docs(samples): added auth samples and tests #927

Sita04 · 2022-06-08T09:35:22Z

Adding samples for the authentication docs.

See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md

Chizzy09 · 2022-06-18T01:04:07Z

45449b2

piaxc

Hi Sita, feel free to grab a slot on my calendar if you want to discuss any of my comments!

samples/snippets/pom.xml

samples/snippets/src/main/java/AuthWithCredentialsFromMetadataServer.java

samples/snippets/src/main/java/AuthenticateExplicit.java

samples/snippets/src/main/java/AuthenticateImplicitWithAdc.java

samples/snippets/src/main/java/IdTokenFromImpersonatedCredentialsREST.java

samples/snippets/src/main/java/IdTokenFromMetadataServer.java

samples/snippets/src/main/java/IdTokenFromServiceAccount.java

# Conflicts: # samples/snippets/src/main/java/AuthenticateExplicit.java # samples/snippets/src/main/java/AuthenticateImplicitWithAdc.java # samples/snippets/src/main/java/IdTokenFromImpersonatedCredentials.java # samples/snippets/src/main/java/IdTokenFromImpersonatedCredentials_OAuth.java # samples/snippets/src/main/java/IdTokenFromMetadataServer.java # samples/snippets/src/main/java/IdTokenFromServiceAccount.java # samples/snippets/src/main/java/IdTokenFromServiceAccountREST.java # samples/snippets/src/main/java/VerifyNonGoogleIdToken.java # samples/snippets/src/test/java/SnippetsIT.java

piaxc

Thanks Sita!

samples/snippets/src/main/java/AuthenticateExplicit.java

samples/snippets/src/main/java/AuthenticateImplicitWithAdc.java

samples/snippets/src/main/java/IdTokenFromImpersonatedCredentials_IAM.java

samples/snippets/src/main/java/IdTokenFromImpersonatedCredentials_OAuth.java

samples/snippets/src/main/java/AuthenticateImplicitWithAdc.java

samples/snippets/src/main/java/IdTokenFromServiceAccount.java

snippet-bot · 2022-07-22T20:18:13Z

Here is the summary of changes.

You are about to add 5 region tags.

samples/snippets/src/main/java/AuthenticateExplicit.java:17, tag auth_cloud_explicit_adc
samples/snippets/src/main/java/AuthenticateImplicitWithAdc.java:17, tag auth_cloud_implicit_adc
samples/snippets/src/main/java/IdTokenFromMetadataServer.java:17, tag auth_cloud_idtoken_metadata_server
samples/snippets/src/main/java/IdTokenFromServiceAccount.java:17, tag auth_cloud_idtoken_service_account
samples/snippets/src/main/java/VerifyGoogleIdToken.java:17, tag auth_cloud_verify_google_idtoken

This comment is generated by snippet-bot.
If you find problems with this result, please file an issue at:
https://github.com/googleapis/repo-automation-bots/issues.
To update this comment, add snippet-bot:force-run label or use the checkbox below:

Refresh this comment

piaxc

LGTM, thanks Sita!

chingor13 · 2022-07-28T19:29:21Z

samples/snippets/src/main/java/VerifyGoogleIdToken.java

+import com.auth0.jwk.JwkException;
+import com.google.api.client.googleapis.auth.oauth2.GoogleIdToken;
+import com.google.api.client.googleapis.auth.oauth2.GoogleIdToken.Payload;
+import com.google.api.client.googleapis.auth.oauth2.GoogleIdTokenVerifier;


This verifier is from google-api-java-client and was not being maintained. It also had a CVE until recently where we weren't actually validating the signature.

We should instead use the token verifier from this library (like https://github.com/GoogleCloudPlatform/java-docs-samples/blob/96c4f10bf01683d0e0a5b2a44ba4bee1ac5fc507/iap/src/main/java/com/example/iap/VerifyIapRequestHeader.java#L60-L73)

Done. I've made the change you suggested and also removed the third party dependency.
PTAL.

chingor13 · 2022-07-28T19:30:49Z

samples/snippets/src/main/java/VerifyNonGoogleIdToken.java

+  public static void verifyNonGoogleIdToken(String idToken, String targetAudience,
+      String jwkUrl)
+      throws IOException, JwkException {
+
+    // Start verification.
+    DecodedJWT jwt = JWT.decode(idToken);
+
+    // Check if the token has expired.
+    if (jwt.getExpiresAt().before(Calendar.getInstance().getTime())) {
+      System.out.println("Token already expired..");
+      return;
+    }
+
+    // Construct the jwkProvider from the provided jwkURL.
+    JwkProvider jwkProvider = new UrlJwkProvider(new URL(jwkUrl));
+    // Get the jwk from the provided key id.
+    Jwk jwk = jwkProvider.get(jwt.getKeyId());
+    // Retrieve the public key and use that to create an instance of the Algorithm.
+    Algorithm algorithm = Algorithm.RSA256((RSAPublicKey) jwk.getPublicKey(), null);
+    // Create the verifier with the algorithm and target audience.
+    JWTVerifier jwtVerifier = JWT.require(algorithm).withAudience(targetAudience).build();
+
+    boolean isVerified = true;
+    try {
+      // Verify the obtained id token. This is done at the receiving end of the OIDC endpoint.
+      jwt = jwtVerifier.verify(idToken);
+    } catch (JWTVerificationException e) {
+      System.out.println("Could not verify Signature: " + e.getMessage());
+      isVerified = false;
+    }
+
+    if (isVerified) {
+      System.out.println("Id token verified.");
+      return;
+    }
+    System.out.println("Unable to verify ID token.");
+  }


I would recommend that we use our first-party implementation and not require extra third-party dependencies.

kurtisvg · 2022-07-29T02:24:41Z

samples/snippets/src/main/java/AuthenticateExplicit.java

+    // see: https://developers.google.com/identity/protocols/oauth2/scopes
+
+    // Construct the Storage client.
+    Storage storage =


This should use a try/catch and include the warning about making sure to close: disingenuous: https://googlecloudplatform.github.io/samples-style-guide/#clients

I am not sure of this as many of the storage samples look like they don't follow the auto close try-catch..
https://github.com/googleapis/java-storage/blob/main/samples/snippets/src/main/java/com/example/storage/bucket/ListBuckets.java

See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md

…uth-library-java into auth-samples

See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md

…uth-library-java into auth-samples

chingor13

2 non-blocking comments

samples/snippets/src/main/java/VerifyGoogleIdToken.java

# Conflicts: # samples/snippets/src/main/java/VerifyGoogleIdToken.java

Sita04 · 2022-08-04T16:35:52Z

2 non-blocking comments

Thanks Jeff! Included your comments in the sample for further clarification.

See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md

🤖 I have created a release *beep* *boop* --- ## [1.10.0](v1.9.0...v1.10.0) (2022-08-05) ### Features * workforce identity federation for pluggable auth ([#959](#959)) ([7f2c535](7f2c535)) ### Bug Fixes * updates executable response spec for executable-sourced credentials ([#955](#955)) ([48ff83d](48ff83d)) ### Documentation * **samples:** added auth samples and tests ([#927](#927)) ([32c717f](32c717f)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

Sita04 added 4 commits June 6, 2022 19:58

docs(samples): added client code for idtoken, adc and metadata server

3bd604d

docs(samples): added authexplicit and copyright

bd1bc55

docs(samples): add auth with metadata server

ece1c56

docs(samples): minor refactoring and added tests

0c26c33

Sita04 requested review from a team as code owners June 8, 2022 09:35

product-auto-label bot added size: xl Pull request size is extra large. samples Issues that are directly related to samples. labels Jun 8, 2022

blunderbuss-gcf bot assigned kolea2 Jun 8, 2022

🦉 Updates from OwlBot post-processor

45449b2

See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md

Sita04 changed the title ~~Added auth samples and tests~~ docs(samples): added auth samples and tests Jun 8, 2022

Sita04 assigned kolea2 and unassigned kolea2 Jun 8, 2022

Merge branch 'main' into auth-samples

7ef36df

Chizzy09 approved these changes Jun 18, 2022

View reviewed changes

piaxc reviewed Jun 27, 2022

View reviewed changes

Sita04 marked this pull request as draft July 18, 2022 04:33

Sita04 added 2 commits July 18, 2022 15:58

refactored acc to review comments

b2f367e

product-auto-label bot added size: l Pull request size is large. and removed size: xl Pull request size is extra large. labels Jul 18, 2022

Merge branch 'main' into auth-samples

b9dee60

piaxc suggested changes Jul 19, 2022

View reviewed changes

Sita04 added 2 commits July 23, 2022 01:47

refactored acc to review comments

3ed6be0

Merge remote-tracking branch 'origin/auth-samples' into auth-samples

dd39fd4

Sita04 marked this pull request as ready for review July 22, 2022 20:21

Merge branch 'main' into auth-samples

a46ccc4

Sita04 requested a review from a team as a code owner July 25, 2022 17:30

Sita04 requested review from kolea2, chingor13 and kurtisvg July 28, 2022 18:52

Sita04 added 2 commits July 29, 2022 00:43

minor comment update

1baeebe

Merge remote-tracking branch 'origin/auth-samples' into auth-samples

9fc3a7a

piaxc approved these changes Jul 28, 2022

View reviewed changes

chingor13 reviewed Jul 28, 2022

View reviewed changes

kurtisvg approved these changes Jul 29, 2022

View reviewed changes

Sita04 and others added 8 commits July 30, 2022 00:01

Merge branch 'main' into auth-samples

b8c5f3f

modified google id token verification and removed third party dependency

680cfdd

Merge remote-tracking branch 'origin/auth-samples' into auth-samples

1944e5d

removed third party deps from pom

a943290

🦉 Updates from OwlBot post-processor

d7d6257

See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md

Merge branch 'auth-samples' of https://github.com/googleapis/google-a…

cf11754

…uth-library-java into auth-samples

🦉 Updates from OwlBot post-processor

b910be5

See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md

Merge branch 'auth-samples' of https://github.com/googleapis/google-a…

e23fe35

…uth-library-java into auth-samples

Sita04 requested a review from chingor13 July 29, 2022 19:19

Sita04 added 2 commits July 30, 2022 02:50

Merge branch 'main' into auth-samples

ada91fb

Merge branch 'main' into auth-samples

8573bb3

chingor13 approved these changes Aug 4, 2022

View reviewed changes

samples/snippets/src/main/java/VerifyGoogleIdToken.java Outdated Show resolved Hide resolved

samples/snippets/src/main/java/VerifyGoogleIdToken.java Show resolved Hide resolved

Sita04 added 2 commits August 4, 2022 22:03

included comment about verifying Google ID tokens

591d0e6

Merge remote-tracking branch 'origin/auth-samples' into auth-samples

82d7350

# Conflicts: # samples/snippets/src/main/java/VerifyGoogleIdToken.java

🦉 Updates from OwlBot post-processor

54013b5

See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md

Sita04 merged commit 32c717f into main Aug 4, 2022

Sita04 deleted the auth-samples branch August 4, 2022 16:47

release-please bot mentioned this pull request Aug 4, 2022

chore(main): release 1.10.0 #962

Merged

release-please bot mentioned this pull request Aug 11, 2022

chore(main): release 1.11.0 #974

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

docs(samples): added auth samples and tests #927

docs(samples): added auth samples and tests #927

Sita04 commented Jun 8, 2022

Chizzy09 commented Jun 18, 2022

piaxc left a comment

piaxc left a comment

snippet-bot bot commented Jul 22, 2022 •

edited

piaxc left a comment

chingor13 Jul 28, 2022

Sita04 Jul 29, 2022

chingor13 Jul 28, 2022

kurtisvg Jul 29, 2022

Sita04 Jul 29, 2022

chingor13 left a comment

Sita04 commented Aug 4, 2022

docs(samples): added auth samples and tests #927

docs(samples): added auth samples and tests #927

Conversation

Sita04 commented Jun 8, 2022

Chizzy09 commented Jun 18, 2022

piaxc left a comment

Choose a reason for hiding this comment

piaxc left a comment

Choose a reason for hiding this comment

snippet-bot bot commented Jul 22, 2022 • edited

piaxc left a comment

Choose a reason for hiding this comment

chingor13 Jul 28, 2022

Choose a reason for hiding this comment

Sita04 Jul 29, 2022

Choose a reason for hiding this comment

chingor13 Jul 28, 2022

Choose a reason for hiding this comment

kurtisvg Jul 29, 2022

Choose a reason for hiding this comment

Sita04 Jul 29, 2022

Choose a reason for hiding this comment

chingor13 left a comment

Choose a reason for hiding this comment

Sita04 commented Aug 4, 2022

snippet-bot bot commented Jul 22, 2022 •

edited