Populate token expiry for GCE credentials #473

bendemaree · 2016-03-24T19:10:51Z

Populates the token_expiry property for GCE App Assertion credentials. The token responses from the metadata service have a expires_in value in the response that can be leveraged to make things work better on the base OAuth2Credentials class, like access_token_expired.

I largely followed the implementation in the base client though less defensively; I don't see any reason why expires_in wouldn't be present though perhaps someone knows better. I did note that the existing tests actually assert this value is not set in the mocked token response so perhaps that provides evidence against my assumption.

coveralls · 2016-03-24T19:14:41Z

Coverage increased (+0.003%) to 97.569% when pulling c96c404 on bendemaree:gce-app-assertion-expiry into 3ca2ca7 on google:master.

oauth2client/contrib/gce.py

@@ -27,6 +28,7 @@

 from oauth2client._helpers import _from_bytes
 from oauth2client import util
+from oauth2client.client import _UTCNOW


coveralls · 2016-03-24T21:50:38Z

Coverage increased (+0.002%) to 97.569% when pulling bffa989 on bendemaree:gce-app-assertion-expiry into 3ca2ca7 on google:master.

tests/contrib/test_gce.py

@@ -73,6 +78,8 @@ def _refresh_success_helper(self, bytes_response=False):
        self.assertEquals(None, credentials.access_token)
        credentials.refresh(http)
        self.assertEquals(access_token, credentials.access_token)
+        self.assertFalse(credentials.access_token_expired)
+        self.assertTrue(credentials.token_expiry > datetime.utcnow())


theacodes · 2016-03-25T16:32:35Z

/cc @elibixby

oauth2client/contrib/gce.py

@@ -135,6 +136,8 @@ def _refresh(self, http_request):
                raise HttpAccessTokenRefreshError(str(e),
                                                  status=response.status)
            self.access_token = token_content['access_token']
+            delta = datetime.timedelta(seconds=int(token_content['expires_in']))


elibixby · 2016-03-25T18:25:10Z

Hi bendemaree@ thanks for the contribution, but I'm actually working on a larger update to GCE credentials that includes this.

Still writing tests but I'll go ahead and submit a pull request so more work doesn't get duplicated =(

dhermes · 2016-03-25T18:26:14Z

@elibixby smaller PRs are much easier to review FWIW.

elibixby · 2016-03-25T18:46:22Z

See #476

I rewrote the wrapper function for the metadata server so that it can be used by lots of common calls that will need to be made, so I would like the first PR to contain that. However, if after that we want to rewrite the interface in a bunch of small PRs that's fine with me. Still, I think all these changes are quite related and should be reviewed together. Just my .02

(Also FYI, I AM splitting up the PR with the GCE credential updates, and the PR to add IAM blob signing, as IAM blob signing could potentially be used in other credential types)

bendemaree · 2016-03-25T20:49:27Z

Ah, alright, thanks for the review anyway! Looking forward to the update; we're trying out some optimistic credential refresh logic since the OAuth dance takes a bit and could cause a request to hang while the token is implicitly refreshed.

Closing out; feel free to reopen if needed.

bendemaree · 2016-04-25T17:12:55Z

@elibixby Given that #476 was closed out and there aren't followup PRs yet (I may have missed them though), would it be possible to put this back on the table for review?...

elibixby · 2016-04-25T18:34:36Z

I'm going to split #476 into smaller PRs and submit those. It's on my plate for the next couple weeks.

I think the right thing to do here is write a metadata module that wraps the metadata server and caches requests. Which should make follow up PRs easy. If you want to take that on you are welcome to. I can't promise I will get to it this week.

bendemaree · 2016-06-03T11:54:14Z

@elibixby @jonparrott Sorry to bring this back to your attention again, but is there any chance we can merge this in? I don't think it's more than a minor bugfix, and at this point it's been 2 months without the major refactor needed to get this behavioral fix. 😢 I don't have the familiarity or bandwidth to re-wrap the metadata server myself, unfortunately.

theacodes · 2016-06-06T16:39:47Z

@dhermes are you fine with this being merged?

elibixby · 2016-06-06T18:28:54Z

@bendemaree Sorry about taking so long. I will have some time in the next week to work on my PRs, but if you'd like to go ahead and submit this for merge. That's understandable.

dhermes · 2016-06-07T05:58:25Z

https://coveralls.io/builds/5540724

What happened to 100% coverage?

dhermes · 2016-06-07T05:58:53Z

Ahhh I know. This needs to be rebased against HEAD in master

googlebot · 2016-06-07T12:01:59Z

We found a Contributor License Agreement for you (the sender of this pull request) and all commit authors, but as best as we can tell these commits were authored by someone else. If that's the case, please add them to this pull request and have them confirm that they're okay with these commits being contributed to Google. If we're mistaken and you did author these commits, just reply here to confirm.

Populates the token_expiry property for GCE App Assertion credentials (thus enabling access_token_expired). This corrects assumptions like the one in the access_token_expired property on GCE specifically: it's stated there "If the token_expiry isn't set, we assume the token doesn't expire" which seems to be incorrect for tokens retrieved from the GCE Metadata service. Remove usage of _UTCNOW

googlebot · 2016-06-07T12:06:30Z

CLAs look good, thanks!

bendemaree · 2016-06-07T12:08:05Z

@dhermes Squashed and rebased (eventually!).

@elibixby @jonparrott Thanks a lot for circling back on this; much obliged!

oauth2client/contrib/gce.py

@@ -135,6 +136,8 @@ def _refresh(self, http_request):
                raise HttpAccessTokenRefreshError(str(e),
                                                  status=response.status)
            self.access_token = token_content['access_token']
+            delta = datetime.timedelta(seconds=int(token_content['expires_in']))
+            self.token_expiry = delta + datetime.datetime.utcnow()


bendemaree · 2016-06-10T15:16:34Z

Bump. 😁

theacodes · 2016-06-10T16:29:11Z

This LGTM.

theacodes · 2016-06-10T16:29:39Z

@dhermes if you have any post-merge objections, let me know and I'll fix myself.

bendemaree · 2016-07-10T15:28:14Z

@jonparrott Is there an upcoming release planned that will include this?

theacodes · 2016-07-11T16:36:04Z

Yes, it will be 3.0.0. I'm waiting for a few outstanding PRs to be resolved first.

googlebot added the cla: yes label Mar 24, 2016

dhermes reviewed Mar 24, 2016
View reviewed changes

oauth2client/contrib/gce.py

@@ -27,6 +28,7 @@

from oauth2client._helpers import _from_bytes

from oauth2client import util

from oauth2client.client import _UTCNOW

This comment was marked as spam.

Sign in to view

This comment was marked as spam.

Sign in to view

dhermes reviewed Mar 24, 2016
View reviewed changes

elibixby reviewed Mar 25, 2016
View reviewed changes

bendemaree closed this Mar 25, 2016

bendemaree reopened this Jun 3, 2016

nathanielmanistaatgoogle assigned dhermes Jun 6, 2016

googlebot added cla: no and removed cla: yes labels Jun 7, 2016

bendemaree force-pushed the gce-app-assertion-expiry branch from 54613ba to b124d19 Compare June 7, 2016 12:06

googlebot added cla: yes and removed cla: no labels Jun 7, 2016

theacodes mentioned this pull request Jun 7, 2016

AppAssertionCredentials not respecting access token expiration #518

Closed

ericbuehl reviewed Jun 7, 2016
View reviewed changes

theacodes merged commit 54d7dce into googleapis:master Jun 10, 2016

theacodes mentioned this pull request Jul 28, 2016

Release 3.0.0 #575

Merged

bendemaree deleted the gce-app-assertion-expiry branch September 7, 2016 04:17

google-admin unassigned dhermes Sep 11, 2018

Populate token expiry for GCE credentials #473

Populate token expiry for GCE credentials #473

Conversation

bendemaree commented Mar 24, 2016

coveralls commented Mar 24, 2016

This comment was marked as spam.

This comment was marked as spam.

coveralls commented Mar 24, 2016

This comment was marked as spam.

This comment was marked as spam.

theacodes commented Mar 25, 2016

This comment was marked as spam.

This comment was marked as spam.

This comment was marked as spam.

This comment was marked as spam.

This comment was marked as spam.

This comment was marked as spam.

elibixby commented Mar 25, 2016

dhermes commented Mar 25, 2016

elibixby commented Mar 25, 2016

bendemaree commented Mar 25, 2016

bendemaree commented Apr 25, 2016

elibixby commented Apr 25, 2016

bendemaree commented Jun 3, 2016

theacodes commented Jun 6, 2016

elibixby commented Jun 6, 2016

dhermes commented Jun 7, 2016

dhermes commented Jun 7, 2016

googlebot commented Jun 7, 2016

googlebot commented Jun 7, 2016

bendemaree commented Jun 7, 2016

This comment was marked as spam.

This comment was marked as spam.

This comment was marked as spam.

This comment was marked as spam.

bendemaree commented Jun 10, 2016

theacodes commented Jun 10, 2016

theacodes commented Jun 10, 2016

bendemaree commented Jul 10, 2016

theacodes commented Jul 11, 2016