google-auth-library-php icon indicating copy to clipboard operation
google-auth-library-php copied to clipboard

feat: support for getProjectId in external account credentials (workforce pools)

Open bshaffer opened this issue 2 years ago • 0 comments

See https://github.com/googleapis/google-auth-library-php/pull/474 See Python's implementation for Workforce credentials

As part of Workforce Credentials, we will need support getting a ProjectID (e.g. implementing ProjectIdProviderInterface) in ExternalAccountCredentials. Here's examples of how this is done in other languages:

From the audience:

  1. Parse the project number from the audience string
  2. Exchange the project number for a project ID

From Workload Identity Pool

  1. Get workforce pool user project from the JSON file
  2. Exchange for a project ID (same as above)

IMPORTANT: Because the caching layer for the auth library is currently implemented in a FetchAuthTokenCache class (which is a pattern that has caused us a lot of headache), we will need to consider refactoring caching implementation to make this feature work. One way would be to implement the CacheTrait. Another would be to have it extend FetchAuthTokenCache. A third option would be create a new AuthTokenCacheTrait which contains logic from FetchAuthTokenCache to be shared between the two classes. A potentially larger refactor is also on the table (see https://github.com/googleapis/google-auth-library-php/pull/322/files)

bshaffer avatar Oct 05 '23 20:10 bshaffer