Google Cloud IAM C++ Client  2.2.1
A C++ Client Library for Google Cloud IAM
Public Member Functions | Friends | List of all members
google::cloud::iam::IAMCredentialsClient Class Reference

A service account is a special type of Google account that belongs to your application or a virtual machine (VM), instead of to an individual end user. More...

#include <google/cloud/iam/iam_credentials_client.h>

Public Member Functions

 IAMCredentialsClient (std::shared_ptr< IAMCredentialsConnection > connection, Options opts={})
 
 ~IAMCredentialsClient ()
 
 IAMCredentialsClient (IAMCredentialsClient const &)=default
 
IAMCredentialsClientoperator= (IAMCredentialsClient const &)=default
 
 IAMCredentialsClient (IAMCredentialsClient &&)=default
 
IAMCredentialsClientoperator= (IAMCredentialsClient &&)=default
 
StatusOr< google::iam::credentials::v1::GenerateAccessTokenResponse > GenerateAccessToken (std::string const &name, std::vector< std::string > const &delegates, std::vector< std::string > const &scope, google::protobuf::Duration const &lifetime, Options opts={})
 Generates an OAuth 2.0 access token for a service account. More...
 
StatusOr< google::iam::credentials::v1::GenerateAccessTokenResponse > GenerateAccessToken (google::iam::credentials::v1::GenerateAccessTokenRequest const &request, Options opts={})
 Generates an OAuth 2.0 access token for a service account. More...
 
StatusOr< google::iam::credentials::v1::GenerateIdTokenResponse > GenerateIdToken (std::string const &name, std::vector< std::string > const &delegates, std::string const &audience, bool include_email, Options opts={})
 Generates an OpenID Connect ID token for a service account. More...
 
StatusOr< google::iam::credentials::v1::GenerateIdTokenResponse > GenerateIdToken (google::iam::credentials::v1::GenerateIdTokenRequest const &request, Options opts={})
 Generates an OpenID Connect ID token for a service account. More...
 
StatusOr< google::iam::credentials::v1::SignBlobResponse > SignBlob (std::string const &name, std::vector< std::string > const &delegates, std::string const &payload, Options opts={})
 Signs a blob using a service account's system-managed private key. More...
 
StatusOr< google::iam::credentials::v1::SignBlobResponse > SignBlob (google::iam::credentials::v1::SignBlobRequest const &request, Options opts={})
 Signs a blob using a service account's system-managed private key. More...
 
StatusOr< google::iam::credentials::v1::SignJwtResponse > SignJwt (std::string const &name, std::vector< std::string > const &delegates, std::string const &payload, Options opts={})
 Signs a JWT using a service account's system-managed private key. More...
 
StatusOr< google::iam::credentials::v1::SignJwtResponse > SignJwt (google::iam::credentials::v1::SignJwtRequest const &request, Options opts={})
 Signs a JWT using a service account's system-managed private key. More...
 

Friends

bool operator== (IAMCredentialsClient const &a, IAMCredentialsClient const &b)
 
bool operator!= (IAMCredentialsClient const &a, IAMCredentialsClient const &b)
 

Detailed Description

A service account is a special type of Google account that belongs to your application or a virtual machine (VM), instead of to an individual end user.

Your application assumes the identity of the service account to call Google APIs, so that the users aren't directly involved.

Service account credentials are used to temporarily assume the identity of the service account. Supported credential types include OAuth 2.0 access tokens, OpenID Connect ID tokens, self-signed JSON Web Tokens (JWTs), and more.

Equality

Instances of this class created via copy-construction or copy-assignment always compare equal. Instances created with equal std::shared_ptr<*Connection> objects compare equal. Objects that compare equal share the same underlying resources.

Performance

Creating a new instance of this class is a relatively expensive operation, new objects establish new connections to the service. In contrast, copy-construction, move-construction, and the corresponding assignment operations are relatively efficient as the copies share all underlying resources.

Thread Safety

Concurrent access to different instances of this class, even if they compare equal, is guaranteed to work. Two or more threads operating on the same instance of this class is not guaranteed to work. Since copy-construction and move-construction is a relatively efficient operation, consider using such a copy when using this class from multiple threads.

Definition at line 70 of file iam_credentials_client.h.

Constructor & Destructor Documentation

◆ IAMCredentialsClient() [1/3]

google::cloud::iam::IAMCredentialsClient::IAMCredentialsClient ( std::shared_ptr< IAMCredentialsConnection connection,
Options  opts = {} 
)
explicit

◆ ~IAMCredentialsClient()

google::cloud::iam::IAMCredentialsClient::~IAMCredentialsClient ( )

◆ IAMCredentialsClient() [2/3]

google::cloud::iam::IAMCredentialsClient::IAMCredentialsClient ( IAMCredentialsClient const &  )
default

◆ IAMCredentialsClient() [3/3]

google::cloud::iam::IAMCredentialsClient::IAMCredentialsClient ( IAMCredentialsClient &&  )
default

Member Function Documentation

◆ GenerateAccessToken() [1/2]

StatusOr<google::iam::credentials::v1::GenerateAccessTokenResponse> google::cloud::iam::IAMCredentialsClient::GenerateAccessToken ( google::iam::credentials::v1::GenerateAccessTokenRequest const &  request,
Options  opts = {} 
)

Generates an OAuth 2.0 access token for a service account.

Parameters
requestgoogle::iam::credentials::v1::GenerateAccessTokenRequest
optsOptional. Override the class-level options, such as retry and backoff policies.
Returns
google::iam::credentials::v1::GenerateAccessTokenResponse

◆ GenerateAccessToken() [2/2]

StatusOr<google::iam::credentials::v1::GenerateAccessTokenResponse> google::cloud::iam::IAMCredentialsClient::GenerateAccessToken ( std::string const &  name,
std::vector< std::string > const &  delegates,
std::vector< std::string > const &  scope,
google::protobuf::Duration const &  lifetime,
Options  opts = {} 
)

Generates an OAuth 2.0 access token for a service account.

Parameters
nameRequired. The resource name of the service account for which the credentials are requested, in the following format: projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}. The - wildcard character is required; replacing it with a project ID is invalid.
delegatesThe sequence of service accounts in a delegation chain. Each service account must be granted the roles/iam.serviceAccountTokenCreator role on its next service account in the chain. The last service account in the chain must be granted the roles/iam.serviceAccountTokenCreator role on the service account that is specified in the name field of the request. The delegates must have the following format: projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}. The - wildcard character is required; replacing it with a project ID is invalid.
scopeRequired. Code to identify the scopes to be included in the OAuth 2.0 access token. See https://developers.google.com/identity/protocols/googlescopes for more information. At least one value required.
lifetimeThe desired lifetime duration of the access token in seconds. Must be set to a value less than or equal to 3600 (1 hour). If a value is not specified, the token's lifetime will be set to a default value of one hour.
optsOptional. Override the class-level options, such as retry and backoff policies.
Returns
google::iam::credentials::v1::GenerateAccessTokenResponse

◆ GenerateIdToken() [1/2]

StatusOr<google::iam::credentials::v1::GenerateIdTokenResponse> google::cloud::iam::IAMCredentialsClient::GenerateIdToken ( google::iam::credentials::v1::GenerateIdTokenRequest const &  request,
Options  opts = {} 
)

Generates an OpenID Connect ID token for a service account.

Parameters
requestgoogle::iam::credentials::v1::GenerateIdTokenRequest
optsOptional. Override the class-level options, such as retry and backoff policies.
Returns
google::iam::credentials::v1::GenerateIdTokenResponse

◆ GenerateIdToken() [2/2]

StatusOr<google::iam::credentials::v1::GenerateIdTokenResponse> google::cloud::iam::IAMCredentialsClient::GenerateIdToken ( std::string const &  name,
std::vector< std::string > const &  delegates,
std::string const &  audience,
bool  include_email,
Options  opts = {} 
)

Generates an OpenID Connect ID token for a service account.

Parameters
nameRequired. The resource name of the service account for which the credentials are requested, in the following format: projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}. The - wildcard character is required; replacing it with a project ID is invalid.
delegatesThe sequence of service accounts in a delegation chain. Each service account must be granted the roles/iam.serviceAccountTokenCreator role on its next service account in the chain. The last service account in the chain must be granted the roles/iam.serviceAccountTokenCreator role on the service account that is specified in the name field of the request. The delegates must have the following format: projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}. The - wildcard character is required; replacing it with a project ID is invalid.
audienceRequired. The audience for the token, such as the API or account that this token grants access to.
include_emailInclude the service account email in the token. If set to true, the token will contain email and email_verified claims.
optsOptional. Override the class-level options, such as retry and backoff policies.
Returns
google::iam::credentials::v1::GenerateIdTokenResponse

◆ operator=() [1/2]

IAMCredentialsClient& google::cloud::iam::IAMCredentialsClient::operator= ( IAMCredentialsClient &&  )
default

◆ operator=() [2/2]

IAMCredentialsClient& google::cloud::iam::IAMCredentialsClient::operator= ( IAMCredentialsClient const &  )
default

◆ SignBlob() [1/2]

StatusOr<google::iam::credentials::v1::SignBlobResponse> google::cloud::iam::IAMCredentialsClient::SignBlob ( google::iam::credentials::v1::SignBlobRequest const &  request,
Options  opts = {} 
)

Signs a blob using a service account's system-managed private key.

Parameters
requestgoogle::iam::credentials::v1::SignBlobRequest
optsOptional. Override the class-level options, such as retry and backoff policies.
Returns
google::iam::credentials::v1::SignBlobResponse

◆ SignBlob() [2/2]

StatusOr<google::iam::credentials::v1::SignBlobResponse> google::cloud::iam::IAMCredentialsClient::SignBlob ( std::string const &  name,
std::vector< std::string > const &  delegates,
std::string const &  payload,
Options  opts = {} 
)

Signs a blob using a service account's system-managed private key.

Parameters
nameRequired. The resource name of the service account for which the credentials are requested, in the following format: projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}. The - wildcard character is required; replacing it with a project ID is invalid.
delegatesThe sequence of service accounts in a delegation chain. Each service account must be granted the roles/iam.serviceAccountTokenCreator role on its next service account in the chain. The last service account in the chain must be granted the roles/iam.serviceAccountTokenCreator role on the service account that is specified in the name field of the request. The delegates must have the following format: projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}. The - wildcard character is required; replacing it with a project ID is invalid.
payloadRequired. The bytes to sign.
optsOptional. Override the class-level options, such as retry and backoff policies.
Returns
google::iam::credentials::v1::SignBlobResponse

◆ SignJwt() [1/2]

StatusOr<google::iam::credentials::v1::SignJwtResponse> google::cloud::iam::IAMCredentialsClient::SignJwt ( google::iam::credentials::v1::SignJwtRequest const &  request,
Options  opts = {} 
)

Signs a JWT using a service account's system-managed private key.

Parameters
requestgoogle::iam::credentials::v1::SignJwtRequest
optsOptional. Override the class-level options, such as retry and backoff policies.
Returns
google::iam::credentials::v1::SignJwtResponse

◆ SignJwt() [2/2]

StatusOr<google::iam::credentials::v1::SignJwtResponse> google::cloud::iam::IAMCredentialsClient::SignJwt ( std::string const &  name,
std::vector< std::string > const &  delegates,
std::string const &  payload,
Options  opts = {} 
)

Signs a JWT using a service account's system-managed private key.

Parameters
nameRequired. The resource name of the service account for which the credentials are requested, in the following format: projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}. The - wildcard character is required; replacing it with a project ID is invalid.
delegatesThe sequence of service accounts in a delegation chain. Each service account must be granted the roles/iam.serviceAccountTokenCreator role on its next service account in the chain. The last service account in the chain must be granted the roles/iam.serviceAccountTokenCreator role on the service account that is specified in the name field of the request. The delegates must have the following format: projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}. The - wildcard character is required; replacing it with a project ID is invalid.
payloadRequired. The JWT payload to sign: a JSON object that contains a JWT Claims Set.
optsOptional. Override the class-level options, such as retry and backoff policies.
Returns
google::iam::credentials::v1::SignJwtResponse

Friends And Related Function Documentation

◆ operator!=

bool operator!= ( IAMCredentialsClient const &  a,
IAMCredentialsClient const &  b 
)
friend

Definition at line 90 of file iam_credentials_client.h.

◆ operator==

bool operator== ( IAMCredentialsClient const &  a,
IAMCredentialsClient const &  b 
)
friend

Definition at line 86 of file iam_credentials_client.h.