Skip to content

ServiceOptions.java: Extract projectId from credentials when provided via .setCredentials` #3386

Closed

Description

@jabubake

Handwritten clients that use ServiceOptions:

when .setCredentials is used, the project id is not extracted from the service account.
This behavior is different when service account credentials are supplied via GOOGLE_APPLICATION_CREDENTIALS env var (project id is extracted)

https://github.com/GoogleCloudPlatform/google-cloud-java/blob/master/google-cloud-clients/google-cloud-core/src/main/java/com/google/cloud/ServiceOptions.java#L465

Similar issue for BigQuery:
GoogleCloudPlatform/java-docs-samples#936

Activity

  1. jabubake commented on Jun 15, 2018

    @jabubake
    ContributorAuthor
  2. hostirosti commented on Jun 15, 2018

    @hostirosti

    Example:

    GoogleCredentials creds;
    try {
       InputStream is = MyClass.class.getClassLoader().getResourceAsStream("service_account.json");
       creds = GoogleCredentials.fromStream(is);
    } catch (IOException e) {
       e.printStackTrace();
       return;
    }
    
    ServiceOptions.newBuilder().setCredentials(creds)...
    
  3. added
    type: questionRequest for information or clarification. Not an issue.
    priority: p2Moderately-important priority. Fix may not be included in next release.
    and removed
    triage meI really want to be triaged.
    on Jun 15, 2018
  4. yihanzhen commented on Jun 15, 2018

    @yihanzhen
    Contributor

    ServiceOptions sets projectId and credentials separately. It would first look for projectId in this sequence, and then look for credentials in this sequence. The reason you have the same projectId when you set the credentials through GOOGLE_APPLICATION_CREDENTIALS is that this json file is the first place ServiceOptions looks for both projectId and credentials if neither of them is set explicitly.

    Though there has been discussions over whether we should extract the projectId from a ServiceAccountCredentials when the credentials is explicitly passed to the ServiceOptions, we generally consider the current behavior intended. Besides, it is possible that users might want the projectId to be different from what is provided in the ServiceAccountCredentials json file.

    We encourage people to use GOOGLE_APPLICATION_CREDENTIALS environment variable over other authentication approaches whenever possible. If you have to manually create and set a credentials, please also set the projectId:

    ServiceOptions options = ServiceOptions.newBuilder()
        .setCredentials(credentials)
        .setProjectId("[project-id]")
        .build();
    
  5. self-assigned this
    on Jun 15, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

api: corepriority: p2Moderately-important priority. Fix may not be included in next release.type: questionRequest for information or clarification. Not an issue.

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions