Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Service Account #51

Closed
freizl opened this issue Aug 26, 2016 · 11 comments
Closed

Service Account #51

freizl opened this issue Aug 26, 2016 · 11 comments

Comments

@freizl
Copy link
Owner

freizl commented Aug 26, 2016

Damian Soriano (Gmail) to me Aug 8
Hi!

I am creating a Haskell application that connects go bigquery. I wanted to use your OAuth2 lib to do that: https://github.com/freizl/hoauth2

I search a little bit in the doc and example and I didn't found anything about service account authentication (https://developers.google.com/identity/protocols/OAuth2ServiceAccount). I was wondering if that feature is already implemented in the lib or not, since I found no example about that.

Many thanks

Regards

@MichelBoucey
Copy link

Hi,

I have just released few days ago a package called google-oauth2-jwt that create the signed JWT needed to access Google APIs with Service Accounts.

BTW: your issue #16 also need it.

Best regards,
Michel.

@freizl
Copy link
Owner Author

freizl commented Sep 7, 2016

@MichelBoucey nice! will take an look.

@freizl
Copy link
Owner Author

freizl commented Sep 29, 2016

@MichelBoucey just be curious that are you able to build http://hackage.haskell.org/package/google-oauth2-jwt on latest mac?
Gets linking error

Undefined symbols for architecture x86_64:
  "_DHparams_dup", referenced from:
      _HsOpenSSL_DHparams_dup in libHSHsOpenSSL-0.11.1.1-42cQLUu6Nm37qCxYZlRnxo.a(HsOpenSSL.o)
     (maybe you meant: _HsOpenSSL_DHparams_dup)
  "_X509_CRL_get0_by_serial", referenced from:
      _cZGG_info in libHSHsOpenSSL-0.11.1.1-42cQLUu6Nm37qCxYZlRnxo.a(Revocation.o)
  "_X509_STORE_CTX_get0_current_crl", referenced from:
      _HsOpenSSL_X509_STORE_CTX_get0_current_crl in libHSHsOpenSSL-0.11.1.1-42cQLUu6Nm37qCxYZlRnxo.a(HsOpenSSL.o)
     (maybe you meant: _HsOpenSSL_X509_STORE_CTX_get0_current_crl)
  "_X509_STORE_CTX_get0_current_issuer", referenced from:
      _HsOpenSSL_X509_STORE_CTX_get0_current_issuer in libHSHsOpenSSL-0.11.1.1-42cQLUu6Nm37qCxYZlRnxo.a(HsOpenSSL.o)
     (maybe you meant: _HsOpenSSL_X509_STORE_CTX_get0_current_issuer)
ld: symbol(s) not found for architecture x86_64
clang: error: linker command failed with exit code 1 (use -v to see invocation)
`gcc' failed in phase `Linker'. (Exit code: 1)

@MichelBoucey
Copy link

I have no Mac. I work on Linux x86_64. I never have had this issue and the build on travis CI is also Okay... Do you build the package with Stack? Have you OpenSSL sources installed? There is an ongoing issue about building HsOpenSSL on Mac OS X.

@freizl
Copy link
Owner Author

freizl commented Sep 29, 2016

@MichelBoucey thanks your feedback. I did find that link which help to me to install the HsOpenSSL but I got error at linking.
Turns out it's specific issue in Mac and I'm running it in CentOS now.

@MichelBoucey
Copy link

MichelBoucey commented Sep 29, 2016

@freizl RedHat/CentOS are very LTS distros, so they use very old versions of libraries and softwares. A successful build should be easer to get on a current Debian(-like) distro or ArchLinux.

@freizl
Copy link
Owner Author

freizl commented Oct 25, 2016

thoughts:
maybe put it in an separated repo?

@MichelBoucey
Copy link

Can't you develop the service account branch in a debian/archlinux docker container?

@freizl
Copy link
Owner Author

freizl commented Oct 26, 2016

I'm not yet an fan of docker container but I have bootstrapped an linux vm.
It's still in progress in very low pace if you are interested: https://github.com/freizl/hoauth2/compare/branch/service-account?expand=1

And I'm wondering all those changes shall live in its own repo given it seems special to google implementation.

@MichelBoucey
Copy link

I have built branch/service-account without any troubles on ArchLinux x86_64 (discarding all examples test searching for "Keys").

And yes it seems to me also that a specific package is a bit better outside an only generic implementation package, at least, in an obviously specific module Network.OAuth.OAuth2.Google .

@freizl
Copy link
Owner Author

freizl commented Oct 28, 2016

Network.OAuth.OAuth2.Google seems an good name. Thanks!

@freizl freizl closed this as completed Oct 28, 2016
@freizl freizl reopened this Oct 28, 2016
freizl added a commit that referenced this issue Oct 19, 2022
- This is the grant type that google service account uses
- Spec https://www.rfc-editor.org/rfc/rfc7523.html#section-2.1

fixes #16, #51
freizl added a commit that referenced this issue Oct 19, 2022
- This is the grant type that google service account uses
- Spec https://www.rfc-editor.org/rfc/rfc7523.html#section-2.1

fixes #16, #51
freizl added a commit that referenced this issue Oct 19, 2022
- This is the grant type that google service account uses
- Spec https://www.rfc-editor.org/rfc/rfc7523.html#section-2.1

fixes #16, #51
@freizl freizl closed this as completed Oct 19, 2022
mirko-plowtech added a commit to mirko-plowtech/hoauth2 that referenced this issue Nov 7, 2022
* relax aeson to 2.1

* manual tweak nix and stack

* bump to houath2-2.5.0 and hoauth2-example-1.4.0

* sync nix file

* fix typo in cabal file

* Update description for tested OAuth2 providers.

* format cabal on the ghc-options; add sub for Auth0 user.

* Upgrade github actions

- upgrade github action
- nix build doesn't work well still. shall think of pin down to a version.

* format cabal files

* Dedeprate all *Internal method with *WithAuthMethod alternative

* remove Douban

* Add since annotation for new method.

* Update documentation; Move APIAuthMethod to HttpClient.

* Refactor http clien methods that only take one Auth method.

- Also remove `authPostBS1` which allow credential being sent in
multiple ways, which is not standard.
- Those are all Breaking changes.
- Fixes the compilation issue that caused by forgetting export APIAuthenticationMethod

* Fixes linkedin demo

* Update comment for ClientAuthenticationMethod.

* Refactor: run request method under MonadIO instead of IO

fixes freizl#147

* Adds helper method authorizationUrlWithParams

* v2 build is default now

* Rename hoauth2-example to hoauth2-demo

* Fixes build after rename

* Adding hoauth-tutorial as another example

* Fixes build error

* fixes hlint

* fixes base for tutorial main

* Fixes build failure

* Update the rewrite thoughts

* Fixes comments

* Add comment to OAuthToken fields

* Update tutorial

* make hoauth2-tutorial 0.1

* tweak hoauth2-tutorial

* Fixes comments

* Rename Hoauth2Tutorial.hs to HOAuth2Tutorial.hs

* Fixes hoauth2-tutorial to work with hoauth2-2.5.0

* bump hoauth2-tutorial-0.1.1

* Remove nonce

* support query parameter overrride in authorizationUrWithParams

* Change the type parameter order in http client JSON method

- It's more likely to apply type for JSON response than monad
- Hence move to first type parameter

* Add the oauth2 binding rewrite implementation and hoauth2 providers (freizl#155)


- The rewrite work resident at Network.OAuth2.Experiment module. See comments in the module for details.
- Adds package hoauth2-providers to for a list of common IdP providers, in terms of their OAuth2 endpoints, userinfo endpoint and the way to construct an Application. This package depends on the Experiment module
- Adds tutorial module for hoauth2-providers
- Updates hoauth2-demo application accordingly and add sample flow Resource Owner Password and Client Credential

* bump hoauth-2.6.0

* bump versions and change licence to MIT

release candidate for

- hoauth2@2.6.0
- hoauth2-demo@1.5.0
- hoauth2-providers@0.1
- hoauth2-providers-tutorial@0.1
- hoauth2-tutorial@0.1.2

* Update makefile

- fix the hlint task
- add publish task

* Update docs and notes

* move hoauth2-demo to new repo

* run dist before publish

* hoauth2-provider: refactor

- update developer page for IdPs
- rename DropboxName to DropboxUserName
- fixes the field comment for Google User

* Remove TODO to rename Facebook

- The social network brand isn't changed

* hoauth2-provider: add twitter

* move hoauth2-demo back; add twitter to demo app

* Adds comment to okta client credential app

* add ghcspecer but it doesn't for now

* :refactor: move to fourmolu

* fixes: surface up entire response body as string when response body is
empty when invoke API using access token

* refactor: rename ResourceOwner and ClientCredential idp config to idp application

* Add GrantType jwt-bearer (freizl#162)


- This is the grant type that google service account uses
- Spec https://www.rfc-editor.org/rfc/rfc7523.html#section-2.1

fixes freizl#16, freizl#51

* hard-code hoauth2 version in useragent header; format hoauth2.cabal.

* Omit internal modules from export/haddock

* Embedded version number dynamically is user agent string

* loose version for tutorial packages; add Paths_ autogen modules.

* Update oauth2 and user info endpoint for Azure

fixes freizl#165

* fixes hlint

* ghc884 compatibility: Remove ImportQualifiedPost

Co-authored-by: HW home <freizl@gmail.com>
Co-authored-by: Haisheng (mercury) <haisheng@mercury.com>
mirko-plowtech added a commit to plow-technologies/hoauth2 that referenced this issue Feb 23, 2023
…by removing "qualified as" (#1)

* relax aeson to 2.1

* manual tweak nix and stack

* bump to houath2-2.5.0 and hoauth2-example-1.4.0

* sync nix file

* fix typo in cabal file

* Update description for tested OAuth2 providers.

* format cabal on the ghc-options; add sub for Auth0 user.

* Upgrade github actions

- upgrade github action
- nix build doesn't work well still. shall think of pin down to a version.

* format cabal files

* Dedeprate all *Internal method with *WithAuthMethod alternative

* remove Douban

* Add since annotation for new method.

* Update documentation; Move APIAuthMethod to HttpClient.

* Refactor http clien methods that only take one Auth method.

- Also remove `authPostBS1` which allow credential being sent in
multiple ways, which is not standard.
- Those are all Breaking changes.
- Fixes the compilation issue that caused by forgetting export APIAuthenticationMethod

* Fixes linkedin demo

* Update comment for ClientAuthenticationMethod.

* Refactor: run request method under MonadIO instead of IO

fixes freizl#147

* Adds helper method authorizationUrlWithParams

* v2 build is default now

* Rename hoauth2-example to hoauth2-demo

* Fixes build after rename

* Adding hoauth-tutorial as another example

* Fixes build error

* fixes hlint

* fixes base for tutorial main

* Fixes build failure

* Update the rewrite thoughts

* Fixes comments

* Add comment to OAuthToken fields

* Update tutorial

* make hoauth2-tutorial 0.1

* tweak hoauth2-tutorial

* Fixes comments

* Rename Hoauth2Tutorial.hs to HOAuth2Tutorial.hs

* Fixes hoauth2-tutorial to work with hoauth2-2.5.0

* bump hoauth2-tutorial-0.1.1

* Remove nonce

* support query parameter overrride in authorizationUrWithParams

* Change the type parameter order in http client JSON method

- It's more likely to apply type for JSON response than monad
- Hence move to first type parameter

* Add the oauth2 binding rewrite implementation and hoauth2 providers (freizl#155)


- The rewrite work resident at Network.OAuth2.Experiment module. See comments in the module for details.
- Adds package hoauth2-providers to for a list of common IdP providers, in terms of their OAuth2 endpoints, userinfo endpoint and the way to construct an Application. This package depends on the Experiment module
- Adds tutorial module for hoauth2-providers
- Updates hoauth2-demo application accordingly and add sample flow Resource Owner Password and Client Credential

* bump hoauth-2.6.0

* bump versions and change licence to MIT

release candidate for

- hoauth2@2.6.0
- hoauth2-demo@1.5.0
- hoauth2-providers@0.1
- hoauth2-providers-tutorial@0.1
- hoauth2-tutorial@0.1.2

* Update makefile

- fix the hlint task
- add publish task

* Update docs and notes

* move hoauth2-demo to new repo

* run dist before publish

* hoauth2-provider: refactor

- update developer page for IdPs
- rename DropboxName to DropboxUserName
- fixes the field comment for Google User

* Remove TODO to rename Facebook

- The social network brand isn't changed

* hoauth2-provider: add twitter

* move hoauth2-demo back; add twitter to demo app

* Adds comment to okta client credential app

* add ghcspecer but it doesn't for now

* :refactor: move to fourmolu

* fixes: surface up entire response body as string when response body is
empty when invoke API using access token

* refactor: rename ResourceOwner and ClientCredential idp config to idp application

* Add GrantType jwt-bearer (freizl#162)


- This is the grant type that google service account uses
- Spec https://www.rfc-editor.org/rfc/rfc7523.html#section-2.1

fixes freizl#16, freizl#51

* hard-code hoauth2 version in useragent header; format hoauth2.cabal.

* Omit internal modules from export/haddock

* Embedded version number dynamically is user agent string

* loose version for tutorial packages; add Paths_ autogen modules.

* Update oauth2 and user info endpoint for Azure

fixes freizl#165

* fixes hlint

* Add jwt authentication method for ClientCredential flow (freizl#163)


* Move google service account utilities to Provider.Google module
* move away from google-oauth-jwt by using HsOpenSSL and jose-jwt directly.
* re-purpose ClientSecret

* Format all src code by fourmolu

* Removes OAuth2Error and adds TokenRequestError (freizl#168)


Authorization Erorrs are not used at all hence doesn't seems beneficial to have data type (`OAuth2Errors`) that could accommodate both. Even it does (I missed use case), prefer being explicit that functions deal with Auth Request returns Auth Error, so as functions that deal with Token Request. So
- Removed `OAuth2Error` data type
- Create `TokenRequestError` that is dedicated to handle token request errors.

Also add unit test for token request error code and github action for unit test.

* Move HasIdpName class to hoauth2-demo (freizl#169)

fixes freizl#167

* bump to hoauth2-2.7; hoauth2-provider-0.2;

* fixes build due to hoauth-provider-0.2 bump

* :chore add restore key to github action

* Fixes the hoauth2 and hoauth2-provider boundary for others packages

* Fixes typo and a few refactor on documents (freizl#171)

* Update docs

* fixes typo in the example in Experiment.hs

* Fixes title of each hackage package

* a few tweaks

* format hackage badge

* update doc for hoauth-demo and quick fixes the path for env.json

* Rename readme.org to README.org

* change to unorder list

* Move idp guide to each module

* Move Provider.Utils to Data.ByteString.Contrib

* format files by fourmolu

* bump to text-2.0

* Specify hlint version

- to fix the runtime error

* ghc884 compatibility: Remove ImportQualifiedPost

---------

Co-authored-by: HW home <freizl@gmail.com>
Co-authored-by: Haisheng (mercury) <haisheng@mercury.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants