|author||Ryan Kohler <firstname.lastname@example.org>||Tue Oct 05 14:39:06 2021 +0000|
|committer||Cody Oss <email@example.com>||Tue Oct 05 18:02:43 2021 +0000|
google/externalaccount: add support for workforce pool credentials Workforce pools (external account credentials for non-Google users) are organization-level resources which means that issued workforce pool tokens will not have any client project ID on token exchange as currently designed. "To use a Google API, the client must identify the application to the server. If the API requires authentication, the client must also identify the principal running the application." The application here is the client project. The token will identify the user principal but not the application. This will result in APIs rejecting requests authenticated with these tokens. Note that passing a x-goog-user-project override header on API request is still not sufficient. The token is still expected to have a client project. As a result, we have extended the spec to support an additional workforce_pool_user_project for these credentials (workforce pools) which will be passed when exchanging an external token for a Google Access token. After the exchange, the issued access token will use the supplied project as the client project. The underlying principal must still have serviceusage.services.use IAM permission to use the project for billing/quota. This field is not needed for flows with basic client authentication (e.g. client ID is supplied). The client ID is sufficient to determine the client project and any additionally supplied workforce_pool_user_project value will be ignored. Note that this feature is not usable yet publicly. Change-Id: I8311d7783e4048c260cbb68e90d3565df864d7e0 GitHub-Last-Rev: a6dc5ebc95207b4cf04a0f3df45e745b24cd76c4 GitHub-Pull-Request: golang/oauth2#520 Reviewed-on: https://go-review.googlesource.com/c/oauth2/+/353393 Reviewed-by: Cody Oss <firstname.lastname@example.org> Reviewed-by: Bassam Ojeil <email@example.com> Trust: Cody Oss <firstname.lastname@example.org> Trust: Tyler Bui-Palsulich <email@example.com> Run-TryBot: Cody Oss <firstname.lastname@example.org> TryBot-Result: Go Bot <email@example.com>
oauth2 package contains a client implementation for OAuth 2.0 spec.
go get golang.org/x/oauth2
Or you can manually git clone the repository to
$(go env GOPATH)/src/golang.org/x/oauth2.
See pkg.go.dev for further documentation and examples.
We no longer accept new provider-specific packages in this repo if all they do is add a single endpoint variable. If you just want to add a single endpoint, add it to the pkg.go.dev/golang.org/x/oauth2/endpoints package.
This repository uses Gerrit for code changes. To learn how to submit changes to this repository, see https://golang.org/doc/contribute.html.
The main issue tracker for the oauth2 repository is located at https://github.com/golang/oauth2/issues.