Class ComputeEngineCredentials (1.4.0)

public class ComputeEngineCredentials extends GoogleCredentials implements ServiceAccountSigner, IdTokenProvider

OAuth2 credentials representing the built-in service account for a Google Compute Engine VM.

Fetches access tokens from the Google Compute Engine metadata server.

These credentials use the IAM API to sign data. See #sign(byte[]) for more details.

Inheritance

Object > Credentials > OAuth2Credentials > GoogleCredentials > ComputeEngineCredentials

Implements

ServiceAccountSigner, IdTokenProvider

Inherited Members

Credentials.blockingGetToCallback(URI,RequestMetadataCallback)

Credentials.getRequestMetadata()

GoogleCredentials.create(AccessToken)

GoogleCredentials.createDelegated(String)

GoogleCredentials.createScoped(String)

GoogleCredentials.createScoped(Collection<String>)

GoogleCredentials.createScoped(Collection<String>,Collection<String>)

GoogleCredentials.createScopedRequired()

GoogleCredentials.fromStream(InputStream)

GoogleCredentials.fromStream(InputStream,HttpTransportFactory)

GoogleCredentials.getApplicationDefault()

GoogleCredentials.getApplicationDefault(HttpTransportFactory)

GoogleCredentials.newBuilder()

GoogleCredentials.toBuilder()

OAuth2Credentials.<T>getFromServiceLoader(Class<? extends T>,T)

OAuth2Credentials.<T>newInstance(String)

OAuth2Credentials.addChangeListener(OAuth2Credentials.CredentialsChangedListener)

OAuth2Credentials.equals(Object)

OAuth2Credentials.getAccessToken()

OAuth2Credentials.getAdditionalHeaders()

OAuth2Credentials.getAuthenticationType()

OAuth2Credentials.getRequestMetadata(URI)

OAuth2Credentials.getRequestMetadata(URI,Executor,RequestMetadataCallback)

OAuth2Credentials.getRequestMetadataInternal()

OAuth2Credentials.hasRequestMetadata()

OAuth2Credentials.hasRequestMetadataOnly()

OAuth2Credentials.hashCode()

OAuth2Credentials.refresh()

OAuth2Credentials.refreshAccessToken()

OAuth2Credentials.refreshIfExpired()

OAuth2Credentials.removeChangeListener(OAuth2Credentials.CredentialsChangedListener)

OAuth2Credentials.toString()

Object.clone()

Object.finalize()

Object.getClass()

Object.notify()

Object.notifyAll()

Object.wait()

Object.wait(long)

Object.wait(long,int)

Static Methods

create()

public static ComputeEngineCredentials create()

Create a new ComputeEngineCredentials instance with default behavior.

Returns

Type	Description
ComputeEngineCredentials	new ComputeEngineCredentials

getIdentityDocumentUrl()

public static String getIdentityDocumentUrl()

Returns

Type	Description
String

getMetadataServerUrl()

public static String getMetadataServerUrl()

Returns

Type	Description
String

getMetadataServerUrl(DefaultCredentialsProvider provider)

public static String getMetadataServerUrl(DefaultCredentialsProvider provider)

Parameter

Name	Description
provider	`com.google.auth.oauth2.DefaultCredentialsProvider`

Returns

Type	Description
String

getServiceAccountsUrl()

public static String getServiceAccountsUrl()

Returns

Type	Description
String

getTokenServerEncodedUrl()

public static String getTokenServerEncodedUrl()

Returns

Type	Description
String

getTokenServerEncodedUrl(DefaultCredentialsProvider provider)

public static String getTokenServerEncodedUrl(DefaultCredentialsProvider provider)

Parameter

Name	Description
provider	`com.google.auth.oauth2.DefaultCredentialsProvider`

Returns

Type	Description
String

newBuilder()

public static ComputeEngineCredentials.Builder newBuilder()

Returns

Type	Description
ComputeEngineCredentials.Builder

Methods

createScoped(Collection<String> newScopes)

public GoogleCredentials createScoped(Collection<String> newScopes)

Clones the compute engine account with the specified scopes.

Parameter

Name	Description
newScopes	`Collection<String>`

Returns

Type	Description
GoogleCredentials

Overrides

GoogleCredentials.createScoped(Collection<String> scopes)

createScoped(Collection<String> newScopes, Collection<String> newDefaultScopes)

public GoogleCredentials createScoped(Collection<String> newScopes, Collection<String> newDefaultScopes)

Clones the compute engine account with the specified scopes.

Parameters

Name	Description
newScopes	`Collection<String>`
newDefaultScopes	`Collection<String>`

Returns

Type	Description
GoogleCredentials

Overrides

GoogleCredentials.createScoped(Collection<String> scopes, Collection<String> defaultScopes)

equals(Object obj)

public boolean equals(Object obj)

Parameter

Name	Description
obj	`Object`

Returns

Type	Description
boolean

Overrides

OAuth2Credentials.equals(Object obj)

getAccount()

public String getAccount()

Returns the email address associated with the GCE default service account.

Returns

Type	Description
String

getScopes()

public final Collection<String> getScopes()

Returns

Type	Description
Collection<String>

hashCode()

public int hashCode()

Returns

Type	Description
int

Overrides

OAuth2Credentials.hashCode()

idTokenWithAudience(String targetAudience, List<IdTokenProvider.Option> options)

public IdToken idTokenWithAudience(String targetAudience, List<IdTokenProvider.Option> options)

Returns a Google ID Token from the metadata server on ComputeEngine

Parameters

Name	Description
targetAudience	`String` the aud: field the IdToken should include
options	`List<Option>` list of Credential specific options for the token. For example, an IDToken for a ComputeEngineCredential could have the full formatted claims returned if IdTokenProvider.Option.FORMAT_FULL) is provided as a list option. Valid option values are: IdTokenProvider.Option.FORMAT_FULL IdTokenProvider.Option.LICENSES_TRUE If no options are set, the defaults are "&format=standard&licenses=false"

Returns

Type	Description
IdToken	IdToken object which includes the raw id_token, JsonWebSignature

Exceptions

Type	Description
IOException	if the attempt to get an IdToken failed

refreshAccessToken()

public AccessToken refreshAccessToken()

Refresh the access token by getting it from the GCE metadata server

Returns

Type	Description
AccessToken

Overrides

OAuth2Credentials.refreshAccessToken()

Exceptions

Type	Description
IOException

sign(byte[] toSign)

public byte[] sign(byte[] toSign)

Signs the provided bytes using the private key associated with the service account.

The Compute Engine's project must enable the Identity and Access Management (IAM) API and the instance's service account must have the iam.serviceAccounts.signBlob permission. See Also: <xref uid="Blob Signing" data-throw-if-not-resolved="false">Blob Signing

Parameter

Name	Description
toSign	`byte[]` bytes to sign

Returns

Type	Description
byte[]	signed bytes

toBuilder()

public ComputeEngineCredentials.Builder toBuilder()

Returns

Type	Description
ComputeEngineCredentials.Builder

Overrides

GoogleCredentials.toBuilder()

toString()

public String toString()

Returns

Type	Description
String

Overrides

OAuth2Credentials.toString()