signer

Documentation

Index

• func SignWithoutKeyAdaptor(ctx context.Context, signer Signer) func([]byte) ([]byte, error)
• type Signer
  • func SmartSigner(ctx context.Context, options ...adcplus.Option) (Signer, error)

Functions

func SignWithoutKeyAdaptor

func SignWithoutKeyAdaptor(ctx context.Context, signer Signer) func([]byte) ([]byte, error)

Types

type Signer

type Signer interface {
	ServiceAccount(context.Context) string
	SignBlob(context.Context, []byte) (string, []byte, error)
	SignJwt(context.Context, string) (string, error)
}

func SmartSigner

func SmartSigner(ctx context.Context, options ...adcplus.Option) (Signer, error)

SmartSigner create signer for ADC with optional impersonation. Impersonation setting is supplied from below in descending order of priority.

1. options e.g. signer.WithTargetPrincipal, signer.WithDelegates
2. `CLOUDSDK_AUTH_IMPERSONATE_SERVICE_ACCOUNT` environment variable

If impersonation is not applied, all credentials except App Engine 1st gen(only Go 1.11) and Service Account Key need a Token Creator role to themselves.

• https://cloud.google.com/iam/docs/creating-short-lived-service-account-credentials?hl=en
• https://cloud.google.com/iam/docs/impersonating-service-accounts?hl=en