github.com/timstclair/heapster@v0.20.0-alpha1/Godeps/_workspace/src/golang.org/x/oauth2/google/jwt.go (about)

     1  // Copyright 2015 The Go Authors. All rights reserved.
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  package google
     6  
     7  import (
     8  	"crypto/rsa"
     9  	"fmt"
    10  	"time"
    11  
    12  	"golang.org/x/oauth2"
    13  	"golang.org/x/oauth2/internal"
    14  	"golang.org/x/oauth2/jws"
    15  )
    16  
    17  // JWTAccessTokenSourceFromJSON uses a Google Developers service account JSON
    18  // key file to read the credentials that authorize and authenticate the
    19  // requests, and returns a TokenSource that does not use any OAuth2 flow but
    20  // instead creates a JWT and sends that as the access token.
    21  // The audience is typically a URL that specifies the scope of the credentials.
    22  //
    23  // Note that this is not a standard OAuth flow, but rather an
    24  // optimization supported by a few Google services.
    25  // Unless you know otherwise, you should use JWTConfigFromJSON instead.
    26  func JWTAccessTokenSourceFromJSON(jsonKey []byte, audience string) (oauth2.TokenSource, error) {
    27  	cfg, err := JWTConfigFromJSON(jsonKey)
    28  	if err != nil {
    29  		return nil, fmt.Errorf("google: could not parse JSON key: %v", err)
    30  	}
    31  	pk, err := internal.ParseKey(cfg.PrivateKey)
    32  	if err != nil {
    33  		return nil, fmt.Errorf("google: could not parse key: %v", err)
    34  	}
    35  	ts := &jwtAccessTokenSource{
    36  		email:    cfg.Email,
    37  		audience: audience,
    38  		pk:       pk,
    39  	}
    40  	tok, err := ts.Token()
    41  	if err != nil {
    42  		return nil, err
    43  	}
    44  	return oauth2.ReuseTokenSource(tok, ts), nil
    45  }
    46  
    47  type jwtAccessTokenSource struct {
    48  	email, audience string
    49  	pk              *rsa.PrivateKey
    50  }
    51  
    52  func (ts *jwtAccessTokenSource) Token() (*oauth2.Token, error) {
    53  	iat := time.Now()
    54  	exp := iat.Add(time.Hour)
    55  	cs := &jws.ClaimSet{
    56  		Iss: ts.email,
    57  		Sub: ts.email,
    58  		Aud: ts.audience,
    59  		Iat: iat.Unix(),
    60  		Exp: exp.Unix(),
    61  	}
    62  	hdr := &jws.Header{
    63  		Algorithm: "RS256",
    64  		Typ:       "JWT",
    65  	}
    66  	msg, err := jws.Encode(hdr, cs, ts.pk)
    67  	if err != nil {
    68  		return nil, fmt.Errorf("google: could not encode JWT: %v", err)
    69  	}
    70  	return &oauth2.Token{AccessToken: msg, TokenType: "Bearer", Expiry: exp}, nil
    71  }