Struct GoogleAuthHeaders 

pub struct GoogleAuthHeaders { /* private fields */ }

The authentication headers of google-cloud-auth credentials, for every request the tonic and reqwest middleware send: authorization with an access token or an ID token, and whatever else the credentials add, such as x-goog-user-project for a quota project.

The credentials mint, cache and refresh the tokens. A GoogleAuthHeaders keeps the headers of the current token, with authorization marked sensitive so that it stays out of logs, and takes new ones only when the credentials report a new token.

from_adc, from_adc_with_scopes, from_service_account_key, id_token_from_adc and id_token_impersonating build credentials, which spawns their refresh task on the current Tokio runtime. All but the last check for the rustls crypto provider a service account key signs with, and fail with ErrorKind::CryptoProviderMissing instead of panicking in that task.

Implementations

impl GoogleAuthHeaders

pub async fn id_token_from_adc(audience: &IdTokenAudience) -> Result<Self>

ID tokens for audience, minted with the identity of the Application Default Credentials:

• a service account key file, as that service account;
• the metadata server, as the service account of the instance;
• impersonated_service_account credentials, such as gcloud auth application-default login --impersonate-service-account writes, as the service account they impersonate;
• workload identity federation with a service_account_impersonation_url, as the service account that URL names, with the federated token calling generateIdToken the way it calls generateAccessToken for access tokens.

Fails with ErrorKind::IdTokenNeedsImpersonation for credentials that hold no service account: authorized_user and external_account_authorized_user credentials, workload identity federation without impersonation, and gdch_service_account credentials. Use id_token_impersonating for the first three.

Fails with ErrorKind::CryptoProviderMissing for a service account key, used directly or as the source of an impersonation, when the auth-default-crypto feature is off and no rustls crypto provider is installed.

pub async fn id_token_impersonating( audience: &IdTokenAudience, service_account: &ServiceAccountEmail, source_credentials: Credentials, ) -> Result<Self>

ID tokens for audience, minted with the identity of service_account through the IAM Credentials generateIdToken method, called with the access tokens of source_credentials. Their principal needs the iam.serviceAccounts.getOpenIdToken permission on service_account, which the Service Account OpenID Connect Identity Token Creator role grants.

source_credentials built from a service account key sign with it, and need a rustls crypto provider when the auth-default-crypto feature is off. They are opaque here, so this constructor cannot check for one.

pub async fn from_adc() -> Result<Self>

Access tokens for the cloud-platform scope, minted with the Application Default Credentials: from_adc_with_scopes with GCP_DEFAULT_SCOPES.

pub async fn from_adc_with_scopes(scopes: Vec<String>) -> Result<Self>

Access tokens for scopes, minted with the Application Default Credentials.

Fails with ErrorKind::CryptoProviderMissing for a service account key, used directly or as the source of an impersonation, when the auth-default-crypto feature is off and no rustls crypto provider is installed. Credentials built with google-cloud-auth’s Builder and converted with GoogleAuthHeaders::from are not checked, and a missing provider panics in their refresh task instead.

pub async fn from_service_account_key( key: Value, scopes: Vec<String>, ) -> Result<Self>

Access tokens for scopes, minted with the service account key key, the JSON of a key file as the IAM console or gcloud iam service-accounts keys create writes it.

Fails with ErrorKind::CryptoProviderMissing when the auth-default-crypto feature is off and no rustls crypto provider is installed, and with ErrorKind::CredentialsBuild when key lacks the fields of a service account key. The private key itself is parsed on the first token request.

pub async fn headers(&self) -> Result<Arc<HeaderMap>>

The headers to set on a request, replacing any it carries under the same names.

Trait Implementations

impl Debug for GoogleAuthHeaders

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl From<Credentials> for GoogleAuthHeaders

Access tokens, or whatever headers credentials serve.

credentials built from a service account key need a rustls crypto provider when the auth-default-crypto feature is off. They are opaque here, so this conversion cannot check for one; GoogleAuthHeaders::from_adc_with_scopes checks for Application Default Credentials and GoogleAuthHeaders::from_service_account_key for a key.

fn from(credentials: Credentials) -> Self

Converts to this type from the input type.

impl From<IDTokenCredentials> for GoogleAuthHeaders

ID tokens from any google-cloud-auth ID token credentials, such as idtoken::service_account::Builder builds from a key that is not the Application Default Credentials.

ID token credentials built from a service account key need a rustls crypto provider when the auth-default-crypto feature is off. They are opaque here, so this conversion cannot check for one; GoogleAuthHeaders::id_token_from_adc checks for Application Default Credentials.

fn from(credentials: IDTokenCredentials) -> Self

Converts to this type from the input type.