• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1# Copyright 2016 Google LLC
2#
3# Licensed under the Apache License, Version 2.0 (the "License");
4# you may not use this file except in compliance with the License.
5# You may obtain a copy of the License at
6#
7#      http://www.apache.org/licenses/LICENSE-2.0
8#
9# Unless required by applicable law or agreed to in writing, software
10# distributed under the License is distributed on an "AS IS" BASIS,
11# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12# See the License for the specific language governing permissions and
13# limitations under the License.
14
15"""Helpers for transitioning from oauth2client to google-auth.
16
17.. warning::
18    This module is private as it is intended to assist first-party downstream
19    clients with the transition from oauth2client to google-auth.
20"""
21
22from __future__ import absolute_import
23
24import six
25
26from google.auth import _helpers
27import google.auth.app_engine
28import google.auth.compute_engine
29import google.oauth2.credentials
30import google.oauth2.service_account
31
32try:
33    import oauth2client.client
34    import oauth2client.contrib.gce
35    import oauth2client.service_account
36except ImportError as caught_exc:
37    six.raise_from(ImportError("oauth2client is not installed."), caught_exc)
38
39try:
40    import oauth2client.contrib.appengine  # pytype: disable=import-error
41
42    _HAS_APPENGINE = True
43except ImportError:
44    _HAS_APPENGINE = False
45
46
47_CONVERT_ERROR_TMPL = "Unable to convert {} to a google-auth credentials class."
48
49
50def _convert_oauth2_credentials(credentials):
51    """Converts to :class:`google.oauth2.credentials.Credentials`.
52
53    Args:
54        credentials (Union[oauth2client.client.OAuth2Credentials,
55            oauth2client.client.GoogleCredentials]): The credentials to
56            convert.
57
58    Returns:
59        google.oauth2.credentials.Credentials: The converted credentials.
60    """
61    new_credentials = google.oauth2.credentials.Credentials(
62        token=credentials.access_token,
63        refresh_token=credentials.refresh_token,
64        token_uri=credentials.token_uri,
65        client_id=credentials.client_id,
66        client_secret=credentials.client_secret,
67        scopes=credentials.scopes,
68    )
69
70    new_credentials._expires = credentials.token_expiry
71
72    return new_credentials
73
74
75def _convert_service_account_credentials(credentials):
76    """Converts to :class:`google.oauth2.service_account.Credentials`.
77
78    Args:
79        credentials (Union[
80            oauth2client.service_account.ServiceAccountCredentials,
81            oauth2client.service_account._JWTAccessCredentials]): The
82            credentials to convert.
83
84    Returns:
85        google.oauth2.service_account.Credentials: The converted credentials.
86    """
87    info = credentials.serialization_data.copy()
88    info["token_uri"] = credentials.token_uri
89    return google.oauth2.service_account.Credentials.from_service_account_info(info)
90
91
92def _convert_gce_app_assertion_credentials(credentials):
93    """Converts to :class:`google.auth.compute_engine.Credentials`.
94
95    Args:
96        credentials (oauth2client.contrib.gce.AppAssertionCredentials): The
97            credentials to convert.
98
99    Returns:
100        google.oauth2.service_account.Credentials: The converted credentials.
101    """
102    return google.auth.compute_engine.Credentials(
103        service_account_email=credentials.service_account_email
104    )
105
106
107def _convert_appengine_app_assertion_credentials(credentials):
108    """Converts to :class:`google.auth.app_engine.Credentials`.
109
110    Args:
111        credentials (oauth2client.contrib.app_engine.AppAssertionCredentials):
112            The credentials to convert.
113
114    Returns:
115        google.oauth2.service_account.Credentials: The converted credentials.
116    """
117    # pylint: disable=invalid-name
118    return google.auth.app_engine.Credentials(
119        scopes=_helpers.string_to_scopes(credentials.scope),
120        service_account_id=credentials.service_account_id,
121    )
122
123
124_CLASS_CONVERSION_MAP = {
125    oauth2client.client.OAuth2Credentials: _convert_oauth2_credentials,
126    oauth2client.client.GoogleCredentials: _convert_oauth2_credentials,
127    oauth2client.service_account.ServiceAccountCredentials: _convert_service_account_credentials,
128    oauth2client.service_account._JWTAccessCredentials: _convert_service_account_credentials,
129    oauth2client.contrib.gce.AppAssertionCredentials: _convert_gce_app_assertion_credentials,
130}
131
132if _HAS_APPENGINE:
133    _CLASS_CONVERSION_MAP[
134        oauth2client.contrib.appengine.AppAssertionCredentials
135    ] = _convert_appengine_app_assertion_credentials
136
137
138def convert(credentials):
139    """Convert oauth2client credentials to google-auth credentials.
140
141    This class converts:
142
143    - :class:`oauth2client.client.OAuth2Credentials` to
144      :class:`google.oauth2.credentials.Credentials`.
145    - :class:`oauth2client.client.GoogleCredentials` to
146      :class:`google.oauth2.credentials.Credentials`.
147    - :class:`oauth2client.service_account.ServiceAccountCredentials` to
148      :class:`google.oauth2.service_account.Credentials`.
149    - :class:`oauth2client.service_account._JWTAccessCredentials` to
150      :class:`google.oauth2.service_account.Credentials`.
151    - :class:`oauth2client.contrib.gce.AppAssertionCredentials` to
152      :class:`google.auth.compute_engine.Credentials`.
153    - :class:`oauth2client.contrib.appengine.AppAssertionCredentials` to
154      :class:`google.auth.app_engine.Credentials`.
155
156    Returns:
157        google.auth.credentials.Credentials: The converted credentials.
158
159    Raises:
160        ValueError: If the credentials could not be converted.
161    """
162
163    credentials_class = type(credentials)
164
165    try:
166        return _CLASS_CONVERSION_MAP[credentials_class](credentials)
167    except KeyError as caught_exc:
168        new_exc = ValueError(_CONVERT_ERROR_TMPL.format(credentials_class))
169        six.raise_from(new_exc, caught_exc)
170