Auth samples for Endpoints.

appengine/flexible/endpoints/README.md

@@ -98,17 +98,16 @@ Now you can use the client ID to make requests to the API:
 
 The App Engine default service account client demonstrates how to use the Google App Engine default service account to authenticate to endpoints.
 We refer to the project that serves API requests as the server project. You also need to create a client project in the [Cloud Console](https://console.cloud.google.com).
+Both server and client projects are running Google App Engine standard applications.
 
 To use the App Engine default service account for authentication:
 
 1. Update the `gae_default_service_account`'s `x-issuer` and `x-jwks_uri` in `swagger.yaml` with your client project ID.
 2. Redeploy your server application.
 3. Update clients/service_to_service_gae_default/main.py, replace 'YOUR-CLIENT-PROJECT-ID' and 'YOUR-SERVER-PROJECT-ID' with your client project ID and your server project ID.
-4. Upload your application to Google App Engine by invoking the following command under clients/service_to_service_gae_default directory.
-This opens a browser window for you to sign in using your Google account. You'll be providing the project ID as the argument for -A. Use
-the -V argument to specify a version name. Additional information on how to deploy an app to Google Cloud App Engine can be found [here](https://cloud.google.com/appengine/docs/python/quickstart).
+4. Upload your application to Google App Engine by invoking the following command.
 
-   appcfg.py -A <YOUR-CLIENT-PROJECT-ID> -V v1 update .
+    gcloud app deploy app.yaml --project=<YOUR-CLIENT-PROJECT-ID> --promote
 
 Your client app is now deployed at https://<YOUR-CLIENT-PROJECT-ID>.appspot.com. When you access https://<YOUR-CLIENT-PROJECT-ID>.appspot.com, your client calls your server project API using
 the client's service account.
@@ -117,6 +116,7 @@ the client's service account.
 
 The service account client demonstrates how to use a non-default service account to authenticate to endpoints.
 We refer to the project that serves API requests as the server project. You also need to create a client project in the [Cloud Console](https://console.cloud.google.com).
+Both server and client projects are running Google App Engine standard applications.
 
 In the example, we use Google Cloud Identity and Access Management (IAM) API to create a JSON Web Token (JWT) for a service account, and use it to call an Endpoints API.
 
@@ -134,11 +134,9 @@ To use the client for authentication:
 2. Redeploy your server application.
 3. Update clients/service_to_service_non_default/main.py, replace 'YOUR-SERVICE-ACCOUNT-EMAIL', 'YOUR-SERVER-PROJECT-ID' and 'YOUR-CLIENT-PROJECT-ID'
 with your service account email, your server project ID, and your client project ID.
-4. Upload your application to Google App Engine by invoking the following command under clients/service_to_service_non_default directory.
-This opens a browser window for you to sign in using your Google account. You'll be providing the project ID as the argument for -A. Use
-the -V argument to specify a version name. Additional information on how to deploy an app to Google Cloud App Engine can be found [here](https://cloud.google.com/appengine/docs/python/quickstart).
+4. Upload your application to Google App Engine by invoking the following command.
 
-   appcfg.py -A <YOUR-CLIENT-PROJECT-ID> -V v1 update .
+    gcloud app deploy app.yaml --project=<YOUR-CLIENT-PROJECT-ID> --promote
 
 Your client app is now deployed at https://<YOUR-CLIENT-PROJECT-ID>.appspot.com. When you access https://<YOUR-CLIENT-PROJECT-ID>.appspot.com, your client calls your server project API using
 the client's service account.
@@ -150,16 +148,15 @@ In the example, we first create a JSON Web Token (JWT) using the App Engine defa
 ID token using the JWT, and call an Endpoints API using the Google ID token.
 
 We refer to the project that serves API requests as the server project. You also need to create a client project in the [Cloud Console](https://console.cloud.google.com).
+Both server and client projects are running Google App Engine standard applications.
 
 To use the client for authentication:
 1. Update the `google_id_token`'s audiences, replace `YOUR-SERVER-PROJECT-ID` with your server project ID.
 2. Redeploy your server application.
 3. Update clients/service_to_service_google_id_token/main.py, replace 'YOUR-CLIENT-PROJECT-ID' and 'YOUR-SERVER-PROJECT-ID' with your client project ID and your server project ID.
-4. Upload your application to Google App Engine by invoking the following command under clients/service_to_service_google_id_token directory.
-This opens a browser window for you to sign in using your Google account. You'll be providing the project ID as the argument for -A. Use
-the -V argument to specify a version name. Additional information on how to deploy an app to Google Cloud App Engine can be found [here](https://cloud.google.com/appengine/docs/python/quickstart).
+4. Upload your application to Google App Engine by invoking the following command.
 
-   appcfg.py -A <YOUR-CLIENT-PROJECT-ID> -V v1 update .
+    gcloud app deploy app.yaml --project=<YOUR-CLIENT-PROJECT-ID> --promote
 
 Your client app is now deployed at https://<YOUR-CLIENT-PROJECT-ID>.appspot.com. When you access https://<YOUR-CLIENT-PROJECT-ID>.appspot.com, your client calls your server project API from
 the client's service account using Google ID token.

appengine/flexible/endpoints/clients/service_to_service_gae_default/main.py

@@ -49,11 +49,13 @@ def generate_jwt():
         "email": DEFAUTL_SERVICE_ACCOUNT
     })
 
-    headerAndPayload = '{}.{}'.format(base64.urlsafe_b64encode(header_json),
-                                      base64.urlsafe_b64encode(payload_json))
+    headerAndPayload = '{}.{}'.format(
+        base64.urlsafe_b64encode(header_json),
+        base64.urlsafe_b64encode(payload_json))
     (key_name, signature) = app_identity.sign_blob(headerAndPayload)
-    signed_jwt = '{}.{}'.format(headerAndPayload,
-                                base64.urlsafe_b64encode(signature))
+    signed_jwt = '{}.{}'.format(
+        headerAndPayload,
+        base64.urlsafe_b64encode(signature))
 
     return signed_jwt
 

appengine/flexible/endpoints/clients/service_to_service_google_id_token/main.py

@@ -51,11 +51,13 @@ def generate_jwt():
         "aud": "https://www.googleapis.com/oauth2/v4/token"
     })
 
-    headerAndPayload = '{}.{}'.format(base64.urlsafe_b64encode(header_json),
-                                      base64.urlsafe_b64encode(payload_json))
+    headerAndPayload = '{}.{}'.format(
+        base64.urlsafe_b64encode(header_json),
+        base64.urlsafe_b64encode(payload_json))
     (key_name, signature) = app_identity.sign_blob(headerAndPayload)
-    signed_jwt = '{}.{}'.format(headerAndPayload,
-                                base64.urlsafe_b64encode(signature))
+    signed_jwt = '{}.{}'.format(
+        headerAndPayload,
+        base64.urlsafe_b64encode(signature))
 
     return signed_jwt
 

appengine/flexible/endpoints/clients/service_to_service_non_default/main.py

@@ -57,8 +57,9 @@ def generate_jwt():
         "email": SERVICE_ACCOUNT_EMAIL
     })
 
-    headerAndPayload = '{}.{}'.format(base64.urlsafe_b64encode(header_json),
-                                      base64.urlsafe_b64encode(payload_json))
+    headerAndPayload = '{}.{}'.format(
+        base64.urlsafe_b64encode(header_json),
+        base64.urlsafe_b64encode(payload_json))
     slist = service.projects().serviceAccounts().signBlob(
         name=SERVICE_ACCOUNT,
         body={'bytesToSign': base64.b64encode(headerAndPayload)})

appengine/flexible/endpoints/requirements.txt

@@ -5,4 +5,4 @@ gcloud==0.17.0
 six==1.10.0
 pyyaml==3.11
 requests==2.10.0
-google-api-python-client
+google-api-python-client==1.5.1