GoogleStorageDriver does not handle service account HMAC credentials
See original GitHub issueHello,
GoogleStorageDriver may use S3-compatibility layer credentials to connect to GCS. There are at least two ways to generate such credentials:
- As User Account HMAC keys. This is inconvenient for services configuration because it ties access to the existence of a user account.
- As Service Account HMAC keys. These should be used for long running services.
Unfortunately, GoogleStorageDriver does not identify the second type correctly. The problematic code is here:
https://github.com/apache/libcloud/blob/trunk/libcloud/common/google.py#L615
It checks the identifier starts with “GOOG” which is true in my case, but my identifier is 61 characters long, way above the 30 characters check.
Callers may force the driver to identify the credentials as GCS_S3, but it requires some digging in the class hierarchy. You need to:
- Override
_ex_connection_class_kwargs
to return{"auth_type": "GCS_S3"}
, to pass it to connectionCls. But this is not enough. - Pass
auth_type="GCS_S3"
to GoogleStorageDriver so that jsonConnectionCls is correctly instantiate.
I find the need for both fix a little weird, I would have expected the first one to be enough, but I do not know libcloud internals to have a relevant opinion.
I would just drop the max length check.
Thanks.
Issue Analytics
- State:
- Created 4 years ago
- Reactions:3
- Comments:7 (7 by maintainers)
Top GitHub Comments
Resolved via #1440.
Thanks again to everyone involved 👍
@MonsieurV and if you get a chance to work it in the next couple of days, I’ll also try to include in the upcoming v3.0.0 release.