github.com/timstclair/heapster@v0.20.0-alpha1/Godeps/_workspace/src/golang.org/x/oauth2/google/jwt.go (about) 1 // Copyright 2015 The Go Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style 3 // license that can be found in the LICENSE file. 4 5 package google 6 7 import ( 8 "crypto/rsa" 9 "fmt" 10 "time" 11 12 "golang.org/x/oauth2" 13 "golang.org/x/oauth2/internal" 14 "golang.org/x/oauth2/jws" 15 ) 16 17 // JWTAccessTokenSourceFromJSON uses a Google Developers service account JSON 18 // key file to read the credentials that authorize and authenticate the 19 // requests, and returns a TokenSource that does not use any OAuth2 flow but 20 // instead creates a JWT and sends that as the access token. 21 // The audience is typically a URL that specifies the scope of the credentials. 22 // 23 // Note that this is not a standard OAuth flow, but rather an 24 // optimization supported by a few Google services. 25 // Unless you know otherwise, you should use JWTConfigFromJSON instead. 26 func JWTAccessTokenSourceFromJSON(jsonKey []byte, audience string) (oauth2.TokenSource, error) { 27 cfg, err := JWTConfigFromJSON(jsonKey) 28 if err != nil { 29 return nil, fmt.Errorf("google: could not parse JSON key: %v", err) 30 } 31 pk, err := internal.ParseKey(cfg.PrivateKey) 32 if err != nil { 33 return nil, fmt.Errorf("google: could not parse key: %v", err) 34 } 35 ts := &jwtAccessTokenSource{ 36 email: cfg.Email, 37 audience: audience, 38 pk: pk, 39 } 40 tok, err := ts.Token() 41 if err != nil { 42 return nil, err 43 } 44 return oauth2.ReuseTokenSource(tok, ts), nil 45 } 46 47 type jwtAccessTokenSource struct { 48 email, audience string 49 pk *rsa.PrivateKey 50 } 51 52 func (ts *jwtAccessTokenSource) Token() (*oauth2.Token, error) { 53 iat := time.Now() 54 exp := iat.Add(time.Hour) 55 cs := &jws.ClaimSet{ 56 Iss: ts.email, 57 Sub: ts.email, 58 Aud: ts.audience, 59 Iat: iat.Unix(), 60 Exp: exp.Unix(), 61 } 62 hdr := &jws.Header{ 63 Algorithm: "RS256", 64 Typ: "JWT", 65 } 66 msg, err := jws.Encode(hdr, cs, ts.pk) 67 if err != nil { 68 return nil, fmt.Errorf("google: could not encode JWT: %v", err) 69 } 70 return &oauth2.Token{AccessToken: msg, TokenType: "Bearer", Expiry: exp}, nil 71 }