google::cloud::Credentials Class Reference

The public interface for Google's Unified Auth Client (GUAC) library. More...

#include <google/cloud/credentials.h>

Public Member Functions
virtual	~Credentials ()=0

Detailed Description

The public interface for Google's Unified Auth Client (GUAC) library.

The Unified Auth Client library allows C++ applications to configure authentication for both REST-based and gRPC-based client libraries. The library public interface is (intentionally) very narrow. Applications describe the type of authentication they want, the libraries used this description to initialize the internal components used in the authentication flows.

A complete overview of authentication and authorization for Google Cloud is outside the scope of this reference guide. We recommend the IAM overview instead. The following brief introduction may help as you read the reference documentation for components related to authentication:

• The Credentials class and the factory functions that create std::shared_ptr<Credentials> objects are related to authentication. That is they allow you to define what principal is making RPCs to GCP.
• The problem of authorization, that is, what principals can perform what operations, is resolved by the IAM Service in GCP. If you need to use this service, the C++ IAM client library may be useful. Some services embed IAM operations in their APIs, in that case, the C++ client library for the service may be easier to use.
• There are two types of "principals" in GCP.
  • Service Accounts: is an account for an application or compute workload instead of an individual end user.
  • Google Accounts: represents a developer, an administrator, or any other person who interacts with Google Cloud.
• Most applications should use GoogleDefaultCredentials(). This allows your administrator to configure the service account used in your workload by setting the default service account in the GCP environment where your application is deployed (e.g. GCE, GKE, or Cloud Run).
• During development, GoogleDefaultCredentials() uses the GOOGLE_APPLICATION_CREDENTIALS environment variable to load an alternative service account key. The value of this environment variable is the full path of a file which contains the service account key.
• During development, if GOOGLE_APPLICATION_CREDENTIALS is not set then GoogleDefaultCredentials() will use the account configured via gcloud auth application-default login. This can be either a service account or a Google Account, such as the developer's account.
• Neither google auth application-default nor GOOGLE_APPLICATION_CREDENTIALS are recommended for production workloads.

Limitations

The C++ GUAC library does not allow applications to create their own credential types. It is not possible to extend the GUAC library without changing internal components. If you need additional functionality please file a feature request on GitHub. Likewise, creating the components that implement (as opposed to describing) authentication flows are also considered implementation details. If you would like to use them in your own libraries please file a feature request.

See also

https://cloud.google.com/docs/authentication for more information on authentication in GCP.

https://cloud.google.com/iam for more information on the IAM Service.

Definition at line 94 of file credentials.h.

Constructor & Destructor Documentation

~Credentials()

virtual google::cloud::Credentials::~Credentials ( )

pure virtual