Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support for generating a OAuth 2.0 access tokens with lifespan > 1 hour #474

Closed
bjornandre opened this issue Sep 2, 2020 · 3 comments · Fixed by #516
Closed

Support for generating a OAuth 2.0 access tokens with lifespan > 1 hour #474

bjornandre opened this issue Sep 2, 2020 · 3 comments · Fixed by #516
Assignees
Labels
type: feature request ‘Nice-to-have’ improvement, new feature or different behavior or design.

Comments

@bjornandre
Copy link

bjornandre commented Sep 2, 2020

By default, OAuth 2.0 access tokens are valid for a maximum of 1 hour (3,600 seconds). However, the maximum lifetime for these tokens can be extended to 12 hours (43,200 seconds) according to the documentation: https://cloud.google.com/iam/docs/creating-short-lived-service-account-credentials#sa-credentials-oauth

This is currently not possible since the maximum 1 hour lifespan is hard-coded into both the ImpersonatedCredentials and the ServiceAccountCredentials class.

@chingor13 chingor13 added the type: feature request ‘Nice-to-have’ improvement, new feature or different behavior or design. label Sep 2, 2020
@chingor13
Copy link
Contributor

The credential classes are designed to cache tokens between requests and opaquely refresh them when needed. Can you describe the use case where you need to have a longer expiry?

@bjornandre
Copy link
Author

bjornandre commented Sep 2, 2020

My use case is as follows:

  • An access token "broker" service that generates OAuth 2.0 access tokens. This service has a Service Account to a Google Cloud Storage (GCS) bucket.
  • A distributed computing engine which, for security reasons, must use the "broker" to get an access token to the GCS bucket (i.e. doesn't have direct access to GCS or the Service Account).

The distributed computing engine may spawn lots of worker nodes. The worker nodes will be fed by the same access token at runtime. Since some of the distributed computing jobs may take more than 1 hour to complete it is desirable that the access token can have a longer expiry.

@chingor13
Copy link
Contributor

cc @silvolu

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type: feature request ‘Nice-to-have’ improvement, new feature or different behavior or design.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants