1 # Copyright 2010 Google Inc.
3 # Licensed under the Apache License, Version 2.0 (the "License");
4 # you may not use this file except in compliance with the License.
5 # You may obtain a copy of the License at
7 # http://www.apache.org/licenses/LICENSE-2.0
9 # Unless required by applicable law or agreed to in writing, software
10 # distributed under the License is distributed on an "AS IS" BASIS,
11 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 # See the License for the specific language governing permissions and
13 # limitations under the License.
16 require 'signet/oauth_2/client'
21 # Helper for loading keys from the PKCS12 files downloaded when
22 # setting up service accounts at the APIs Console.
28 # Loads a key from PKCS12 file, assuming a single private key
31 # @param [String] keyfile
32 # Path of the PKCS12 file to load. If not a path to an actual file,
33 # assumes the string is the content of the file itself.
34 # @param [String] passphrase
35 # Passphrase for unlocking the private key
37 # @return [OpenSSL::PKey] The private key for signing assertions.
38 def self.load_key(keyfile, passphrase)
40 if File.exists?(keyfile)
41 content = File.read(keyfile)
45 pkcs12 = OpenSSL::PKCS12.new(content, passphrase)
47 rescue OpenSSL::PKCS12::PKCS12Error
48 raise ArgumentError.new("Invalid keyfile or passphrase")
54 # Generates access tokens using the JWT assertion profile. Requires a
55 # service account & access to the private key.
59 # client = Google::APIClient.new
60 # key = Google::APIClient::PKCS12.load_key('client.p12', 'notasecret')
61 # service_account = Google::APIClient::JWTAsserter(
62 # '123456-abcdef@developer.gserviceaccount.com',
63 # 'https://www.googleapis.com/auth/prediction',
65 # client.authorization = service_account.authorize
68 # @see https://developers.google.com/accounts/docs/OAuth2ServiceAccount
70 # @return [String] ID/email of the issuing party
72 # @return [Fixnum] How long, in seconds, the assertion is valid for
74 # @return [Fixnum] Seconds to expand the issued at/expiry window to account for clock skew
76 # @return [String] Scopes to authorize
78 # @return [OpenSSL::PKey] key for signing assertions
82 # Initializes the asserter for a service account.
84 # @param [String] issuer
85 # Name/ID of the client issuing the assertion
86 # @param [String, Array] scope
87 # Scopes to authorize. May be a space delimited string or array of strings
88 # @param [OpenSSL::PKey] key
89 # RSA private key for signing assertions
90 def initialize(issuer, scope, key)
93 self.expiry = 60 # 1 min default
99 # Set the scopes to authorize
101 # @param [String, Array] new_scope
102 # Scopes to authorize. May be a space delimited string or array of strings
103 def scope=(new_scope)
106 @scope = new_scope.join(' ')
112 raise TypeError, "Expected Array or String, got #{new_scope.class}"
117 # Builds & signs the assertion.
119 # @param [String] person
120 # Email address of a user, if requesting a token to act on their behalf
121 # @return [String] Encoded JWT
122 def to_jwt(person=nil)
126 "scope" => self.scope,
127 "aud" => "https://accounts.google.com/o/oauth2/token",
128 "exp" => (now + expiry).to_i,
129 "iat" => (now - skew).to_i
131 assertion['prn'] = person unless person.nil?
132 return JWT.encode(assertion, @key, "RS256")
136 # Request a new access token.
138 # @param [String] person
139 # Email address of a user, if requesting a token to act on their behalf
140 # @param [Hash] options
141 # Pass through to Signet::OAuth2::Client.fetch_access_token
142 # @return [Signet::OAuth2::Client] Access token
144 # @see Signet::OAuth2::Client.fetch_access_token
145 def authorize(person = nil, options={})
146 assertion = self.to_jwt(person)
147 authorization = Signet::OAuth2::Client.new(
148 :token_credential_uri => 'https://accounts.google.com/o/oauth2/token'
150 authorization.grant_type = 'urn:ietf:params:oauth:grant-type:jwt-bearer'
151 authorization.extension_parameters = { :assertion => assertion }
152 authorization.fetch_access_token!(options)