Skip to content

Latest commit

 

History

History
138 lines (98 loc) · 5.82 KB

AUTHENTICATION.md

File metadata and controls

138 lines (98 loc) · 5.82 KB
Raw

Authentication

In general, the google-cloud-ruby library uses Service Account credentials to connect to Google Cloud services. When running on Compute Engine the credentials will be discovered automatically. When running on other environments, the Service Account credentials can be specified by providing the path to the JSON keyfile for the account (or the JSON itself) in environment variables. Additionally, Cloud SDK credentials can also be discovered automatically, but this is only recommended during development.

General instructions, environment variables, and configuration options are covered in the general Authentication guide for the google-cloud umbrella package. Specific instructions and environment variables for each individual service are linked from the README documents listed below for each service.

Creating a Service Account

Google Cloud requires a Project ID and Service Account Credentials to connect to most services.

If you are not running this client within Google Cloud Platform environments, you need a Google Developers service account.

  1. Visit the Google Developers Console.

  2. Create a new project or click on an existing project.

  3. Activate the slide-out navigation tray and select API Manager. From here, you will enable the APIs that your application requires.

    Enable the APIs that your application requires

    Note: You may need to enable billing in order to use these services.

  4. Select Credentials from the side navigation.

    You should see a screen like one of the following.

    Create a new service account

    Create a new service account With Existing Keys

    Find the "Add credentials" drop down and select "Service account" to be guided through downloading a new JSON key file.

    If you want to re-use an existing service account, you can easily generate a new key file. Just select the account you wish to re-use, and click "Generate new JSON key":

    Re-use an existing service account

    The key file you download will be used to authenticate API requests and should be stored in a secure location.

Project and Credential Lookup

The google-cloud-ruby library aims to make authentication as simple as possible, and provides several mechanisms to configure your system without providing Project ID and Service Account Credentials directly in code.

Project ID is discovered in the following order:

  1. Specify project ID in code
  2. Discover project ID in environment variables
  3. Discover GCE project ID

Credentials are discovered in the following order:

  1. Specify credentials in code
  2. Discover credentials path in environment variables
  3. Discover credentials JSON in environment variables
  4. Discover credentials file in the Cloud SDK's path
  5. Discover GCE credentials

Google Cloud Platform environments

While running on Google Cloud Platform environments such as Google Compute Engine, Google App Engine and Google Kubernetes Engine, no extra work is needed. The Project ID and Credentials and are discovered automatically. Code should be written as if already authenticated.

Environment Variables

The Project ID and Credentials JSON can be placed in environment variables instead of declaring them directly in code. Each service has its own environment variable, allowing for different service accounts to be used for different services. (See the READMEs for the individual service gems for details.) The path to the Credentials JSON file can be stored in the environment variable, or the Credentials JSON itself can be stored for environments such as Docker containers where writing files is difficult or not encouraged.

Here are the environment variables that Datastore checks for project ID:

  1. DATASTORE_PROJECT
  2. GOOGLE_CLOUD_PROJECT

Here are the environment variables that Datastore checks for credentials:

  1. DATASTORE_KEYFILE - Path to JSON file
  2. GOOGLE_CLOUD_KEYFILE - Path to JSON file
  3. DATASTORE_KEYFILE_JSON - JSON contents
  4. GOOGLE_CLOUD_KEYFILE_JSON - JSON contents

Cloud SDK

This option allows for an easy way to authenticate during development. If credentials are not provided in code or in environment variables, then Cloud SDK credentials are discovered.

To configure your system for this, simply:

  1. Download and install the Cloud SDK
  2. Authenticate using OAuth 2.0 $ gcloud auth login
  3. Write code as if already authenticated.

NOTE: This is not recommended for running in production. The Cloud SDK *should only be used during development.

Troubleshooting

If you're having trouble authenticating open a Github Issue to get help. Also consider searching or asking questions on StackOverflow.