UrlSigner using active GoogleCredentials

Hi,

I deploy ServiceA in GAE project A using the default GAE service account. ServiceA accesses buckets in projectB. The service account (and my username) has been given access to the projectB.

Code is straightforward and works fine

 var bucket = client.GetBucket(bucketName);
 foreach (var obj in client.ListObjects(bucketName, "bc593da7")) {...}

I want to generate sign url using the current credentials being used but I am having a difficulties.

GoogleCredential credential = await GoogleCredential.GetApplicationDefaultAsync();returns the UserCredentials when I test locally, and will, I believe, return the service account credentials when deployed to GAE.

UrlSigner is all about ServiceAccountCredential. So i cannot even do:

GoogleCredential credential = await GoogleCredential.GetApplicationDefaultAsync();
var cred = credential.UnderlyingCredential as ServiceAccountCredential;
UrlSigner urlSigner = UrlSigner.FromServiceAccountCredential(cc);

as it gives me UserAccount cannot be casted in ServiceAccount when testing locally

Question: is there a way to sign an url using current credentials without storing/deploying the json key with the app?

[minherz]

@jskeet, this limitation makes it nearly impossible to use UrlSigner in conjunction with implicit service account that is associated with GCE instance. When running an app on GCE instance and calling to GoogleCredential.GetApplicationDefault() the ComputeCredential is returned. There is no way to get an instance of ServiceAccountCredential from an instance of ComputeCredential. I would expect that since both are based on ServiceCredential type, they both can be used for signing URLs. But the library is very strict on the matter.

[neil-119]

I wanted to share how we worked around this problem. We created a new Service Account and gave it the necessary permissions, and then we uploaded its JSON string to GCP Secret Manager. Since Secret Manager can be accessed with the default credentials, we stream the JSON from Secret Manager to create the credential, like so:

...
if (scopes == null)
                scopes = new string[] { "https://www.googleapis.com/auth/cloud-platform" };

            var json = ...; // grab it from Secret Manager
            using MemoryStream stream = new MemoryStream(System.Text.Encoding.UTF8.GetBytes(json));
            return (ServiceAccountCredential)GoogleCredential
                .FromStream(stream)
                .CreateScoped(scopes)
                .UnderlyingCredential;

...