有什么方法可以使用一些谷歌云 java 客户端获取“令牌”？答案

【问题标题】：Is the any way to get "token" using some Google cloud java client?有什么方法可以使用一些谷歌云 java 客户端获取“令牌”？
【发布时间】：2021-11-11 22:29:37
【问题描述】：

我正在尝试实现这个https://vaex.io/docs/api.html：

df = vaex.open('gs://vaex-data/airlines/us_airline_data_1988_2019.hdf5?token=MAGIC_GOOGLE_TOKEN')

我有java和

{
  "type": "service_account",
  "project_id": "project_id",
  "private_key_id": "XXX",
  "private_key": "YYY"
  
}

为简洁起见，省略了其他字段。

是否有可能使用谷歌云 java 客户端以某种方式获取此令牌？

我正在尝试这个：

 def getOrCreateInstance(bigQueryCredentialsJson: String,
                          projectId: String): BigQueryClientService = {
    val serviceAccountCredentials: ServiceAccountCredentials = ServiceAccountCredentials.fromStream(new ByteArrayInputStream(bigQueryCredentialsJson.getBytes(StandardCharsets.UTF_8)))
    val bigQuery = BigQueryOptions.newBuilder()
      .setCredentials(serviceAccountCredentials)
      .setProjectId(projectId)
      .build()
      .getService

    new BigQueryClientService(bigQuery, projectId, serviceAccountCredentials)
  }

它确实有效，因为

我可以使用 BigQuery 实例连接到 BigQuery。
查询结果导出到云存储，所以我当前的账户对特定云存储有RWX访问权限

我的下一步是向另一个内部系统提供存储桶路径 + accessToken。

这是我尝试获取 AccessToken 的另一种方法

def getAccessToken(): AccessToken = {
    // serviceAccountCredentials were instantiated above
    serviceAccountCredentials.refreshIfExpired() // exception
    serviceAccountCredentials.getAccessToken
  }

它在refreshIfExpired 处抛出异常


Error getting access token for service account: 400 Bad Request
POST https://oauth2.googleapis.com/token
{"error":"invalid_scope","error_description":"Invalid OAuth scope or ID token audience provided."}, iss:bla_bla@datadiscovery-spark-dev.iam.gserviceaccount.com
java.io.IOException: Error getting access token for service account: 400 Bad Request
POST https://oauth2.googleapis.com/token
{"error":"invalid_scope","error_description":"Invalid OAuth scope or ID token audience provided."}, iss: bla_bla@datadiscovery-spark-dev.iam.gserviceaccount.com
    at com.google.auth.oauth2.ServiceAccountCredentials.refreshAccessToken(ServiceAccountCredentials.java:605)
    at com.google.auth.oauth2.OAuth2Credentials$1.call(OAuth2Credentials.java:243)
    at com.google.auth.oauth2.OAuth2Credentials$1.call(OAuth2Credentials.java:240)
    at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
    at com.google.common.util.concurrent.DirectExecutor.execute(DirectExecutor.java:30)
    at com.google.auth.oauth2.OAuth2Credentials$AsyncRefreshResult.executeIfNew(OAuth2Credentials.java:567)
    at com.google.auth.oauth2.OAuth2Credentials.asyncFetch(OAuth2Credentials.java:206)
    at com.google.auth.oauth2.OAuth2Credentials.refreshIfExpired(OAuth2Credentials.java:177)

我不知道为什么，但这至少开始创建 AccessToken

 def getAccessToken(): AccessToken = {
    val scoped = serviceAccountCredentials.createScoped("https://www.googleapis.com/auth/devstorage.read_write")
    scoped.refreshIfExpired()
    scoped.getAccessToken
  }

这个我不关注。服务帐号可以将 BigQuery 查询结果导出到云存储，但无法获取访问令牌来读取相同的数据...

【问题讨论】：

标签： google-cloud-platform google-cloud-storage vaex

【解决方案1】：

您可以使用Google Auth Library for Java

以下示例从服务帐户 JSON 密钥文件中获取 Google OAuth 访问令牌。

GoogleCredentials credentials = GoogleCredentials.fromStream(new FileInputStream("/path/to/credentials.json"));
credentials.refreshIfExpired();
AccessToken token = credentials.getAccessToken();

Google Cloud 授权通常通过 HTTP 标头 Authorization: Bearer TOKEN 指定。还有其他方法如签名网址，但不支持HTTP请求查询参数。

构建与此示例类似的 HTTP 请求。将 GOOGLE_STORAGE_URL 替换为 REST API URL，例如 https://storage.googleapis.com/storage/v1/b/BUCKET/o/OBJECT

HttpClient client = HttpClient.newHttpClient();

HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create(GOOGLE_STORAGE_URL))
    .GET()
    .header("Authorization", "Bearer " + token)
    .build();

HttpResponse<String> response = client.send(request,
    HttpResponse.BodyHandlers.ofString());

有关 API 调用和参数，请参阅 API 文档：

Google Cloud Storage REST API Object GET documenation

注意：我建议使用 Google Cloud Storage Java SDK 而不是我上面写的 REST API 示例。

Cloud Storage client libraries

【讨论】：