Try to use OIDC token from metadata server as first option#1787
Try to use OIDC token from metadata server as first option#1787
Conversation
|
Apologies for the build issues on this - wanted to get something in front of you before i spent time polishing this |
lahirumaramba
left a comment
lahirumaramba
left a comment
There was a problem hiding this comment.
Thanks @joehan ! Added a few comments.
src/app/credential-internal.ts
Outdated
| // NOTE: the Google Metadata Service uses HTTP over a vlan | ||
| const GOOGLE_METADATA_SERVICE_HOST = 'metadata.google.internal'; | ||
| const GOOGLE_METADATA_SERVICE_TOKEN_PATH = '/computeMetadata/v1/instance/service-accounts/default/token'; | ||
| const GOOGLE_METADATA_SERVICE_IDENTITY_PATH = '/computeMetadata/v1/instance/service-accounts/default/token'; |
There was a problem hiding this comment.
This looks identical to GOOGLE_METADATA_SERVICE_TOKEN_PATH. I think we want to replace default with the service account email. http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/${saEmail}/identity?audience=${audience}
There was a problem hiding this comment.
Ahhhh, this was a typo - it should be /identity, not /token
| : await this.getUrl(resources, FIREBASE_FUNCTION_URL_FORMAT); | ||
| task.httpRequest.url = functionUrl; | ||
| try { | ||
| const idToken = await this.app.options.credential.getIDToken(functionUrl) |
There was a problem hiding this comment.
I think for Extensions use-case we still need a way to pass the service account. Please ignore if you plan to address that in a separate PR.
There was a problem hiding this comment.
Turns out that within Cloud Functions, default/ is just an alias for whatever service account the function is running as. For extensions, this is the service account we'd want to pass in anyways
| * @param audience The URL this token will be used to call. | ||
| * @returns A base64 encoded OIDC token. | ||
| */ | ||
| getIDToken(audience: string): Promise<string>; |
There was a problem hiding this comment.
It ok to add to this interface? or is this a public interface/would require a API review?
|
Closing in favor of #1812 |
2 participants
Taking a crack at switching the Tasks code to use ID tokens from the Metadata