Investigate using ServiceAccountJwtAccessCredentials vs ServiceAccountCredentials #1459
Labels
priority: p2
Moderately-important priority. Fix may not be included in next release.
type: bug
Error or flaw in code with unintended results or allowing sub-optimal usage patterns.
Issue stemmed from b/354698601
ServiceAccountJwtAccessCredentials may be setting the incorrect audience (not the default audience that is passed in to the Credentials). It may be using the URI for the http request instead of the shortened URI.
For example, the audience from this sample: https://cloud.google.com/bigquery/docs/json-web-tokens#java_example is
https://bigquery.googleapis.com/bigquery/v2/...
instead ofhttps://bigquery.googleapis.com/
. Previous attempts to use the shortened URI resulted in downstream failures in Spring-Cloud-GCP and java samples(see comments in #572).Our guidance is to use ServiceAccountCredentials with SSJWT whenever possible.
Scope
edits:
by @zhumin8 Minor corrections and provided more context links.
The text was updated successfully, but these errors were encountered: