Storage: app_identity_service.GetAccessToken NOT_ALLOWED

• GAE standard env
• google-cloud-storage==1.9.0

steps to reproduce:

• create a long-lived Bucket object
• do some file operations, under the hood it will get an access_token from IdentityService for you
• keep your Bucket instance live for at least 1h (so that access token can expire)
• next time when you’ll try to get a fresh token from IdentityService it will raise NotAllowed exception

code example: https://github.com/zyzniewski/app_identity_service_bug/blob/master/main.py

[theacodes]

Yeah there’s definitely a possibility that App Engine can’t do authentication outside of a request context, so I would suggest creating your client during your request.

Also, we don’t fully support App Engine standard yet in these libraries. See #1893.

[jacobg]

I’m also running into this issue with the Firebase Admin SDK on GAE Python 2.7. I call firebase_admin.initialize_app() when the app starts up. I thought maybe that happens under /_ah/warmup request. And it works fine, but then after an hour, when it needs to refresh during another request, it fails. But how is that out of “request context”? Or do you mean that a request can’t refresh a token that a different request originally generated?

If I call firebase_admin.initialize_app() on every request where I need it, will that add latency? Are there any other throttles on # of access tokens generated?

  File "/base/data/home/apps/s~f/1.415261650055915972/sitepackages/prod/firebase_admin/auth.py", line 252, in get_user_by_email
    response = user_manager.get_user(email=email)
  File "/base/data/home/apps/s~f/1.415261650055915972/sitepackages/prod/firebase_admin/_user_mgt.py", line 397, in get_user
    response = self._client.request('post', 'getAccountInfo', json=payload)
  File "/base/data/home/apps/s~f/1.415261650055915972/sitepackages/prod/firebase_admin/auth.py", line 513, in request
    resp = self.session.request(method, self.ID_TOOLKIT_URL + urlpath, **kwargs)
  File "/base/data/home/apps/s~f/1.415261650055915972/sitepackages/prod/google/auth/transport/requests.py", line 198, in request
    self._auth_request, method, url, request_headers)
  File "/base/data/home/apps/s~f/1.415261650055915972/sitepackages/prod/google/auth/credentials.py", line 122, in before_request
    self.refresh(request)
  File "/base/data/home/apps/s~f/1.415261650055915972/sitepackages/prod/google/auth/app_engine.py", line 118, in refresh
    self._scopes, self._service_account_id)
  File "/base/alloc/tmpfs/dynamic_runtimes/python27g/7e468a4e2dbc991a/python27/python27_lib/versions/1/google/appengine/api/app_identity/app_identity.py", line 605, in get_access_token
    scopes, service_account_id=service_account_id)
  File "/base/alloc/tmpfs/dynamic_runtimes/python27g/7e468a4e2dbc991a/python27/python27_lib/versions/1/google/appengine/api/app_identity/app_identity.py", line 558, in get_access_token_uncached
    return rpc.get_result()
  File "/base/alloc/tmpfs/dynamic_runtimes/python27g/7e468a4e2dbc991a/python27/python27_lib/versions/1/google/appengine/api/apiproxy_stub_map.py", line 615, in get_result
    return self.__get_result_hook(self)
  File "/base/alloc/tmpfs/dynamic_runtimes/python27g/7e468a4e2dbc991a/python27/python27_lib/versions/1/google/appengine/api/app_identity/app_identity.py", line 529, in get_access_token_result
    raise _to_app_identity_error(err)
NotAllowed