python - 如何获取用于调用 google api 的委托(delegate)凭证对象？

Question

我正在尝试通过 API 获取 gsuite 警报。我已经根据他们的 docs 创建了一个服务帐户我已将该服务帐户分配给我的谷歌云功能。

我不想使用环境变量或将凭据与源代码一起上传，但我想利用函数使用的默认服务帐户。

from googleapiclient.discovery import build

def get_credentials():

    # if one knows credentials file location(when one uploads the json credentials file or specify them in environment variable) one can easily get the credentials by specify the path.
    # In case of google cloud functions atleast I couldn't find it the path as the GOOGLE_APPLICATION_CREDENTIALS is empty in python runtime

    # the below code work find if one uncomments the below line
    #credentials = ServiceAccountCredentials.from_json_keyfile_name(key_file_location)

    credentials = < how to get default credentials object for default service account?>

    delegated_credentials = credentials.create_delegated('admin@alertcenter1.bigr.name').create_scoped(SCOPES)
    return delegated_credentials

def get_alerts(api_name, api_version, key_file_location=None):

    delegated_credentials = get_credentials()
    alertcli = build(api_name, api_version, credentials=delegated_credentials)
    resp = alertcli.alerts().list(pageToken=None).execute()
    print(resp)

有什么方法可以创建默认凭据对象。我试过使用from google.auth import credentials 但这不包含 create_delegated 函数和我也尝试过 ServiceAccountCredentials() 但这需要签名者。

Answer 1

这是一个使用 Gmail API 和委托(delegate)凭据的示例。服务帐户凭据需要启用“启用 G Suite 全域委派”。

from google.oauth2 import service_account
from googleapiclient.discovery import build

credentials = service_account.Credentials.from_service_account_file(
                        credentials_file,
                        scopes=['https://www.googleapis.com/auth/gmail.send'])

impersonate = 'username@example.com'

credentials = credentials.with_subject(impersonate)

service = build('gmail', 'v1', credentials=credentials)