Tricky to use custom credentials with Spanner

[jskeet]

Currently there are two ways to specify non-default credentials for SpannerConnection:

• Set SpannerConnectionStringBuilder.CredentialFile
• Pass a ChannelCredentials into the constructor of SpannerConnection

We previously didn't want to expose GoogleCredential etc in case we move away from Google.Apis.Auth, but with GAX v4 we reversed that policy. We should look at exposing custom credentials via SpannerConnectionStringBuilder constructors and properties. (It's slightly tricky as it can't really be in the connection string itself, but we clearly have a way with ChannelCredentials already.)

[amanda-tarafa]

Idea: Allow the fully qualified name of an Func<GoogleCredential> on the connection string builder, and that could be in the connection string itself.

[jskeet]

Hmm... I'm not sure about executing arbitrary code based on the connection string. Sounds like a security issue waiting to happen.

[amanda-tarafa]

Yep, that's a good point.

Another idea: Provide a utility to inject the ConnectionStringBuilder and we then can fetch the credential from DI. And we can even read the connection string from configuration in that case, if it's present.