You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The credential classes are designed to cache tokens between requests and opaquely refresh them when needed. Can you describe the use case where you need to have a longer expiry?
An access token "broker" service that generates OAuth 2.0 access tokens. This service has a Service Account to a Google Cloud Storage (GCS) bucket.
A distributed computing engine which, for security reasons, must use the "broker" to get an access token to the GCS bucket (i.e. doesn't have direct access to GCS or the Service Account).
The distributed computing engine may spawn lots of worker nodes. The worker nodes will be fed by the same access token at runtime. Since some of the distributed computing jobs may take more than 1 hour to complete it is desirable that the access token can have a longer expiry.
By default, OAuth 2.0 access tokens are valid for a maximum of 1 hour (3,600 seconds). However, the maximum lifetime for these tokens can be extended to 12 hours (43,200 seconds) according to the documentation: https://cloud.google.com/iam/docs/creating-short-lived-service-account-credentials#sa-credentials-oauth
This is currently not possible since the maximum 1 hour lifespan is hard-coded into both the ImpersonatedCredentials and the ServiceAccountCredentials class.
The text was updated successfully, but these errors were encountered: