0

Google Cloud seems to offer 2 versions of their API client libraries: Google API Client Libraries and Google Cloud Client Libraries. The latter seems to be the successor to the former.

Now, the legacy Google API Client Libraries offered a way to create a ServiceAccountCredential from a certificate via a FromCertificate() method. I can't seem to find a way to do that in the Google Cloud Client Libraries. Seems like the only way to access a Google service using the Google Cloud Client Libraries when you're not running in GCP is to download a service account key (JSON) and store it in a file, then provide that to the libraries via an environment variable.

So, is auth from a certificate for Google Cloud Client Libraries not supported?

5
  • Your question seems to assume there are two different auth libraries - there aren't. You can authenticate in Google Cloud Client Libraries using a ServiceAccountCredential loaded with FromCertificate. See googleapis.github.io/google-cloud-dotnet/docs/…
    – Jon Skeet
    Commented Jan 12, 2021 at 17:02
  • Thanks for the comment, Jon. Sorry, I couldn't find where on that page you linked to that it described how you could use a ServiceAccountCredential to log into Google Cloud Client Libraries. I don't see ServiceAccountCredential listed on that page at all.
    – Kevin Wong
    Commented Jan 13, 2021 at 14:16
  • No, because it's not SAC-specific - it's any credential. Follow the UserCredential example, just using a ServiceAccountCredential.
    – Jon Skeet
    Commented Jan 13, 2021 at 14:45
  • Ah, thx. I'll try that.
    – Kevin Wong
    Commented Jan 18, 2021 at 14:32
  • This Cloud Pub/Sub playlist is EXCELLENT! youtube.com/… Commented Sep 22, 2021 at 14:55

1 Answer 1

2

So, is auth from a certificate for Google Cloud Client Libraries not supported?

Depends on the definition of auth using a certificate. Google Cloud SDKs and respective APIs do not support certificate authorization. The only part of a certificate that Google uses is the private key. The same private key that exists in both P12/PFX certificate files and JSON key files.

The P12/PFX certificate format is legacy and is no longer recommended. The newer JSON key format contains more information which improves items like key lookup during validation. However, the only required item is the private key which is the same for both formats but encoded differently (Binary versus PEM).

Seems like the only way to access a Google service using the Google Cloud Client Libraries when you're not running in GCP is to download a service account key (JSON) and store it in a file, then provide that to the libraries via an environment variable.

I think you are making an incorrect assumption that you can create your own certificate file and use that for authorization. You can only use private keys that are generated by Google Cloud. Therefore you have the same limitation for both P12/PFX certificate files and for JSON key files. You must download both types unless you are using service account impersonation or running on a Google Cloud service that supports the Metadata server for fetching tokens.

Now, the legacy Google API Client Libraries offered a way to create a ServiceAccountCredential from a certificate via a FromCertificate() method. I can't seem to find a way to do that in the Google Cloud Client Libraries.

The libraries support loading service accounts from JSON. You can extract the private key from a P12/PFX certificate, encode in PEM, build the JSON structure and proceed as if you originally had a service account in JSON key format.

On my website are a number of articles about P12 certificate service accounts including converting from P12 to JSON.

My advice is to switch to service accounts in JSON format.

1
  • Thanks so much, John. Looks like building the JSON structure from the cert as you described would be the equivalent of that Google.Apis FromCertificate() method. I was pursuing that solution because the runtime env of my code already has access to certs that are being used for auth with some Google API Client Libraries (Google.Apis APIs). Were I to switch to JSON, I'd need to figure out how to securely distribute those files to all the envs in which my code will run (unless I built the JSON from the cert, as you described). I was putting that off, but maybe I'll just have to bite that bullet.
    – Kevin Wong
    Commented Jan 13, 2021 at 14:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.