Expand description
Google Service Signer
Generic service-account impersonation accepts any token-only Google source provider and can feed its output into a signer or Credential Access Boundary grant.
Typed server-side Cloud Storage Credential Access Boundary downscoping is
always available. Enable the credential-access-boundary-client-side
feature for local client-side token generation.
Structsยง
- Client
Side Credential Access Boundary Granter - Exchanges source credentials for intermediary material and generates Google Credential Access Boundary tokens locally.
- Credential
- Credential represents Google credentials that may contain a service account, token, and provider-discovered signer identity.
- Credential
Access Boundary Grant - A typed, bound Google Cloud Storage Credential Access Boundary.
- Credential
Access Boundary Permissions - Typed Google Cloud Storage roles supported by Credential Access Boundaries.
- Default
Credential Provider - Default credential provider for Google Cloud Storage (GCS).
- Default
Credential Provider Builder - Builder for
DefaultCredentialProvider. - EnvCredential
Provider - External
Account Config - Google configuration for exchanging an external subject token.
- External
Account Credential Provider - Exchanges an external subject token for a Google access token.
- File
Credential Provider - FileCredentialProvider loads Google credentials from an explicit credential file path.
- Request
Signer - RequestSigner for Google service requests.
- Server
Side Credential Access Boundary Granter - Exchanges a Google OAuth access token for a server-issued CAB token.
- Service
Account - ServiceAccount holds the client email and private key for service account authentication.
- Service
Account Impersonation Credential Provider - A Google-specific provider that loads a source credential and applies a fixed service-account impersonation flow.
- Service
Account Impersonation Grant - A typed, explicitly bound IAM service-account impersonation grant.
- Service
Account Impersonation Granter - Exchanges a token-only Google credential through IAM Credentials
generateAccessToken. - Service
Account Token Credential Provider - Exchanges a service-account credential for an OAuth access token.
- Static
Credential Provider - StaticCredentialProvider loads credentials from a JSON string provided at construction time.
- Token
- Token represents an OAuth2 access token with expiration.
- Token
Credential Provider - TokenCredentialProvider loads a raw OAuth access token from memory or a file path.
- VmMetadata
Credential Provider - VmMetadataCredentialProvider loads tokens from Google Compute Engine VM metadata service.
- Well
Known Credential Provider