{"id":21354922,"url":"https://github.com/salrashid123/gcp_process_credentials_go","last_synced_at":"2026-05-16T23:12:23.238Z","repository":{"id":189687935,"uuid":"681112887","full_name":"salrashid123/gcp_process_credentials_go","owner":"salrashid123","description":"Process Credentials for GCP Client Library  - golang","archived":false,"fork":false,"pushed_at":"2024-04-25T12:03:30.000Z","size":28,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-01-22T17:47:01.922Z","etag":null,"topics":["aws","aws-authentication"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/salrashid123.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2023-08-21T09:42:48.000Z","updated_at":"2024-04-25T12:03:34.000Z","dependencies_parsed_at":null,"dependency_job_id":"838d576b-f252-4479-b0e8-dfe5220c542f","html_url":"https://github.com/salrashid123/gcp_process_credentials_go","commit_stats":null,"previous_names":["salrashid123/gcp_process_credentials_go"],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/salrashid123%2Fgcp_process_credentials_go","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/salrashid123%2Fgcp_process_credentials_go/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/salrashid123%2Fgcp_process_credentials_go/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/salrashid123%2Fgcp_process_credentials_go/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/salrashid123","download_url":"https://codeload.github.com/salrashid123/gcp_process_credentials_go/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243828587,"owners_count":20354526,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","aws-authentication"],"created_at":"2024-11-22T04:15:20.490Z","updated_at":"2026-05-16T23:12:18.200Z","avatar_url":"https://github.com/salrashid123.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"## Process Credentials for GCP Client Library  - golang\n\nGoogle Cloud Credential provider which allows sourcing credentials from an external process.\n\nEssentially, its a credential source which allows the delegation of acquiring GCP `access_tokens` to arbitrary binaries you have access to at runtime.\n\nThe arbitrary binary would use whatever means it has available (kerberos, ldap, saml-cli, etc) to get a GCP `access_token`.  \n\nFrom there, the token is given surfaced as a refreshable credential source you can directly use with a GCP library.\n\nThis is similar to several systems that provide such delegation.\n\n* Kubernetes kubectl [credential plugin](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins)\n* [AWS Process Credentials](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sourcing-external.html)\n\n\nNeedless to say, use this after very careful consideration:  this library will attempt to execute a binary on the system where its run (ofcource the process running using the library would need access to run the script anyway)\n\n\u003e\u003e **NOTE** these samples are NOT supported by google; its just something done on a weekend...\n\n---\n\n### Implementations\n\nAs its a weekend project, caveat emptor.  The code is alpha quality and I didn't have time to push it to maven central, npm, etc. \n\nIf you want it there, please review the code, provide suggestions and improvements here\n\n* `golang`: [https://github.com/salrashid123/gcp_process_credentials_go](https://github.com/salrashid123/gcp_process_credentials_go)\n* `python`: [https://github.com/salrashid123/gcp_process_credentials_py](https://github.com/salrashid123/gcp_process_credentials_py)\n* `java`: [https://github.com/salrashid123/gcp_process_credentials_java](https://github.com/salrashid123/gcp_process_credentials_java)\n* `node`: [https://github.com/salrashid123/gcp_process_credentials_node](https://github.com/salrashid123/gcp_process_credentials_node)\n\n\nSee the \"examples\" folder in each\n\n---\n\n### Binary Response Contract\n\nEach library above will invoke a binary, pass it some args and env var.\n\nThe response back from the binary must\n\nbe valid JSON in the form\n\n```json\n{\n  \"access_token\": \"ya29....\",\n  \"expires_in\": 3600,\n  \"token_type\": \"Bearer\"\n}\n```\n\n* `access_token`: your access token\n* `expires_in`: how many seconds this token is valid for\n* `token_type`:  usually just a bearer token\n\n### Quickstart\n\nFor a quick example, the following will read a token file and use that for credentials:\n\n```golang\nimport \"github.com/salrashid123/gcp_process_credentials_go\"\n\n\textTokenSource, err := sal.ExternalTokenSource(\n\t\t\u0026sal.ExternalTokenConfig{\n\t\t\tCommand: \"/usr/bin/cat\",\n\t\t\tEnv:     []string{\"foo=bar\"},\n\t\t\tArgs:    []string{\"/tmp/token.txt\"},\n\t\t},\n\t)\n\n\ttok, err := extTokenSource.Token()\n\n\tsts := oauth2.ReuseTokenSource(tok, extTokenSource)\n\tstorageClient, err := storage.NewClient(ctx, option.WithTokenSource(sts))\n```\n\nofcourse the file  here `/tmp/token.txt` **must** be the json file format described above\n\n### Parser Interface \n\nIf your binary does not provide the exact json format, your can define a parser interface to 'translate' the credential for you.\n\nFor example,  `gcloud auth print-access-token` returns just the access token with an annoying newline character from stdout.\n\nYou an provide an interface to do the translation like this:\n\n```golang\n\textTokenSource, err := sal.ExternalTokenSource(\n\t\t\u0026sal.ExternalTokenConfig{\n\t\t\tCommand: \"gcloud\",\n\t\t\tEnv:     []string{\"foo=bar\"},\n\t\t\tArgs:    []string{\"auth\", \"print-access-token\"},\n\t\t\tParser: func(b []byte) (sal.ExternalTokenResponse, error) {\n\t\t\t\tret := \u0026sal.ExternalTokenResponse{\n\t\t\t\t\tToken:     string(b),\n\t\t\t\t\tExpiresIn: 3600,\n\t\t\t\t\tTokenType: \"Bearer\",\n\t\t\t\t}\n\t\t\t\treturn *ret, nil\n\t\t\t},\n\t\t},\n\t)\n```\n\n### Injecting tokens vs Wrapped Credentials\n\nYou might be asking..._why cant' i just run the binary on my own in code, get the token an inject it as a credential like this?_?\n\nWell, the, token is _not_ refreshable and your client library will need to manage that.  On the other hand, if you use this library, it will automatically refresh the token by calling the binary when its nearing expiration\n\n---\n\nOther References [AWS-\u003eGCP Process Credential Plugin](https://github.com/salrashid123/awscompat#process-credentials)\n\n\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsalrashid123%2Fgcp_process_credentials_go","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsalrashid123%2Fgcp_process_credentials_go","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsalrashid123%2Fgcp_process_credentials_go/lists"}