Authentication components for Google Cloud Storage. More...

Classes
class	AnonymousCredentials
	A `Credentials` type representing "anonymous" Google OAuth2.0 credentials. More...

class	AuthorizedUserCredentials
	Wrapper class for Google OAuth 2.0 user account credentials. More...

class	AuthorizedUserCredentials< storage::internal::CurlRequestBuilder, std::chrono::system_clock >

struct	AuthorizedUserCredentialsInfo
	Object to hold information used to instantiate an AuthorizedUserCredentials. More...

class	ComputeEngineCredentials
	Wrapper class for Google OAuth 2.0 GCE instance service account credentials. More...

class	ComputeEngineCredentials< storage::internal::CurlRequestBuilder, std::chrono::system_clock >

class	Credentials
	Interface for OAuth 2.0 credentials used to access Google Cloud services. More...

class	RefreshingCredentialsWrapper
	Wrapper for refreshable parts of a Credentials object. More...

class	ServiceAccountCredentials
	Wrapper class for Google OAuth 2.0 service account credentials. More...

class	ServiceAccountCredentials< storage::internal::CurlRequestBuilder, std::chrono::system_clock >

struct	ServiceAccountCredentialsInfo
	Object to hold information used to instantiate an ServiceAccountCredentials. More...

struct	ServiceAccountMetadata
	A helper struct that contains service account metadata. More...

Enumerations
enum class	JwtSigningAlgorithms { RS256 }
	Supported signing algorithms used in JWT auth flows. More...

Functions
StatusOr< RefreshingCredentialsWrapper::TemporaryToken >	ParseAuthorizedUserRefreshResponse (storage::internal::HttpResponse const &response, std::chrono::system_clock::time_point now)
	Parses a refresh response JSON string into an authorization header. More...

StatusOr< AuthorizedUserCredentialsInfo >	ParseAuthorizedUserCredentials (std::string const &content, std::string const &source, std::string const &default_token_uri=google::cloud::oauth2_internal::GoogleOAuthRefreshEndpoint())
	Parses a user credentials JSON string into an AuthorizedUserCredentialsInfo. More...

StatusOr< ServiceAccountMetadata >	ParseMetadataServerResponse (storage::internal::HttpResponse const &response)
	Parses a metadata server response JSON string into a ServiceAccountMetadata. More...

StatusOr< RefreshingCredentialsWrapper::TemporaryToken >	ParseComputeEngineRefreshResponse (storage::internal::HttpResponse const &response, std::chrono::system_clock::time_point now)
	Parses a refresh response JSON string into an authorization header. More...

constexpr std::chrono::seconds	GoogleOAuthAccessTokenLifetime ()
	The max lifetime in seconds of an access token. More...

constexpr std::chrono::seconds	GoogleOAuthAccessTokenExpirationSlack ()
	Returns the slack to consider when checking if an access token is expired. More...

char const *	GoogleOAuthRefreshEndpoint ()
	The endpoint to fetch an OAuth 2.0 access token from. More...

char const *	GoogleOAuthScopeCloudPlatform ()
	String representing the "cloud-platform" OAuth 2.0 scope. More...

char const *	GoogleAdcEnvVar ()
	Returns the Application Default Credentials environment variable name. More...

std::string	GoogleAdcFilePathFromEnvVarOrEmpty ()
	Returns the path to the Application Default Credentials file, if set. More...

std::string	GoogleAdcFilePathFromWellKnownPathOrEmpty ()
	Returns the path to the Application Default Credentials file, if set. More...

char const *	GoogleGcloudAdcFileEnvVar ()
	Returns the environment variable to override the gcloud ADC path. More...

char const *	GoogleAdcHomeEnvVar ()
	Returns the environment variable used to construct the well known ADC path. More...

StatusOr< std::shared_ptr< Credentials > >	GoogleDefaultCredentials (ChannelOptions const &options={})
	Produces a Credentials type based on the runtime environment. More...

StatusOr< std::shared_ptr< Credentials > >	CreateServiceAccountCredentialsFromDefaultPaths (ChannelOptions const &options={})
	Produces a ServiceAccountCredentials type by trying to load the standard Application Default Credentials paths. More...

StatusOr< std::shared_ptr< Credentials > >	CreateServiceAccountCredentialsFromDefaultPaths (absl::optional< std::set< std::string > > scopes, absl::optional< std::string > subject, ChannelOptions const &options={})
	Produces a ServiceAccountCredentials type by trying to load the standard Application Default Credentials paths. More...

StatusOr< std::shared_ptr< Credentials > >	CreateServiceAccountCredentialsFromJsonContents (std::string const &contents, ChannelOptions const &options={})
	Creates a ServiceAccountCredentials from a JSON string. More...

StatusOr< std::shared_ptr< Credentials > >	CreateServiceAccountCredentialsFromJsonContents (std::string const &contents, absl::optional< std::set< std::string > > scopes, absl::optional< std::string > subject, ChannelOptions const &options={})
	Creates a ServiceAccountCredentials from a JSON string. More...

std::shared_ptr< Credentials >	CreateComputeEngineCredentials ()
	Creates a ComputeEngineCredentials for the VM's default service account. More...

std::shared_ptr< Credentials >	CreateComputeEngineCredentials (std::string const &service_account_email)
	Creates a ComputeEngineCredentials for the VM's specified service account. More...

StatusOr< ServiceAccountCredentialsInfo >	ParseServiceAccountCredentials (std::string const &content, std::string const &source, std::string const &default_token_uri=GoogleOAuthRefreshEndpoint())
	Parses the contents of a JSON keyfile into a ServiceAccountCredentialsInfo. More...

StatusOr< ServiceAccountCredentialsInfo >	ParseServiceAccountP12File (std::string const &source, std::string const &default_token_uri=GoogleOAuthRefreshEndpoint())
	Parses the contents of a P12 keyfile into a ServiceAccountCredentialsInfo. More...

StatusOr< RefreshingCredentialsWrapper::TemporaryToken >	ParseServiceAccountRefreshResponse (storage::internal::HttpResponse const &response, std::chrono::system_clock::time_point now)
	Parses a refresh response JSON string and uses the current time to create a TemporaryToken. More...

std::pair< std::string, std::string >	AssertionComponentsFromInfo (ServiceAccountCredentialsInfo const &info, std::chrono::system_clock::time_point now)
	Splits a ServiceAccountCredentialsInfo into header and payload components and uses the current time to make a JWT assertion. More...

std::string	MakeJWTAssertion (std::string const &header, std::string const &payload, std::string const &pem_contents)
	Given a key and a JSON header and payload, creates a JWT assertion string. More...

std::string	CreateServiceAccountRefreshPayload (ServiceAccountCredentialsInfo const &info, std::string const &grant_type, std::chrono::system_clock::time_point now)
	Uses a ServiceAccountCredentialsInfo and the current time to construct a JWT assertion. More...

StatusOr< std::string >	MakeSelfSignedJWT (ServiceAccountCredentialsInfo const &info, std::chrono::system_clock::time_point tp)
	Make a self-signed JWT from the service account. More...

bool	ServiceAccountUseOAuth (ServiceAccountCredentialsInfo const &info)
	Return true if we need to use the OAuth path to create tokens. More...

Functions to manually create specific credential types.
Deprecated: Prefer using the unified credentials documented in Authentication Components
std::shared_ptr< Credentials >	CreateAnonymousCredentials ()
	Creates an AnonymousCredentials. More...

StatusOr< std::shared_ptr< Credentials > >	CreateAuthorizedUserCredentialsFromJsonFilePath (std::string const &path)
	Creates an AuthorizedUserCredentials from a JSON file at the specified path. More...

StatusOr< std::shared_ptr< Credentials > >	CreateAuthorizedUserCredentialsFromJsonContents (std::string const &contents, ChannelOptions const &options={})
	Creates an AuthorizedUserCredentials from a JSON string. More...

Load service account key files.
Deprecated: Prefer using the unified credentials documented in Authentication Components
StatusOr< std::shared_ptr< Credentials > >	CreateServiceAccountCredentialsFromFilePath (std::string const &path)
	Creates a ServiceAccountCredentials from a file at the specified path. More...

StatusOr< std::shared_ptr< Credentials > >	CreateServiceAccountCredentialsFromFilePath (std::string const &path, absl::optional< std::set< std::string > > scopes, absl::optional< std::string > subject)
	Creates a ServiceAccountCredentials from a file at the specified path. More...

StatusOr< std::shared_ptr< Credentials > >	CreateServiceAccountCredentialsFromJsonFilePath (std::string const &path)
	Creates a ServiceAccountCredentials from a JSON file at the specified path. More...

StatusOr< std::shared_ptr< Credentials > >	CreateServiceAccountCredentialsFromJsonFilePath (std::string const &path, absl::optional< std::set< std::string > > scopes, absl::optional< std::string > subject, ChannelOptions const &options={})
	Creates a ServiceAccountCredentials from a JSON file at the specified path. More...

StatusOr< std::shared_ptr< Credentials > >	CreateServiceAccountCredentialsFromP12FilePath (std::string const &path)
	Creates a ServiceAccountCredentials from a P12 file at the specified path. More...

StatusOr< std::shared_ptr< Credentials > >	CreateServiceAccountCredentialsFromP12FilePath (std::string const &path, absl::optional< std::set< std::string > > scopes, absl::optional< std::string > subject, ChannelOptions const &options={})
	Creates a ServiceAccountCredentials from a P12 file at the specified path. More...

Detailed Description

Authentication components for Google Cloud Storage.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

Enumeration Type Documentation

◆ JwtSigningAlgorithms

enum class google::cloud::storage::oauth2::JwtSigningAlgorithms

strong

Supported signing algorithms used in JWT auth flows.

We currently only support RSA with SHA-256, but use this enum for readability and easy addition of support for other algorithms.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

Enumerator
RS256

Function Documentation

◆ AssertionComponentsFromInfo()

std::pair< std::string, std::string > google::cloud::storage::oauth2::AssertionComponentsFromInfo	(	ServiceAccountCredentialsInfo const &	info,
		std::chrono::system_clock::time_point	now
	)

Splits a ServiceAccountCredentialsInfo into header and payload components and uses the current time to make a JWT assertion.

See also: https://cloud.google.com/endpoints/docs/frameworks/java/troubleshoot-jwt; https://tools.ietf.org/html/rfc7523

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ CreateAnonymousCredentials()

std::shared_ptr< Credentials > google::cloud::storage::oauth2::CreateAnonymousCredentials ( )

Creates an AnonymousCredentials.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ CreateAuthorizedUserCredentialsFromJsonContents()

StatusOr< std::shared_ptr< Credentials > > google::cloud::storage::oauth2::CreateAuthorizedUserCredentialsFromJsonContents	(	std::string const &	contents,
		ChannelOptions const &	options = `{}`
	)

Creates an AuthorizedUserCredentials from a JSON string.

Note: It is strongly preferred to instead use service account credentials with Cloud Storage client libraries.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ CreateAuthorizedUserCredentialsFromJsonFilePath()

StatusOr< std::shared_ptr< Credentials > > google::cloud::storage::oauth2::CreateAuthorizedUserCredentialsFromJsonFilePath ( std::string const & path )

Creates an AuthorizedUserCredentials from a JSON file at the specified path.

Note: It is strongly preferred to instead use service account credentials with Cloud Storage client libraries.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ CreateComputeEngineCredentials() [1/2]

std::shared_ptr< Credentials > google::cloud::storage::oauth2::CreateComputeEngineCredentials ( )

Creates a ComputeEngineCredentials for the VM's default service account.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ CreateComputeEngineCredentials() [2/2]

std::shared_ptr< Credentials > google::cloud::storage::oauth2::CreateComputeEngineCredentials ( std::string const & service_account_email )

Creates a ComputeEngineCredentials for the VM's specified service account.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ CreateServiceAccountCredentialsFromDefaultPaths() [1/2]

StatusOr< std::shared_ptr< Credentials > > google::cloud::storage::oauth2::CreateServiceAccountCredentialsFromDefaultPaths	(	absl::optional< std::set< std::string > >	scopes,
		absl::optional< std::string >	subject,
		ChannelOptions const &	options = `{}`
	)

Produces a ServiceAccountCredentials type by trying to load the standard Application Default Credentials paths.

If the GOOGLE_APPLICATION_CREDENTIALS environment variable is set, the JSON or P12 file it points to will be loaded. Otherwise, if the gcloud utility has configured an Application Default Credentials file, that file is loaded. The loaded file is used to create a ServiceAccountCredentials.

Parameters

scopes	the scopes to request during the authorization grant. If omitted, the cloud-platform scope, defined by `GoogleOAuthScopeCloudPlatform()`, is used as a default.
subject	for domain-wide delegation; the email address of the user for which to request delegated access. If omitted, no "subject" attribute is included in the authorization grant.
options	any configuration needed for the transport channel to Google's authentication servers.

See also: https://developers.google.com/identity/protocols/googlescopes for a list of OAuth 2.0 scopes used with Google APIs.; https://cloud.google.com/docs/authentication/production for details about Application Default Credentials.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ CreateServiceAccountCredentialsFromDefaultPaths() [2/2]

StatusOr< std::shared_ptr< Credentials > > google::cloud::storage::oauth2::CreateServiceAccountCredentialsFromDefaultPaths ( ChannelOptions const & options = {} )

Produces a ServiceAccountCredentials type by trying to load the standard Application Default Credentials paths.

If the GOOGLE_APPLICATION_CREDENTIALS environment variable is set, the JSON or P12 file it points to will be loaded. Otherwise, if the gcloud utility has configured an Application Default Credentials file, that file is loaded. The loaded file is used to create a ServiceAccountCredentials.

Parameters

options any configuration needed for the transport channel to Google's authentication servers.

See also: https://cloud.google.com/docs/authentication/production for details about Application Default Credentials.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ CreateServiceAccountCredentialsFromFilePath() [1/2]

StatusOr< std::shared_ptr< Credentials > > google::cloud::storage::oauth2::CreateServiceAccountCredentialsFromFilePath ( std::string const & path )

Creates a ServiceAccountCredentials from a file at the specified path.

Note: This function automatically detects if the file is a JSON or P12 (aka PFX aka PKCS#12) file and tries to load the file as a service account credential. We strongly recommend that applications use JSON files for service account key files.

These credentials use the cloud-platform OAuth 2.0 scope, defined by GoogleOAuthScopeCloudPlatform(). To specify alternate scopes, use the overloaded version of this function.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ CreateServiceAccountCredentialsFromFilePath() [2/2]

StatusOr< std::shared_ptr< Credentials > > google::cloud::storage::oauth2::CreateServiceAccountCredentialsFromFilePath	(	std::string const &	path,
		absl::optional< std::set< std::string > >	scopes,
		absl::optional< std::string >	subject
	)

Creates a ServiceAccountCredentials from a file at the specified path.

Note: This function automatically detects if the file is a JSON or P12 (aka PFX aka PKCS#12) file and tries to load the file as a service account credential. We strongly recommend that applications use JSON files for service account key files.

Parameters

path	the path to the file containing service account JSON credentials.
scopes	the scopes to request during the authorization grant. If omitted, the cloud-platform scope, defined by `GoogleOAuthScopeCloudPlatform()`, is used as a default.
subject	for domain-wide delegation; the email address of the user for which to request delegated access. If omitted, no "subject" attribute is included in the authorization grant.

See also: https://developers.google.com/identity/protocols/googlescopes for a list of OAuth 2.0 scopes used with Google APIs.; https://developers.google.com/identity/protocols/OAuth2ServiceAccount for more information about domain-wide delegation.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ CreateServiceAccountCredentialsFromJsonContents() [1/2]

StatusOr< std::shared_ptr< Credentials > > google::cloud::storage::oauth2::CreateServiceAccountCredentialsFromJsonContents	(	std::string const &	contents,
		absl::optional< std::set< std::string > >	scopes,
		absl::optional< std::string >	subject,
		ChannelOptions const &	options = `{}`
	)

Creates a ServiceAccountCredentials from a JSON string.

Parameters

contents	the string containing the JSON contents of a service account credentials file.
scopes	the scopes to request during the authorization grant. If omitted, the cloud-platform scope, defined by `GoogleOAuthScopeCloudPlatform()`, is used as a default.
subject	for domain-wide delegation; the email address of the user for which to request delegated access. If omitted, no "subject" attribute is included in the authorization grant.
options	any configuration needed for the transport channel to Google's authentication servers.

See also: https://developers.google.com/identity/protocols/googlescopes for a list of OAuth 2.0 scopes used with Google APIs.; https://developers.google.com/identity/protocols/OAuth2ServiceAccount for more information about domain-wide delegation.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ CreateServiceAccountCredentialsFromJsonContents() [2/2]

StatusOr< std::shared_ptr< Credentials > > google::cloud::storage::oauth2::CreateServiceAccountCredentialsFromJsonContents	(	std::string const &	contents,
		ChannelOptions const &	options = `{}`
	)

Creates a ServiceAccountCredentials from a JSON string.

These credentials use the cloud-platform OAuth 2.0 scope, defined by GoogleOAuthScopeCloudPlatform(). To specify an alternate set of scopes, use the overloaded version of this function.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ CreateServiceAccountCredentialsFromJsonFilePath() [1/2]

StatusOr< std::shared_ptr< Credentials > > google::cloud::storage::oauth2::CreateServiceAccountCredentialsFromJsonFilePath ( std::string const & path )

Creates a ServiceAccountCredentials from a JSON file at the specified path.

These credentials use the cloud-platform OAuth 2.0 scope, defined by GoogleOAuthScopeCloudPlatform(). To specify alternate scopes, use the overloaded version of this function.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ CreateServiceAccountCredentialsFromJsonFilePath() [2/2]

StatusOr< std::shared_ptr< Credentials > > google::cloud::storage::oauth2::CreateServiceAccountCredentialsFromJsonFilePath	(	std::string const &	path,
		absl::optional< std::set< std::string > >	scopes,
		absl::optional< std::string >	subject,
		ChannelOptions const &	options = `{}`
	)

Creates a ServiceAccountCredentials from a JSON file at the specified path.

Parameters

path	the path to the file containing service account JSON credentials.
scopes	the scopes to request during the authorization grant. If omitted, the cloud-platform scope, defined by `GoogleOAuthScopeCloudPlatform()`, is used as a default.
subject	for domain-wide delegation; the email address of the user for which to request delegated access. If omitted, no "subject" attribute is included in the authorization grant.
options	any configuration needed for the transport channel to Google's authentication servers.

See also: https://developers.google.com/identity/protocols/googlescopes for a list of OAuth 2.0 scopes used with Google APIs.; https://developers.google.com/identity/protocols/OAuth2ServiceAccount for more information about domain-wide delegation.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ CreateServiceAccountCredentialsFromP12FilePath() [1/2]

StatusOr< std::shared_ptr< Credentials > > google::cloud::storage::oauth2::CreateServiceAccountCredentialsFromP12FilePath ( std::string const & path )

Creates a ServiceAccountCredentials from a P12 file at the specified path.

These credentials use the cloud-platform OAuth 2.0 scope, defined by GoogleOAuthScopeCloudPlatform(). To specify alternate scopes, use the overloaded version of this function.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ CreateServiceAccountCredentialsFromP12FilePath() [2/2]

StatusOr< std::shared_ptr< Credentials > > google::cloud::storage::oauth2::CreateServiceAccountCredentialsFromP12FilePath	(	std::string const &	path,
		absl::optional< std::set< std::string > >	scopes,
		absl::optional< std::string >	subject,
		ChannelOptions const &	options = `{}`
	)

Creates a ServiceAccountCredentials from a P12 file at the specified path.

Parameters

path	the path to the file containing service account JSON credentials.
scopes	the scopes to request during the authorization grant. If omitted, the cloud-platform scope, defined by `GoogleOAuthScopeCloudPlatform()`, is used as a default.
subject	for domain-wide delegation; the email address of the user for which to request delegated access. If omitted, no "subject" attribute is included in the authorization grant.
options	any configuration needed for the transport channel to Google's authentication servers.

See also: https://developers.google.com/identity/protocols/googlescopes for a list of OAuth 2.0 scopes used with Google APIs.; https://developers.google.com/identity/protocols/OAuth2ServiceAccount for more information about domain-wide delegation.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ CreateServiceAccountRefreshPayload()

std::string google::cloud::storage::oauth2::CreateServiceAccountRefreshPayload	(	ServiceAccountCredentialsInfo const &	info,
		std::string const &	grant_type,
		std::chrono::system_clock::time_point	now
	)

Uses a ServiceAccountCredentialsInfo and the current time to construct a JWT assertion.

The assertion combined with the grant type is used to create the refresh payload.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ GoogleAdcEnvVar()

char const * google::cloud::storage::oauth2::GoogleAdcEnvVar ( )

Returns the Application Default Credentials environment variable name.

This environment variable should be checked for a valid file path when attempting to load Google Application Default Credentials.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ GoogleAdcFilePathFromEnvVarOrEmpty()

std::string google::cloud::storage::oauth2::GoogleAdcFilePathFromEnvVarOrEmpty ( )

Returns the path to the Application Default Credentials file, if set.

If the Application Default Credentials environment variable is set, we check the path specified by its value for a file containing ADCs. Returns an empty string if no such path exists or the environment variable is not set.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ GoogleAdcFilePathFromWellKnownPathOrEmpty()

std::string google::cloud::storage::oauth2::GoogleAdcFilePathFromWellKnownPathOrEmpty ( )

Returns the path to the Application Default Credentials file, if set.

If the gcloud utility has configured an Application Default Credentials file, the path to that file is returned. Returns an empty string if no such file exists at the well known path.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ GoogleAdcHomeEnvVar()

char const * google::cloud::storage::oauth2::GoogleAdcHomeEnvVar ( )

Returns the environment variable used to construct the well known ADC path.

The directory containing a user's application configuration data, indicated by this environment variable, varies across environments. That directory is used when constructing the well known path of the Application Default Credentials file.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ GoogleDefaultCredentials()

StatusOr< std::shared_ptr< Credentials > > google::cloud::storage::oauth2::GoogleDefaultCredentials ( ChannelOptions const & options = {} )

Produces a Credentials type based on the runtime environment.

If the GOOGLE_APPLICATION_CREDENTIALS environment variable is set, the JSON file it points to will be loaded and used to create a credential of the specified type. Otherwise, if running on a Google-hosted environment (e.g. Compute Engine), credentials for the environment's default service account will be used.

See also: https://cloud.google.com/docs/authentication/production for details about Application Default Credentials.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ GoogleGcloudAdcFileEnvVar()

char const * google::cloud::storage::oauth2::GoogleGcloudAdcFileEnvVar ( )

Returns the environment variable to override the gcloud ADC path.

This environment variable is used for testing to override the path that should be searched for the gcloud Application Default Credentials file.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ GoogleOAuthAccessTokenExpirationSlack()

constexpr std::chrono::seconds google::cloud::storage::oauth2::GoogleOAuthAccessTokenExpirationSlack ( )

constexpr

Returns the slack to consider when checking if an access token is expired.

This time should be subtracted from a token's expiration time when checking if it is expired. This prevents race conditions where, for example, one might check expiration time one second before the expiration, see that the token is still valid, then attempt to use it two seconds later and receive an error.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ GoogleOAuthAccessTokenLifetime()

constexpr std::chrono::seconds google::cloud::storage::oauth2::GoogleOAuthAccessTokenLifetime ( )

constexpr

The max lifetime in seconds of an access token.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ GoogleOAuthRefreshEndpoint()

char const * google::cloud::storage::oauth2::GoogleOAuthRefreshEndpoint ( )

inline

The endpoint to fetch an OAuth 2.0 access token from.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ GoogleOAuthScopeCloudPlatform()

char const * google::cloud::storage::oauth2::GoogleOAuthScopeCloudPlatform ( )

inline

String representing the "cloud-platform" OAuth 2.0 scope.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ MakeJWTAssertion()

std::string google::cloud::storage::oauth2::MakeJWTAssertion	(	std::string const &	header,
		std::string const &	payload,
		std::string const &	pem_contents
	)

Given a key and a JSON header and payload, creates a JWT assertion string.

See also: https://tools.ietf.org/html/rfc7519

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ MakeSelfSignedJWT()

StatusOr< std::string > google::cloud::storage::oauth2::MakeSelfSignedJWT	(	ServiceAccountCredentialsInfo const &	info,
		std::chrono::system_clock::time_point	tp
	)

Make a self-signed JWT from the service account.

Self-signed JWTs bypass the intermediate step of exchanging client assertions for OAuth tokens. The advantages of self-signed JTWs include:

They are more efficient, as they require more or less the same amount of local work, and save a round-trip to the token endpoint, typically https://oauth2.googleapis.com/token.
While this service is extremely reliable, removing external dependencies in the critical path almost always improves reliability.
They work better in VPC-SC environments and other environments with limited Internet access.

Warning: At this time only scope-based self-signed JWTs are supported.

Parameters

info	the parsed service account information, see `ParseServiceAccountCredentials()`
tp	the current time

Returns: a bearer token for authentication. Include this value in the Authorization header with the "Bearer" type.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ ParseAuthorizedUserCredentials()

StatusOr< AuthorizedUserCredentialsInfo > google::cloud::storage::oauth2::ParseAuthorizedUserCredentials	(	std::string const &	content,
		std::string const &	source,
		std::string const &	default_token_uri = `google::cloud::oauth2_internal::GoogleOAuthRefreshEndpoint()`
	)

Parses a user credentials JSON string into an AuthorizedUserCredentialsInfo.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ ParseAuthorizedUserRefreshResponse()

StatusOr< RefreshingCredentialsWrapper::TemporaryToken > google::cloud::storage::oauth2::ParseAuthorizedUserRefreshResponse	(	storage::internal::HttpResponse const &	response,
		std::chrono::system_clock::time_point	now
	)

Parses a refresh response JSON string into an authorization header.

The header and the current time (for the expiration) form a TemporaryToken.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ ParseComputeEngineRefreshResponse()

StatusOr< RefreshingCredentialsWrapper::TemporaryToken > google::cloud::storage::oauth2::ParseComputeEngineRefreshResponse	(	storage::internal::HttpResponse const &	response,
		std::chrono::system_clock::time_point	now
	)

Parses a refresh response JSON string into an authorization header.

The header and the current time (for the expiration) form a TemporaryToken.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ ParseMetadataServerResponse()

StatusOr< ServiceAccountMetadata > google::cloud::storage::oauth2::ParseMetadataServerResponse ( storage::internal::HttpResponse const & response )

Parses a metadata server response JSON string into a ServiceAccountMetadata.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ ParseServiceAccountCredentials()

StatusOr< ServiceAccountCredentialsInfo > google::cloud::storage::oauth2::ParseServiceAccountCredentials	(	std::string const &	content,
		std::string const &	source,
		std::string const &	default_token_uri = `GoogleOAuthRefreshEndpoint()`
	)

Parses the contents of a JSON keyfile into a ServiceAccountCredentialsInfo.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ ParseServiceAccountP12File()

StatusOr< ServiceAccountCredentialsInfo > google::cloud::storage::oauth2::ParseServiceAccountP12File	(	std::string const &	source,
		std::string const &	default_token_uri = `GoogleOAuthRefreshEndpoint()`
	)

Parses the contents of a P12 keyfile into a ServiceAccountCredentialsInfo.

Warning: We strongly recommend that applications use JSON keyfiles instead.

Note: Note that P12 keyfiles do not contain the client_email for the service account, the application must obtain this through some other means and provide them to the function.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ ParseServiceAccountRefreshResponse()

StatusOr< RefreshingCredentialsWrapper::TemporaryToken > google::cloud::storage::oauth2::ParseServiceAccountRefreshResponse	(	storage::internal::HttpResponse const &	response,
		std::chrono::system_clock::time_point	now
	)

Parses a refresh response JSON string and uses the current time to create a TemporaryToken.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

◆ ServiceAccountUseOAuth()

bool google::cloud::storage::oauth2::ServiceAccountUseOAuth ( ServiceAccountCredentialsInfo const & info )

Return true if we need to use the OAuth path to create tokens.

Deprecated:: Prefer using the unified credentials documented in Authentication Components

Classes

Enumerations

Functions

Detailed Description

Enumeration Type Documentation

◆ JwtSigningAlgorithms

Function Documentation

◆ AssertionComponentsFromInfo()

◆ CreateAnonymousCredentials()

◆ CreateAuthorizedUserCredentialsFromJsonContents()

◆ CreateAuthorizedUserCredentialsFromJsonFilePath()

◆ CreateComputeEngineCredentials() [1/2]

◆ CreateComputeEngineCredentials() [2/2]

◆ CreateServiceAccountCredentialsFromDefaultPaths() [1/2]

◆ CreateServiceAccountCredentialsFromDefaultPaths() [2/2]

◆ CreateServiceAccountCredentialsFromFilePath() [1/2]

◆ CreateServiceAccountCredentialsFromFilePath() [2/2]

◆ CreateServiceAccountCredentialsFromJsonContents() [1/2]

◆ CreateServiceAccountCredentialsFromJsonContents() [2/2]

◆ CreateServiceAccountCredentialsFromJsonFilePath() [1/2]

◆ CreateServiceAccountCredentialsFromJsonFilePath() [2/2]

◆ CreateServiceAccountCredentialsFromP12FilePath() [1/2]

◆ CreateServiceAccountCredentialsFromP12FilePath() [2/2]

◆ CreateServiceAccountRefreshPayload()

◆ GoogleAdcEnvVar()

◆ GoogleAdcFilePathFromEnvVarOrEmpty()

◆ GoogleAdcFilePathFromWellKnownPathOrEmpty()

◆ GoogleAdcHomeEnvVar()

◆ GoogleDefaultCredentials()

◆ GoogleGcloudAdcFileEnvVar()

◆ GoogleOAuthAccessTokenExpirationSlack()

◆ GoogleOAuthAccessTokenLifetime()

◆ GoogleOAuthRefreshEndpoint()

◆ GoogleOAuthScopeCloudPlatform()

◆ MakeJWTAssertion()

◆ MakeSelfSignedJWT()

◆ ParseAuthorizedUserCredentials()

◆ ParseAuthorizedUserRefreshResponse()

◆ ParseComputeEngineRefreshResponse()

◆ ParseMetadataServerResponse()

◆ ParseServiceAccountCredentials()

◆ ParseServiceAccountP12File()

◆ ParseServiceAccountRefreshResponse()

◆ ServiceAccountUseOAuth()