authorizer / vendor / google / auth / src / Iam.php

Iam.php in Authorizer 3.14.2, at vendor/google/auth/src/Iam.php

156 lines 5.0 KB

Raw Download Zip

1	<?php
2	/*
3	* Copyright 2019 Google LLC
4	*
5	* Licensed under the Apache License, Version 2.0 (the "License");
6	* you may not use this file except in compliance with the License.
7	* You may obtain a copy of the License at
8	*
9	* http://www.apache.org/licenses/LICENSE-2.0
10	*
11	* Unless required by applicable law or agreed to in writing, software
12	* distributed under the License is distributed on an "AS IS" BASIS,
13	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14	* See the License for the specific language governing permissions and
15	* limitations under the License.
16	*/
17
18	namespace Google\Auth;
19
20	use Google\Auth\HttpHandler\HttpClientCache;
21	use Google\Auth\HttpHandler\HttpHandlerFactory;
22	use GuzzleHttp\Psr7;
23	use GuzzleHttp\Psr7\Utils;
24
25	/**
26	* Tools for using the IAM API.
27	*
28	* @see https://cloud.google.com/iam/docs IAM Documentation
29	*/
30	class Iam
31	{
32	/**
33	* @deprecated
34	*/
35	const IAM_API_ROOT = 'https://iamcredentials.googleapis.com/v1';
36	const SIGN_BLOB_PATH = '%s:signBlob?alt=json';
37	const SERVICE_ACCOUNT_NAME = 'projects/-/serviceAccounts/%s';
38	private const IAM_API_ROOT_TEMPLATE = 'https://iamcredentials.UNIVERSE_DOMAIN/v1';
39	private const GENERATE_ID_TOKEN_PATH = '%s:generateIdToken';
40
41	/**
42	* @var callable
43	*/
44	private $httpHandler;
45
46	private string $universeDomain;
47
48	/**
49	* @param callable\|null $httpHandler [optional] The HTTP Handler to send requests.
50	*/
51	public function __construct(
52	?callable $httpHandler = null,
53	string $universeDomain = GetUniverseDomainInterface::DEFAULT_UNIVERSE_DOMAIN
54	) {
55	$this->httpHandler = $httpHandler
56	?: HttpHandlerFactory::build(HttpClientCache::getHttpClient());
57	$this->universeDomain = $universeDomain;
58	}
59
60	/**
61	* Sign a string using the IAM signBlob API.
62	*
63	* Note that signing using IAM requires your service account to have the
64	* `iam.serviceAccounts.signBlob` permission, part of the "Service Account
65	* Token Creator" IAM role.
66	*
67	* @param string $email The service account email.
68	* @param string $accessToken An access token from the service account.
69	* @param string $stringToSign The string to be signed.
70	* @param array<string> $delegates [optional] A list of service account emails to
71	* add to the delegate chain. If omitted, the value of `$email` will
72	* be used.
73	* @return string The signed string, base64-encoded.
74	*/
75	public function signBlob($email, $accessToken, $stringToSign, array $delegates = [])
76	{
77	$name = sprintf(self::SERVICE_ACCOUNT_NAME, $email);
78	$apiRoot = str_replace('UNIVERSE_DOMAIN', $this->universeDomain, self::IAM_API_ROOT_TEMPLATE);
79	$uri = $apiRoot . '/' . sprintf(self::SIGN_BLOB_PATH, $name);
80
81	if ($delegates) {
82	foreach ($delegates as &$delegate) {
83	$delegate = sprintf(self::SERVICE_ACCOUNT_NAME, $delegate);
84	}
85	} else {
86	$delegates = [$name];
87	}
88
89	$body = [
90	'delegates' => $delegates,
91	'payload' => base64_encode($stringToSign),
92	];
93
94	$headers = [
95	'Authorization' => 'Bearer ' . $accessToken
96	];
97
98	$request = new Psr7\Request(
99	'POST',
100	$uri,
101	$headers,
102	Utils::streamFor(json_encode($body))
103	);
104
105	$res = ($this->httpHandler)($request);
106	$body = json_decode((string) $res->getBody(), true);
107
108	return $body['signedBlob'];
109	}
110
111	/**
112	* Sign a string using the IAM signBlob API.
113	*
114	* Note that signing using IAM requires your service account to have the
115	* `iam.serviceAccounts.signBlob` permission, part of the "Service Account
116	* Token Creator" IAM role.
117	*
118	* @param string $clientEmail The service account email.
119	* @param string $targetAudience The audience for the ID token.
120	* @param string $bearerToken The token to authenticate the IAM request.
121	* @param array<string, string> $headers [optional] Additional headers to send with the request.
122	*
123	* @return string The signed string, base64-encoded.
124	*/
125	public function generateIdToken(
126	string $clientEmail,
127	string $targetAudience,
128	string $bearerToken,
129	array $headers = []
130	): string {
131	$name = sprintf(self::SERVICE_ACCOUNT_NAME, $clientEmail);
132	$apiRoot = str_replace('UNIVERSE_DOMAIN', $this->universeDomain, self::IAM_API_ROOT_TEMPLATE);
133	$uri = $apiRoot . '/' . sprintf(self::GENERATE_ID_TOKEN_PATH, $name);
134
135	$headers['Authorization'] = 'Bearer ' . $bearerToken;
136
137	$body = [
138	'audience' => $targetAudience,
139	'includeEmail' => true,
140	'useEmailAzp' => true,
141	];
142
143	$request = new Psr7\Request(
144	'POST',
145	$uri,
146	$headers,
147	Utils::streamFor(json_encode($body))
148	);
149
150	$res = ($this->httpHandler)($request);
151	$body = json_decode((string) $res->getBody(), true);
152
153	return $body['token'];
154	}
155	}
156