AppIdentityCredentials
extends CredentialsLoader
in package
implements
SignBlobInterface, ProjectIdProviderInterface
AppIdentityCredentials supports authorization on Google App Engine.
It can be used to authorize requests using the AuthTokenMiddleware or AuthTokenSubscriber, but will only succeed if being run on App Engine:
Example:
use Google\Auth\Credentials\AppIdentityCredentials;
use Google\Auth\Middleware\AuthTokenMiddleware;
use GuzzleHttp\Client;
use GuzzleHttp\HandlerStack;
$gae = new AppIdentityCredentials('https://www.googleapis.com/auth/books');
$middleware = new AuthTokenMiddleware($gae);
$stack = HandlerStack::create();
$stack->push($middleware);
$client = new Client([
'handler' => $stack,
'base_uri' => 'https://www.googleapis.com/books/v1',
'auth' => 'google_auth'
]);
$res = $client->get('volumes?q=Henry+David+Thoreau&country=US');
Table of Contents
Interfaces
- SignBlobInterface
- Describes a class which supports signing arbitrary strings.
- ProjectIdProviderInterface
- Describes a Credentials object which supports fetching the project ID.
Constants
- ENV_VAR = 'GOOGLE_APPLICATION_CREDENTIALS'
- NON_WINDOWS_WELL_KNOWN_PATH_BASE = '.config'
- TOKEN_CREDENTIAL_URI = 'https://oauth2.googleapis.com/token'
- WELL_KNOWN_PATH = 'gcloud/application_default_credentials.json'
Properties
- $lastReceivedToken : array<string|int, mixed>
- Result of fetchAuthToken.
- $clientName : string
- $scope : array<string|int, mixed>
- Array of OAuth2 scopes to be requested.
Methods
- __construct() : mixed
- fetchAuthToken() : array<string|int, mixed>
- Implements FetchAuthTokenInterface#fetchAuthToken.
- fromEnv() : array<string|int, mixed>|null
- Load a JSON key from the path specified in the environment.
- fromWellKnownFile() : array<string|int, mixed>|null
- Load a JSON key from a well known path.
- getCacheKey() : string
- Caching is handled by the underlying AppIdentityService, return empty string to prevent caching.
- getClientName() : string
- Get the client name from AppIdentityService.
- getLastReceivedToken() : array<string|int, mixed>|null
- Returns an associative array with the token and expiration time.
- getProjectId() : string|null
- Get the project ID from AppIdentityService.
- getUpdateMetadataFunc() : array<string|int, mixed>
- export a callback function which updates runtime metadata.
- makeCredentials() : ServiceAccountCredentials|UserRefreshCredentials
- Create a new Credentials instance.
- makeHttpClient() : Client
- Create an authorized HTTP Client from an instance of FetchAuthTokenInterface.
- makeInsecureCredentials() : InsecureCredentials
- Create a new instance of InsecureCredentials.
- onAppEngine() : bool
- Determines if this an App Engine instance, by accessing the SERVER_SOFTWARE environment variable (prod) or the APPENGINE_RUNTIME environment variable (dev).
- signBlob() : string
- Sign a string using AppIdentityService.
- updateMetadata() : array<string|int, mixed>
- Updates metadata with the authorization token.
- checkAppEngineContext() : mixed
- getGuzzleMajorVersion() : int
- Returns the currently available major Guzzle version.
- isOnWindows() : bool
- unableToReadEnv() : string
Constants
ENV_VAR
public
mixed
ENV_VAR
= 'GOOGLE_APPLICATION_CREDENTIALS'
NON_WINDOWS_WELL_KNOWN_PATH_BASE
public
mixed
NON_WINDOWS_WELL_KNOWN_PATH_BASE
= '.config'
TOKEN_CREDENTIAL_URI
public
mixed
TOKEN_CREDENTIAL_URI
= 'https://oauth2.googleapis.com/token'
WELL_KNOWN_PATH
public
mixed
WELL_KNOWN_PATH
= 'gcloud/application_default_credentials.json'
Properties
$lastReceivedToken
Result of fetchAuthToken.
protected
array<string|int, mixed>
$lastReceivedToken
$clientName
private
string
$clientName
$scope
Array of OAuth2 scopes to be requested.
private
array<string|int, mixed>
$scope
Methods
__construct()
public
__construct([array<string|int, mixed> $scope = array() ]) : mixed
Parameters
- $scope : array<string|int, mixed> = array()
-
One or more scopes.
fetchAuthToken()
Implements FetchAuthTokenInterface#fetchAuthToken.
public
fetchAuthToken([callable $httpHandler = null ]) : array<string|int, mixed>
Fetches the auth tokens using the AppIdentityService if available. As the AppIdentityService uses protobufs to fetch the access token, the GuzzleHttp\ClientInterface instance passed in will not be used.
Parameters
- $httpHandler : callable = null
-
callback which delivers psr7 request
Return values
array<string|int, mixed> —A set of auth related metadata, containing the following keys: - access_token (string) - expiration_time (string)
fromEnv()
Load a JSON key from the path specified in the environment.
public
static fromEnv() : array<string|int, mixed>|null
Load a JSON key from the path specified in the environment variable GOOGLE_APPLICATION_CREDENTIALS. Return null if GOOGLE_APPLICATION_CREDENTIALS is not specified.
Return values
array<string|int, mixed>|null —JSON key | null
fromWellKnownFile()
Load a JSON key from a well known path.
public
static fromWellKnownFile() : array<string|int, mixed>|null
The well known path is OS dependent:
- windows: %APPDATA%/gcloud/application_default_credentials.json
- others: $HOME/.config/gcloud/application_default_credentials.json
If the file does not exist, this returns null.
Return values
array<string|int, mixed>|null —JSON key | null
getCacheKey()
Caching is handled by the underlying AppIdentityService, return empty string to prevent caching.
public
getCacheKey() : string
Return values
stringgetClientName()
Get the client name from AppIdentityService.
public
getClientName([callable $httpHandler = null ]) : string
Subsequent calls to this method will return a cached value.
Parameters
- $httpHandler : callable = null
-
Not used in this implementation.
Tags
Return values
stringgetLastReceivedToken()
Returns an associative array with the token and expiration time.
public
getLastReceivedToken() : array<string|int, mixed>|null
Return values
array<string|int, mixed>|nullgetProjectId()
Get the project ID from AppIdentityService.
public
getProjectId([callable $httpHander = null ]) : string|null
Returns null if AppIdentityService is unavailable.
Parameters
- $httpHander : callable = null
Return values
string|nullgetUpdateMetadataFunc()
export a callback function which updates runtime metadata.
public
getUpdateMetadataFunc() : array<string|int, mixed>
Return values
array<string|int, mixed> —updateMetadata function
makeCredentials()
Create a new Credentials instance.
public
static makeCredentials(string|array<string|int, mixed> $scope, array<string|int, mixed> $jsonKey[, string|array<string|int, mixed> $defaultScope = null ]) : ServiceAccountCredentials|UserRefreshCredentials
Parameters
- $scope : string|array<string|int, mixed>
-
the scope of the access request, expressed either as an Array or as a space-delimited String.
- $jsonKey : array<string|int, mixed>
-
the JSON credentials.
- $defaultScope : string|array<string|int, mixed> = null
-
The default scope to use if no user-defined scopes exist, expressed either as an Array or as a space-delimited string.
Return values
ServiceAccountCredentials|UserRefreshCredentialsmakeHttpClient()
Create an authorized HTTP Client from an instance of FetchAuthTokenInterface.
public
static makeHttpClient(FetchAuthTokenInterface $fetcher[, array<string|int, mixed> $httpClientOptions = [] ][, callable $httpHandler = null ][, callable $tokenCallback = null ]) : Client
Parameters
- $fetcher : FetchAuthTokenInterface
-
is used to fetch the auth token
- $httpClientOptions : array<string|int, mixed> = []
-
(optional) Array of request options to apply.
- $httpHandler : callable = null
-
(optional) http client to fetch the token.
- $tokenCallback : callable = null
-
(optional) function to be called when a new token is fetched.
Return values
ClientmakeInsecureCredentials()
Create a new instance of InsecureCredentials.
public
static makeInsecureCredentials() : InsecureCredentials
Return values
InsecureCredentialsonAppEngine()
Determines if this an App Engine instance, by accessing the SERVER_SOFTWARE environment variable (prod) or the APPENGINE_RUNTIME environment variable (dev).
public
static onAppEngine() : bool
Return values
bool —true if this an App Engine Instance, false otherwise
signBlob()
Sign a string using AppIdentityService.
public
signBlob(string $stringToSign[, bool $forceOpenSsl = false ]) : string
Parameters
- $stringToSign : string
-
The string to sign.
- $forceOpenSsl : bool = false
-
[optional] Does not apply to this credentials type.
Tags
Return values
string —The signature, base64-encoded.
updateMetadata()
Updates metadata with the authorization token.
public
updateMetadata(array<string|int, mixed> $metadata[, string $authUri = null ][, callable $httpHandler = null ]) : array<string|int, mixed>
Parameters
- $metadata : array<string|int, mixed>
-
metadata hashmap
- $authUri : string = null
-
optional auth uri
- $httpHandler : callable = null
-
callback which delivers psr7 request
Return values
array<string|int, mixed> —updated metadata hashmap
checkAppEngineContext()
private
checkAppEngineContext() : mixed
getGuzzleMajorVersion()
Returns the currently available major Guzzle version.
private
static getGuzzleMajorVersion() : int
Return values
intisOnWindows()
private
static isOnWindows() : bool
Return values
boolunableToReadEnv()
private
static unableToReadEnv(string $cause) : string
Parameters
- $cause : string