com.google.auth.oauth2

Class ComputeEngineCredentials

java.lang.Object

com.google.auth.Credentials

com.google.auth.oauth2.OAuth2Credentials

com.google.auth.oauth2.GoogleCredentials

com.google.auth.oauth2.ComputeEngineCredentials

All Implemented Interfaces:

ServiceAccountSigner, Serializable

public class ComputeEngineCredentials
extends GoogleCredentials
implements ServiceAccountSigner

OAuth2 credentials representing the built-in service account for a Google Compute Engine VM.

Fetches access tokens from the Google Compute Engine metadata server.

These credentials use the IAM API to sign data. See sign(byte[]) for more details.

See Also:

Serialized Form

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	ComputeEngineCredentials.Builder

Nested classes/interfaces inherited from class com.google.auth.oauth2.OAuth2Credentials

OAuth2Credentials.CredentialsChangedListener

Nested classes/interfaces inherited from interface com.google.auth.ServiceAccountSigner

ServiceAccountSigner.SigningException

Constructor Summary

Constructors

Constructor and Description
ComputeEngineCredentials() Deprecated. Use create() instead. This constructor will either be deleted or made private in a later version.
ComputeEngineCredentials(HttpTransportFactory transportFactory) Deprecated. Use newBuilder() instead. This constructor will either be deleted or made private in a later version.

Method Summary

Modifier and Type	Method and Description
static ComputeEngineCredentials	create() Create a new ComputeEngineCredentials instance with default behavior.
boolean	equals(Object obj)
String	getAccount()
static String	getMetadataServerUrl()
static String	getMetadataServerUrl(com.google.auth.oauth2.DefaultCredentialsProvider provider)
static String	getServiceAccountsUrl()
static String	getTokenServerEncodedUrl()
static String	getTokenServerEncodedUrl(com.google.auth.oauth2.DefaultCredentialsProvider provider)
int	hashCode()
static ComputeEngineCredentials.Builder	newBuilder()
static ComputeEngineCredentials	of(HttpTransportFactory transportFactory) Deprecated. Use newBuilder() instead. This constructor will either be deleted or made private in a later version.
AccessToken	refreshAccessToken() Refresh the access token by getting it from the GCE metadata server
byte[]	sign(byte[] toSign) Signs the provided bytes using the private key associated with the service account.
ComputeEngineCredentials.Builder	toBuilder()
String	toString()

Methods inherited from class com.google.auth.oauth2.GoogleCredentials

create, createDelegated, createScoped, createScopedRequired, fromStream, fromStream, getApplicationDefault, getApplicationDefault, of

Methods inherited from class com.google.auth.oauth2.OAuth2Credentials

addChangeListener, getAccessToken, getAuthenticationType, getFromServiceLoader, getRequestMetadata, getRequestMetadata, getRequestMetadataInternal, hasRequestMetadata, hasRequestMetadataOnly, newInstance, refresh, refreshIfExpired, removeChangeListener

Methods inherited from class com.google.auth.Credentials

blockingGetToCallback, getRequestMetadata

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, wait, wait, wait

Constructor Detail

ComputeEngineCredentials

@Deprecated
public ComputeEngineCredentials()

Deprecated. Use create() instead. This constructor will either be deleted or made private in a later version.

Create a new ComputeEngineCredentials instance with default behavior.

ComputeEngineCredentials

@Deprecated
public ComputeEngineCredentials(HttpTransportFactory transportFactory)

Deprecated. Use newBuilder() instead. This constructor will either be deleted or made private in a later version.

Constructor with overridden transport.

Parameters:

transportFactory - HTTP transport factory, creates the transport used to get access tokens.

Method Detail

of

@Deprecated
public static ComputeEngineCredentials of(HttpTransportFactory transportFactory)

Deprecated. Use newBuilder() instead. This constructor will either be deleted or made private in a later version.

Returns a credentials instance from the given transport factory

Parameters:

transportFactory - The Http transport factory

Returns:

the credential instance

create

public static ComputeEngineCredentials create()

Create a new ComputeEngineCredentials instance with default behavior.

refreshAccessToken

public AccessToken refreshAccessToken()
                               throws IOException

Refresh the access token by getting it from the GCE metadata server

Overrides:

refreshAccessToken in class OAuth2Credentials

Throws:

IOException - from derived implementations

getMetadataServerUrl

public static String getMetadataServerUrl(com.google.auth.oauth2.DefaultCredentialsProvider provider)

getMetadataServerUrl

public static String getMetadataServerUrl()

getTokenServerEncodedUrl

public static String getTokenServerEncodedUrl(com.google.auth.oauth2.DefaultCredentialsProvider provider)

getTokenServerEncodedUrl

public static String getTokenServerEncodedUrl()

getServiceAccountsUrl

public static String getServiceAccountsUrl()

hashCode

public int hashCode()

Overrides:

hashCode in class OAuth2Credentials

toString

public String toString()

Overrides:

toString in class OAuth2Credentials

equals

public boolean equals(Object obj)

Overrides:

equals in class OAuth2Credentials

toBuilder

public ComputeEngineCredentials.Builder toBuilder()

Overrides:

toBuilder in class GoogleCredentials

newBuilder

public static ComputeEngineCredentials.Builder newBuilder()

getAccount

public String getAccount()

Specified by:

getAccount in interface ServiceAccountSigner

sign

public byte[] sign(byte[] toSign)

Signs the provided bytes using the private key associated with the service account.

The Compute Engine's project must enable the Identity and Access Management (IAM) API and the instance's service account must have the iam.serviceAccounts.signBlob permission.

Specified by:

sign in interface ServiceAccountSigner

Parameters:

toSign - bytes to sign

Returns:

signed bytes

Throws:

SigningException - if the attempt to sign the provided bytes failed

See Also:

Blob Signing