(got, want, sorter) { t.Errorf("Incorrect environment received.\nReceived: %s\nExpected: %s", got, want) } }) } } var failureTests = []struct { name string testEnvironment testEnvironment noExecution bool expectedErr error }{ { name: "Environment Variable Not Set", testEnvironment: testEnvironment{ byteResponse: []byte{}, }, noExecution: true, expectedErr: executablesDisallowedError(), }, { name: "Invalid Token", testEnvironment: testEnvironment{ envVars: executablesAllowed, byteResponse: []byte("tokentokentoken"), }, expectedErr: jsonParsingError(executableSource, "tokentokentoken"), }, { name: "Version Field Missing", testEnvironment: testEnvironment{ envVars: executablesAllowed, jsonResponse: &executableResponse{ Success: Bool(true), }, }, expectedErr: missingFieldError(executableSource, "version"), }, { name: "Success Field Missing", testEnvironment: testEnvironment{ envVars: executablesAllowed, jsonResponse: &executableResponse{ Version: 1, }, }, expectedErr: missingFieldError(executableSource, "success"), }, { name: "User defined error", testEnvironment: testEnvironment{ envVars: executablesAllowed, jsonResponse: &executableResponse{ Success: Bool(false), Version: 1, Code: "404", Message: "Token Not Found", }, }, expectedErr: userDefinedError("404", "Token Not Found"), }, { name: "User defined error without code", testEnvironment: testEnvironment{ envVars: executablesAllowed, jsonResponse: &executableResponse{ Success: Bool(false), Version: 1, Message: "Token Not Found", }, }, expectedErr: malformedFailureError(), }, { name: "User defined error without message", testEnvironment: testEnvironment{ envVars: executablesAllowed, jsonResponse: &executableResponse{ Success: Bool(false), Version: 1, Code: "404", }, }, expectedErr: malformedFailureError(), }, { name: "User defined error without fields", testEnvironment: testEnvironment{ envVars: executablesAllowed, jsonResponse: &executableResponse{ Success: Bool(false), Version: 1, }, }, expectedErr: malformedFailureError(), }, { name: "Newer Version", testEnvironment: testEnvironment{ envVars: executablesAllowed, jsonResponse: &executableResponse{ Success: Bool(true), Version: 2, }, }, expectedErr: unsupportedVersionError(executableSource, 2), }, { name: "Missing Token Type", testEnvironment: testEnvironment{ envVars: executablesAllowed, jsonResponse: &executableResponse{ Success: Bool(true), Version: 1, ExpirationTime: defaultTime.Unix(), }, }, expectedErr: missingFieldError(executableSource, "token_type"), }, { name: "Token Expired", testEnvironment: testEnvironment{ envVars: executablesAllowed, jsonResponse: &executableResponse{ Success: Bool(true), Version: 1, ExpirationTime: defaultTime.Unix() - 1, TokenType: "urn:ietf:params:oauth:token-type:jwt", }, }, expectedErr: tokenExpiredError(), }, { name: "Invalid Token Type", testEnvironment: testEnvironment{ envVars: executablesAllowed, jsonResponse: &executableResponse{ Success: Bool(true), Version: 1, ExpirationTime: defaultTime.Unix(), TokenType: "urn:ietf:params:oauth:token-type:invalid", }, }, expectedErr: tokenTypeError(executableSource), }, { name: "Missing JWT", testEnvironment: testEnvironment{ envVars: executablesAllowed, jsonResponse: &executableResponse{ Success: Bool(true), Version: 1, ExpirationTime: defaultTime.Unix(), TokenType: "urn:ietf:params:oauth:token-type:jwt", }, }, expectedErr: missingFieldError(executableSource, "id_token"), }, { name: "Missing ID Token", testEnvironment: testEnvironment{ envVars: executablesAllowed, jsonResponse: &executableResponse{ Success: Bool(true), Version: 1, ExpirationTime: defaultTime.Unix(), TokenType: "urn:ietf:params:oauth:token-type:id_token", }, }, expectedErr: missingFieldError(executableSource, "id_token"), }, { name: "Missing SAML Token", testEnvironment: testEnvironment{ envVars: executablesAllowed, jsonResponse: &executableResponse{ Success: Bool(true), Version: 1, ExpirationTime: defaultTime.Unix(), TokenType: "urn:ietf:params:oauth:token-type:saml2", }, }, expectedErr: missingFieldError(executableSource, "saml_response"), }, } func TestRetrieveExecutableSubjectTokenExecutableErrors(t testing.T) { cs := CredentialSource{ Executable: &ExecutableConfig{ Command: "blarg", TimeoutMillis: Int(5000), }, } tfc := testFileConfig tfc.CredentialSource = &cs base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } ecs, ok := base.(executableCredentialSource) if !ok { t.Fatalf("Wrong credential type created.") } for _, tt := range failureTests { t.Run(tt.name, func(t testing.T) { ecs.env = &tt.testEnvironment if _, err = ecs.subjectToken(); err == nil { t.Fatalf("Expected error but found none") } else if got, want := err.Error(), tt.expectedErr.Error(); got != want { t.Errorf("Incorrect error received.\nReceived: %s\nExpected: %s", got, want) } deadline, deadlineSet := tt.testEnvironment.getDeadline() if tt.noExecution { if deadlineSet { t.Errorf("Executable called when it should not have been") } } else { if !deadlineSet { t.Errorf("Command run without a deadline") } else if deadline != defaultTime.Add(5time.Second) { t.Errorf("Command run with incorrect deadline") } } }) } } var successTests = []struct { name string testEnvironment testEnvironment }{ { name: "JWT", testEnvironment: testEnvironment{ envVars: executablesAllowed, jsonResponse: &executableResponse{ Success: Bool(true), Version: 1, ExpirationTime: defaultTime.Unix() + 3600, TokenType: "urn:ietf:params:oauth:token-type:jwt", IdToken: "tokentokentoken", }, }, }, { name: "ID Token", testEnvironment: testEnvironment{ envVars: executablesAllowed, jsonResponse: &executableResponse{ Success: Bool(true), Version: 1, ExpirationTime: defaultTime.Unix() + 3600, TokenType: "urn:ietf:params:oauth:token-type:id_token", IdToken: "tokentokentoken", }, }, }, { name: "SAML", testEnvironment: testEnvironment{ envVars: executablesAllowed, jsonResponse: &executableResponse{ Success: Bool(true), Version: 1, ExpirationTime: defaultTime.Unix() + 3600, TokenType: "urn:ietf:params:oauth:token-type:saml2", SamlResponse: "tokentokentoken", }, }, }, { name: "Missing Expiration", testEnvironment: testEnvironment{ envVars: executablesAllowed, jsonResponse: &executableResponse{ Success: Bool(true), Version: 1, TokenType: "urn:ietf:params:oauth:token-type:jwt", IdToken: "tokentokentoken", }, }, }, } func TestRetrieveExecutableSubjectTokenSuccesses(t testing.T) { cs := CredentialSource{ Executable: &ExecutableConfig{ Command: "blarg", TimeoutMillis: Int(5000), }, } tfc := testFileConfig tfc.CredentialSource = &cs base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } ecs, ok := base.(executableCredentialSource) if !ok { t.Fatalf("Wrong credential type created.") } for _, tt := range successTests { t.Run(tt.name, func(t testing.T) { ecs.env = &tt.testEnvironment out, err := ecs.subjectToken() if err != nil { t.Fatalf("retrieveSubjectToken() failed: %v", err) } deadline, deadlineSet := tt.testEnvironment.getDeadline() if !deadlineSet { t.Errorf("Command run without a deadline") } else if deadline != defaultTime.Add(5time.Second) { t.Errorf("Command run with incorrect deadline") } if got, want := out, "tokentokentoken"; got != want { t.Errorf("Incorrect token received.\nReceived: %s\nExpected: %s", got, want) } }) } } func TestRetrieveOutputFileSubjectTokenNotJSON(t testing.T) { outputFile, err := ioutil.TempFile("testdata", "result..json") if err != nil { t.Fatalf("Tempfile failed: %v", err) } defer os.Remove(outputFile.Name()) cs := CredentialSource{ Executable: &ExecutableConfig{ Command: "blarg", TimeoutMillis: Int(5000), OutputFile: outputFile.Name(), }, } tfc := testFileConfig tfc.CredentialSource = &cs base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } ecs, ok := base.(executableCredentialSource) if !ok { t.Fatalf("Wrong credential type created.") } if _, err = outputFile.Write([]byte("tokentokentoken")); err != nil { t.Fatalf("error writing to file: %v", err) } te := testEnvironment{ envVars: executablesAllowed, byteResponse: []byte{}, } ecs.env = &te if _, err = base.subjectToken(); err == nil { t.Fatalf("Expected error but found none") } else if got, want := err.Error(), jsonParsingError(outputFileSource, "tokentokentoken").Error(); got != want { t.Errorf("Incorrect error received.\nExpected: %s\nRecieved: %s", want, got) } _, deadlineSet := te.getDeadline() if deadlineSet { t.Errorf("Executable called when it should not have been") } } // These are errors in the output file that should be reported to the user. // Most of these will help the developers debug their code. var cacheFailureTests = []struct { name string outputFileContents executableResponse expectedErr error }{ { name: "Missing Version", outputFileContents: executableResponse{ Success: Bool(true), }, expectedErr: missingFieldError(outputFileSource, "version"), }, { name: "Missing Success", outputFileContents: executableResponse{ Version: 1, }, expectedErr: missingFieldError(outputFileSource, "success"), }, { name: "Newer Version", outputFileContents: executableResponse{ Success: Bool(true), Version: 2, }, expectedErr: unsupportedVersionError(outputFileSource, 2), }, { name: "Missing Token Type", outputFileContents: executableResponse{ Success: Bool(true), Version: 1, ExpirationTime: defaultTime.Unix(), }, expectedErr: missingFieldError(outputFileSource, "token_type"), }, { name: "Missing Expiration", outputFileContents: executableResponse{ Success: Bool(true), Version: 1, TokenType: "urn:ietf:params:oauth:token-type:jwt", }, expectedErr: missingFieldError(outputFileSource, "expiration_time"), }, { name: "Invalid Token Type", outputFileContents: executableResponse{ Success: Bool(true), Version: 1, ExpirationTime: defaultTime.Unix(), TokenType: "urn:ietf:params:oauth:token-type:invalid", }, expectedErr: tokenTypeError(outputFileSource), }, { name: "Missing JWT", outputFileContents: executableResponse{ Success: Bool(true), Version: 1, ExpirationTime: defaultTime.Unix() + 3600, TokenType: "urn:ietf:params:oauth:token-type:jwt", }, expectedErr: missingFieldError(outputFileSource, "id_token"), }, { name: "Missing ID Token", outputFileContents: executableResponse{ Success: Bool(true), Version: 1, ExpirationTime: defaultTime.Unix() + 3600, TokenType: "urn:ietf:params:oauth:token-type:id_token", }, expectedErr: missingFieldError(outputFileSource, "id_token"), }, { name: "Missing SAML", outputFileContents: executableResponse{ Success: Bool(true), Version: 1, ExpirationTime: defaultTime.Unix() + 3600, TokenType: "urn:ietf:params:oauth:token-type:jwt", }, expectedErr: missingFieldError(outputFileSource, "id_token"), }, } func TestRetrieveOutputFileSubjectTokenFailureTests(t testing.T) { for _, tt := range cacheFailureTests { t.Run(tt.name, func(t testing.T) { outputFile, err := ioutil.TempFile("testdata", "result..json") if err != nil { t.Fatalf("Tempfile failed: %v", err) } defer os.Remove(outputFile.Name()) cs := CredentialSource{ Executable: &ExecutableConfig{ Command: "blarg", TimeoutMillis: Int(5000), OutputFile: outputFile.Name(), }, } tfc := testFileConfig tfc.CredentialSource = &cs base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } ecs, ok := base.(executableCredentialSource) if !ok { t.Fatalf("Wrong credential type created.") } te := testEnvironment{ envVars: executablesAllowed, byteResponse: []byte{}, } ecs.env = &te if err = json.NewEncoder(outputFile).Encode(tt.outputFileContents); err != nil { t.Errorf("Error encoding to file: %v", err) return } if _, err = ecs.subjectToken(); err == nil { t.Errorf("Expected error but found none") } else if got, want := err.Error(), tt.expectedErr.Error(); got != want { t.Errorf("Incorrect error received.\nExpected: %s\nRecieved: %s", want, got) } if _, deadlineSet := te.getDeadline(); deadlineSet { t.Errorf("Executable called when it should not have been") } }) } } // These tests should ignore the error in the output file, and check the executable. var invalidCacheTests = []struct { name string outputFileContents executableResponse }{ { name: "User Defined Error", outputFileContents: executableResponse{ Success: Bool(false), Version: 1, Code: "404", Message: "Token Not Found", }, }, { name: "User Defined Error without Code", outputFileContents: executableResponse{ Success: Bool(false), Version: 1, Message: "Token Not Found", }, }, { name: "User Defined Error without Message", outputFileContents: executableResponse{ Success: Bool(false), Version: 1, Code: "404", }, }, { name: "User Defined Error without Fields", outputFileContents: executableResponse{ Success: Bool(false), Version: 1, }, }, { name: "Expired Token", outputFileContents: executableResponse{ Success: Bool(true), Version: 1, ExpirationTime: defaultTime.Unix() - 1, TokenType: "urn:ietf:params:oauth:token-type:jwt", }, }, } func TestRetrieveOutputFileSubjectTokenInvalidCache(t testing.T) { for _, tt := range invalidCacheTests { t.Run(tt.name, func(t testing.T) { outputFile, err := ioutil.TempFile("testdata", "result..json") if err != nil { t.Fatalf("Tempfile failed: %v", err) } defer os.Remove(outputFile.Name()) cs := CredentialSource{ Executable: &ExecutableConfig{ Command: "blarg", TimeoutMillis: Int(5000), OutputFile: outputFile.Name(), }, } tfc := testFileConfig tfc.CredentialSource = &cs base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } te := testEnvironment{ envVars: executablesAllowed, jsonResponse: &executableResponse{ Success: Bool(true), Version: 1, ExpirationTime: defaultTime.Unix() + 3600, TokenType: "urn:ietf:params:oauth:token-type:jwt", IdToken: "tokentokentoken", }, } ecs, ok := base.(executableCredentialSource) if !ok { t.Fatalf("Wrong credential type created.") } ecs.env = &te if err = json.NewEncoder(outputFile).Encode(tt.outputFileContents); err != nil { t.Errorf("Error encoding to file: %v", err) return } out, err := ecs.subjectToken() if err != nil { t.Errorf("retrieveSubjectToken() failed: %v", err) return } if deadline, deadlineSet := te.getDeadline(); !deadlineSet { t.Errorf("Command run without a deadline") } else if deadline != defaultTime.Add(5time.Second) { t.Errorf("Command run with incorrect deadline") } if got, want := out, "tokentokentoken"; got != want { t.Errorf("Incorrect token received.\nExpected: %s\nRecieved: %s", want, got) } }) } } var cacheSuccessTests = []struct { name string outputFileContents executableResponse }{ { name: "JWT", outputFileContents: executableResponse{ Success: Bool(true), Version: 1, ExpirationTime: defaultTime.Unix() + 3600, TokenType: "urn:ietf:params:oauth:token-type:jwt", IdToken: "tokentokentoken", }, }, { name: "Id Token", outputFileContents: executableResponse{ Success: Bool(true), Version: 1, ExpirationTime: defaultTime.Unix() + 3600, TokenType: "urn:ietf:params:oauth:token-type:id_token", IdToken: "tokentokentoken", }, }, { name: "SAML", outputFileContents: executableResponse{ Success: Bool(true), Version: 1, ExpirationTime: defaultTime.Unix() + 3600, TokenType: "urn:ietf:params:oauth:token-type:saml2", SamlResponse: "tokentokentoken", }, }, } func TestRetrieveOutputFileSubjectTokenJwt(t testing.T) { for _, tt := range cacheSuccessTests { t.Run(tt.name, func(t testing.T) { outputFile, err := ioutil.TempFile("testdata", "result..json") if err != nil { t.Fatalf("Tempfile failed: %v", err) } defer os.Remove(outputFile.Name()) cs := CredentialSource{ Executable: &ExecutableConfig{ Command: "blarg", TimeoutMillis: Int(5000), OutputFile: outputFile.Name(), }, } tfc := testFileConfig tfc.CredentialSource = &cs base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } te := testEnvironment{ envVars: executablesAllowed, byteResponse: []byte{}, } ecs, ok := base.(executableCredentialSource) if !ok { t.Fatalf("Wrong credential type created.") } ecs.env = &te if err = json.NewEncoder(outputFile).Encode(tt.outputFileContents); err != nil { t.Errorf("Error encoding to file: %v", err) return } if out, err := ecs.subjectToken(); err != nil { t.Errorf("retrieveSubjectToken() failed: %v", err) } else if got, want := out, "tokentokentoken"; got != want { t.Errorf("Incorrect token received.\nExpected: %s\nRecieved: %s", want, got) } if _, deadlineSet := te.getDeadline(); deadlineSet { t.Errorf("Executable called when it should not have been") } }) } } func TestServiceAccountImpersonationRE(t *testing.T) { tests := []struct { name string serviceAccountImpersonationURL string want string }{ { name: "universe domain Google Default Universe (GDU) googleapis.com", serviceAccountImpersonationURL: "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/test@project.iam.gserviceaccount.com:generateAccessToken", want: "test@project.iam.gserviceaccount.com", }, { name: "email does not match", serviceAccountImpersonationURL: "test@project.iam.gserviceaccount.com", want: "", }, { name: "universe domain non-GDU", serviceAccountImpersonationURL: "https://iamcredentials.apis-tpclp.goog/v1/projects/-/serviceAccounts/test@project.iam.gserviceaccount.com:generateAccessToken", want: "test@project.iam.gserviceaccount.com", }, } for _, tt := range tests { matches := serviceAccountImpersonationRE.FindStringSubmatch(tt.serviceAccountImpersonationURL) if matches == nil { if tt.want != "" { t.Errorf("%q: got nil, want %q", tt.name, tt.want) } } else if matches[1] != tt.want { t.Errorf("%q: got %q, want %q", tt.name, matches[1], tt.want) } } }	26.95 KB	2025-05-25 12:27
📄 filecredsource.go // Copyright 2020 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package externalaccount import ( "bytes" "encoding/json" "errors" "fmt" "io" "io/ioutil" "os" ) type fileCredentialSource struct { File string Format Format } func (cs fileCredentialSource) credentialSourceType() string { return "file" } func (cs fileCredentialSource) subjectToken() (string, error) { tokenFile, err := os.Open(cs.File) if err != nil { return "", fmt.Errorf("oauth2/google/externalaccount: failed to open credential file %q", cs.File) } defer tokenFile.Close() tokenBytes, err := ioutil.ReadAll(io.LimitReader(tokenFile, 1<<20)) if err != nil { return "", fmt.Errorf("oauth2/google/externalaccount: failed to read credential file: %v", err) } tokenBytes = bytes.TrimSpace(tokenBytes) switch cs.Format.Type { case "json": jsonData := make(map[string]interface{}) err = json.Unmarshal(tokenBytes, &jsonData) if err != nil { return "", fmt.Errorf("oauth2/google/externalaccount: failed to unmarshal subject token file: %v", err) } val, ok := jsonData[cs.Format.SubjectTokenFieldName] if !ok { return "", errors.New("oauth2/google/externalaccount: provided subject_token_field_name not found in credentials") } token, ok := val.(string) if !ok { return "", errors.New("oauth2/google/externalaccount: improperly formatted subject token") } return token, nil case "text": return string(tokenBytes), nil case "": return string(tokenBytes), nil default: return "", errors.New("oauth2/google/externalaccount: invalid credential_source file format type") } }	1.66 KB	2025-05-25 12:27
📄 filecredsource_test.go // Copyright 2020 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package externalaccount import ( "context" "testing" ) var testFileConfig = Config{ Audience: "32555940559.apps.googleusercontent.com", SubjectTokenType: "urn:ietf:params:oauth:token-type:jwt", TokenURL: "http://localhost:8080/v1/token", TokenInfoURL: "http://localhost:8080/v1/tokeninfo", ServiceAccountImpersonationURL: "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/service-gcs-admin@$PROJECT_ID.iam.gserviceaccount.com:generateAccessToken", ClientSecret: "notsosecret", ClientID: "rbrgnognrhongo3bi4gb9ghg9g", } func TestRetrieveFileSubjectToken(t testing.T) { var fileSourceTests = []struct { name string cs CredentialSource want string }{ { name: "UntypedFileSource", cs: CredentialSource{ File: textBaseCredPath, }, want: "street123", }, { name: "TextFileSource", cs: CredentialSource{ File: textBaseCredPath, Format: Format{Type: fileTypeText}, }, want: "street123", }, { name: "JSONFileSource", cs: CredentialSource{ File: jsonBaseCredPath, Format: Format{Type: fileTypeJSON, SubjectTokenFieldName: "SubjToken"}, }, want: "321road", }, } for _, test := range fileSourceTests { test := test tfc := testFileConfig tfc.CredentialSource = &test.cs t.Run(test.name, func(t testing.T) { base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } out, err := base.subjectToken() if err != nil { t.Errorf("Method subjectToken() errored.") } else if test.want != out { t.Errorf("got %v but want %v", out, test.want) } if got, want := base.credentialSourceType(), "file"; got != want { t.Errorf("got %v but want %v", got, want) } }) } }	1.98 KB	2025-05-25 12:27
📄 header.go // Copyright 2023 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package externalaccount import ( "runtime" "strings" "unicode" ) var ( // version is a package internal global variable for testing purposes. version = runtime.Version ) // versionUnknown is only used when the runtime version cannot be determined. const versionUnknown = "UNKNOWN" // goVersion returns a Go runtime version derived from the runtime environment // that is modified to be suitable for reporting in a header, meaning it has no // whitespace. If it is unable to determine the Go runtime version, it returns // versionUnknown. func goVersion() string { const develPrefix = "devel +" s := version() if strings.HasPrefix(s, develPrefix) { s = s[len(develPrefix):] if p := strings.IndexFunc(s, unicode.IsSpace); p >= 0 { s = s[:p] } return s } else if p := strings.IndexFunc(s, unicode.IsSpace); p >= 0 { s = s[:p] } notSemverRune := func(r rune) bool { return !strings.ContainsRune("0123456789.", r) } if strings.HasPrefix(s, "go1") { s = s[2:] var prerelease string if p := strings.IndexFunc(s, notSemverRune); p >= 0 { s, prerelease = s[:p], s[p:] } if strings.HasSuffix(s, ".") { s += "0" } else if strings.Count(s, ".") < 2 { s += ".0" } if prerelease != "" { // Some release candidates already have a dash in them. if !strings.HasPrefix(prerelease, "-") { prerelease = "-" + prerelease } s += prerelease } return s } return "UNKNOWN" }	1.55 KB	2025-05-25 12:27
📄 header_test.go // Copyright 2023 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package externalaccount import ( "runtime" "testing" "github.com/google/go-cmp/cmp" ) func TestGoVersion(t *testing.T) { testVersion := func(v string) func() string { return func() string { return v } } for _, tst := range []struct { v func() string want string }{ { testVersion("go1.19"), "1.19.0", }, { testVersion("go1.21-20230317-RC01"), "1.21.0-20230317-RC01", }, { testVersion("devel +abc1234"), "abc1234", }, { testVersion("this should be unknown"), versionUnknown, }, } { version = tst.v got := goVersion() if diff := cmp.Diff(got, tst.want); diff != "" { t.Errorf("got(-),want(+):\n%s", diff) } } version = runtime.Version }	872 B	2025-05-25 12:27
📄 programmaticrefreshcredsource.go // Copyright 2024 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package externalaccount import "context" type programmaticRefreshCredentialSource struct { supplierOptions SupplierOptions subjectTokenSupplier SubjectTokenSupplier ctx context.Context } func (cs programmaticRefreshCredentialSource) credentialSourceType() string { return "programmatic" } func (cs programmaticRefreshCredentialSource) subjectToken() (string, error) { return cs.subjectTokenSupplier.SubjectToken(cs.ctx, cs.supplierOptions) }	633 B	2025-05-25 12:27
📄 programmaticrefreshcredsource_test.go // Copyright 2024 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package externalaccount import ( "context" "errors" "testing" ) func TestRetrieveSubjectToken_ProgrammaticAuth(t testing.T) { tfc := testConfig tfc.SubjectTokenSupplier = testSubjectTokenSupplier{ subjectToken: "subjectToken", } base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } out, err := base.subjectToken() if err != nil { t.Fatalf("retrieveSubjectToken() failed: %v", err) } if out != "subjectToken" { t.Errorf("subjectToken = \n%q\n want \nSubjectToken", out) } } func TestRetrieveSubjectToken_ProgrammaticAuthFails(t testing.T) { tfc := testConfig testError := errors.New("test error") tfc.SubjectTokenSupplier = testSubjectTokenSupplier{ err: testError, } base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } _, err = base.subjectToken() if err == nil { t.Fatalf("subjectToken() should have failed") } if testError != err { t.Errorf("subjectToken = %e, want %e", err, testError) } } func TestRetrieveSubjectToken_ProgrammaticAuthOptions(t testing.T) { tfc := testConfig expectedOptions := SupplierOptions{Audience: tfc.Audience, SubjectTokenType: tfc.SubjectTokenType} tfc.SubjectTokenSupplier = testSubjectTokenSupplier{ subjectToken: "subjectToken", expectedOptions: &expectedOptions, } base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } _, err = base.subjectToken() if err != nil { t.Fatalf("retrieveSubjectToken() failed: %v", err) } } func TestRetrieveSubjectToken_ProgrammaticAuthContext(t testing.T) { tfc := testConfig ctx := context.Background() tfc.SubjectTokenSupplier = testSubjectTokenSupplier{ subjectToken: "subjectToken", expectedContext: ctx, } base, err := tfc.parse(ctx) if err != nil { t.Fatalf("parse() failed %v", err) } _, err = base.subjectToken() if err != nil { t.Fatalf("retrieveSubjectToken() failed: %v", err) } } type testSubjectTokenSupplier struct { err error subjectToken string expectedOptions *SupplierOptions expectedContext context.Context } func (supp testSubjectTokenSupplier) SubjectToken(ctx context.Context, options SupplierOptions) (string, error) { if supp.err != nil { return "", supp.err } if supp.expectedOptions != nil { if supp.expectedOptions.Audience != options.Audience { return "", errors.New("Audience does not match") } if supp.expectedOptions.SubjectTokenType != options.SubjectTokenType { return "", errors.New("Audience does not match") } } if supp.expectedContext != nil { if supp.expectedContext != ctx { return "", errors.New("Context does not match") } } return supp.subjectToken, nil }	2.85 KB	2025-05-25 12:27
📁 testdata	-	2025-05-25 12:27
📄 urlcredsource.go // Copyright 2020 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package externalaccount import ( "context" "encoding/json" "errors" "fmt" "io" "io/ioutil" "net/http" "golang.org/x/oauth2" ) type urlCredentialSource struct { URL string Headers map[string]string Format Format ctx context.Context } func (cs urlCredentialSource) credentialSourceType() string { return "url" } func (cs urlCredentialSource) subjectToken() (string, error) { client := oauth2.NewClient(cs.ctx, nil) req, err := http.NewRequest("GET", cs.URL, nil) if err != nil { return "", fmt.Errorf("oauth2/google/externalaccount: HTTP request for URL-sourced credential failed: %v", err) } req = req.WithContext(cs.ctx) for key, val := range cs.Headers { req.Header.Add(key, val) } resp, err := client.Do(req) if err != nil { return "", fmt.Errorf("oauth2/google/externalaccount: invalid response when retrieving subject token: %v", err) } defer resp.Body.Close() respBody, err := ioutil.ReadAll(io.LimitReader(resp.Body, 1<<20)) if err != nil { return "", fmt.Errorf("oauth2/google/externalaccount: invalid body in subject token URL query: %v", err) } if c := resp.StatusCode; c < 200 \|\| c > 299 { return "", fmt.Errorf("oauth2/google/externalaccount: status code %d: %s", c, respBody) } switch cs.Format.Type { case "json": jsonData := make(map[string]interface{}) err = json.Unmarshal(respBody, &jsonData) if err != nil { return "", fmt.Errorf("oauth2/google/externalaccount: failed to unmarshal subject token file: %v", err) } val, ok := jsonData[cs.Format.SubjectTokenFieldName] if !ok { return "", errors.New("oauth2/google/externalaccount: provided subject_token_field_name not found in credentials") } token, ok := val.(string) if !ok { return "", errors.New("oauth2/google/externalaccount: improperly formatted subject token") } return token, nil case "text": return string(respBody), nil case "": return string(respBody), nil default: return "", errors.New("oauth2/google/externalaccount: invalid credential_source file format type") } }	2.16 KB	2025-05-25 12:27
📄 urlcredsource_test.go // Copyright 2020 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package externalaccount import ( "context" "encoding/json" "net/http" "net/http/httptest" "testing" ) var myURLToken = "testTokenValue" func TestRetrieveURLSubjectToken_Text(t testing.T) { ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { if r.Method != "GET" { t.Errorf("Unexpected request method, %v is found", r.Method) } if r.Header.Get("Metadata") != "True" { t.Errorf("Metadata header not properly included.") } w.Write([]byte("testTokenValue")) })) heads := make(map[string]string) heads["Metadata"] = "True" cs := CredentialSource{ URL: ts.URL, Format: Format{Type: fileTypeText}, Headers: heads, } tfc := testFileConfig tfc.CredentialSource = &cs base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } out, err := base.subjectToken() if err != nil { t.Fatalf("retrieveSubjectToken() failed: %v", err) } if out != myURLToken { t.Errorf("got %v but want %v", out, myURLToken) } } // Checking that retrieveSubjectToken properly defaults to type text func TestRetrieveURLSubjectToken_Untyped(t testing.T) { ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { if r.Method != "GET" { t.Errorf("Unexpected request method, %v is found", r.Method) } w.Write([]byte("testTokenValue")) })) cs := CredentialSource{ URL: ts.URL, } tfc := testFileConfig tfc.CredentialSource = &cs base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } out, err := base.subjectToken() if err != nil { t.Fatalf("Failed to retrieve URL subject token: %v", err) } if out != myURLToken { t.Errorf("got %v but want %v", out, myURLToken) } } func TestRetrieveURLSubjectToken_JSON(t testing.T) { type tokenResponse struct { TestToken string `json:"SubjToken"` } ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { if got, want := r.Method, "GET"; got != want { t.Errorf("got %v, but want %v", r.Method, want) } resp := tokenResponse{TestToken: "testTokenValue"} jsonResp, err := json.Marshal(resp) if err != nil { t.Errorf("Failed to marshal values: %v", err) } w.Write(jsonResp) })) cs := CredentialSource{ URL: ts.URL, Format: Format{Type: fileTypeJSON, SubjectTokenFieldName: "SubjToken"}, } tfc := testFileConfig tfc.CredentialSource = &cs base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } out, err := base.subjectToken() if err != nil { t.Fatalf("%v", err) } if out != myURLToken { t.Errorf("got %v but want %v", out, myURLToken) } } func TestURLCredential_CredentialSourceType(t *testing.T) { cs := CredentialSource{ URL: "http://example.com", Format: Format{Type: fileTypeText}, } tfc := testFileConfig tfc.CredentialSource = &cs base, err := tfc.parse(context.Background()) if err != nil { t.Fatalf("parse() failed %v", err) } if got, want := base.credentialSourceType(), "url"; got != want { t.Errorf("got %v but want %v", got, want) } }	3.22 KB	2025-05-25 12:27

Terminal