1 // 2 // Copyright 2020 gRPC authors. 3 // 4 // Licensed under the Apache License, Version 2.0 (the "License"); 5 // you may not use this file except in compliance with the License. 6 // You may obtain a copy of the License at 7 // 8 // http://www.apache.org/licenses/LICENSE-2.0 9 // 10 // Unless required by applicable law or agreed to in writing, software 11 // distributed under the License is distributed on an "AS IS" BASIS, 12 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 // See the License for the specific language governing permissions and 14 // limitations under the License. 15 // 16 17 #ifndef GRPC_CORE_LIB_SECURITY_CREDENTIALS_EXTERNAL_EXTERNAL_ACCOUNT_CREDENTIALS_H 18 #define GRPC_CORE_LIB_SECURITY_CREDENTIALS_EXTERNAL_EXTERNAL_ACCOUNT_CREDENTIALS_H 19 20 #include <grpc/support/port_platform.h> 21 22 #include <string> 23 #include <vector> 24 25 #include "src/core/lib/json/json.h" 26 #include "src/core/lib/security/credentials/oauth2/oauth2_credentials.h" 27 28 namespace grpc_core { 29 30 // Base external account credentials. The base class implements common logic for 31 // exchanging external account credentials for GCP access token to authorize 32 // requests to GCP APIs. The specific logic of retrieving subject token is 33 // implemented in subclasses. 34 class ExternalAccountCredentials 35 : public grpc_oauth2_token_fetcher_credentials { 36 public: 37 // External account credentials json interface. 38 struct Options { 39 std::string type; 40 std::string audience; 41 std::string subject_token_type; 42 std::string service_account_impersonation_url; 43 std::string token_url; 44 std::string token_info_url; 45 Json credential_source; 46 std::string quota_project_id; 47 std::string client_id; 48 std::string client_secret; 49 }; 50 51 static RefCountedPtr<ExternalAccountCredentials> Create( 52 const Json& json, std::vector<std::string> scopes, 53 grpc_error_handle* error); 54 55 ExternalAccountCredentials(Options options, std::vector<std::string> scopes); 56 ~ExternalAccountCredentials() override; 57 std::string debug_string() override; 58 59 protected: 60 // This is a helper struct to pass information between multiple callback based 61 // asynchronous calls. 62 struct HTTPRequestContext { HTTPRequestContextHTTPRequestContext63 HTTPRequestContext(grpc_httpcli_context* httpcli_context, 64 grpc_polling_entity* pollent, grpc_millis deadline) 65 : httpcli_context(httpcli_context), 66 pollent(pollent), 67 deadline(deadline) {} ~HTTPRequestContextHTTPRequestContext68 ~HTTPRequestContext() { grpc_http_response_destroy(&response); } 69 70 // Contextual parameters passed from 71 // grpc_oauth2_token_fetcher_credentials::fetch_oauth2(). 72 grpc_httpcli_context* httpcli_context; 73 grpc_polling_entity* pollent; 74 grpc_millis deadline; 75 76 // Reusable token fetch http response and closure. 77 grpc_closure closure; 78 grpc_http_response response; 79 }; 80 81 // Subclasses of base external account credentials need to override this 82 // method to implement the specific subject token retrieval logic. 83 // Once the subject token is ready, subclasses need to invoke 84 // the callback function (cb) to pass the subject token (or error) 85 // back. 86 virtual void RetrieveSubjectToken( 87 HTTPRequestContext* ctx, const Options& options, 88 std::function<void(std::string, grpc_error_handle)> cb) = 0; 89 90 private: 91 // This method implements the common token fetch logic and it will be called 92 // when grpc_oauth2_token_fetcher_credentials request a new access token. 93 void fetch_oauth2(grpc_credentials_metadata_request* req, 94 grpc_httpcli_context* httpcli_context, 95 grpc_polling_entity* pollent, grpc_iomgr_cb_func cb, 96 grpc_millis deadline) override; 97 98 void OnRetrieveSubjectTokenInternal(absl::string_view subject_token, 99 grpc_error_handle error); 100 101 void ExchangeToken(absl::string_view subject_token); 102 static void OnExchangeToken(void* arg, grpc_error_handle error); 103 void OnExchangeTokenInternal(grpc_error_handle error); 104 105 void ImpersenateServiceAccount(); 106 static void OnImpersenateServiceAccount(void* arg, grpc_error_handle error); 107 void OnImpersenateServiceAccountInternal(grpc_error_handle error); 108 109 void FinishTokenFetch(grpc_error_handle error); 110 111 Options options_; 112 std::vector<std::string> scopes_; 113 114 HTTPRequestContext* ctx_ = nullptr; 115 grpc_credentials_metadata_request* metadata_req_ = nullptr; 116 grpc_iomgr_cb_func response_cb_ = nullptr; 117 }; 118 119 } // namespace grpc_core 120 121 #endif // GRPC_CORE_LIB_SECURITY_CREDENTIALS_EXTERNAL_EXTERNAL_ACCOUNT_CREDENTIALS_H 122