question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

GoogleStorageDriver does not handle service account HMAC credentials

See original GitHub issue

Hello,

GoogleStorageDriver may use S3-compatibility layer credentials to connect to GCS. There are at least two ways to generate such credentials:

  • As User Account HMAC keys. This is inconvenient for services configuration because it ties access to the existence of a user account.
  • As Service Account HMAC keys. These should be used for long running services.

Unfortunately, GoogleStorageDriver does not identify the second type correctly. The problematic code is here:

https://github.com/apache/libcloud/blob/trunk/libcloud/common/google.py#L615

It checks the identifier starts with “GOOG” which is true in my case, but my identifier is 61 characters long, way above the 30 characters check.

Callers may force the driver to identify the credentials as GCS_S3, but it requires some digging in the class hierarchy. You need to:

  • Override _ex_connection_class_kwargs to return {"auth_type": "GCS_S3"}, to pass it to connectionCls. But this is not enough.
  • Pass auth_type="GCS_S3" to GoogleStorageDriver so that jsonConnectionCls is correctly instantiate.

I find the need for both fix a little weird, I would have expected the first one to be enough, but I do not know libcloud internals to have a relevant opinion.

I would just drop the max length check.

Thanks.

Issue Analytics

  • State:closed
  • Created 4 years ago
  • Reactions:3
  • Comments:7 (7 by maintainers)

github_iconTop GitHub Comments

1reaction
Kamicommented, Mar 10, 2020

Resolved via #1440.

Thanks again to everyone involved 👍

1reaction
Kamicommented, Mar 7, 2020

@MonsieurV and if you get a chance to work it in the next couple of days, I’ll also try to include in the upcoming v3.0.0 release.

Read more comments on GitHub >

github_iconTop Results From Across the Web

Manage HMAC keys for service accounts | Cloud Storage
This page shows you how to create, disable, and delete Hash-based Message Authentication Code (HMAC) keys associated with service accounts in your project....
Read more >
Generate HMAC keys for a service account to use with Google ...
There's no way to generate HMAC secrets for service accounts. The sub-optimal solution is to create a dedicated user account for signing.
Read more >
Using HMAC credentials - IBM Cloud Docs
HMAC credentials consist of an Access Key and Secret Key paired for use with S3-compatible tools and libraries that require authentication. HMAC credentials...
Read more >
Can I use HMAC credentials to create a new client? #5071
We want to switch an existing application from using AWS S3 to Google Cloud Storage at our company. We wish to use HMAC...
Read more >
Get authentication details - Akamai TechDocs
If you didn't download the file, or if you lost it, you may need to delete the existing HMAC key and add a...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found