gpt4 book ai didi

python - GAE 属性错误 : 'Credentials' object has no attribute 'with_subject'

转载 作者:行者123 更新时间:2023-11-28 17:02:57 25 4
gpt4 key购买 nike

我有一个 python 应用程序,我想在 App Engine(第二代 Python 3.7)上部署,我在该应用程序上使用启用了全域委派的服务帐户来访问用户数据。

我在本地:

import google.auth
from apiclient.discovery import build

creds, project = google.auth.default(
scopes=['https://www.googleapis.com/auth/admin.directory.user', ],
)
creds = creds.with_subject(GSUITE_ADMIN_USER)

service = build('admin', 'directory_v1', credentials=creds)

这很好用,据我所知,这是当前在使用应用程序默认凭据时执行此操作的方法(我在本地定义了 GOOGLE_APPLICATION_CREDENTIALS)。

问题出在 GAE 上,部署时,对 with_subject 的调用引发:AttributeError: 'Credentials' 对象没有属性 'with_subject'

我已经在 GAE 服务帐户上启用了全域委派。

当我在本地使用的 GOOGLE_APPLICATION_CREDENTIALS 和 GAE 中的 GOOGLE_APPLICATION_CREDENTIALS 都是具有域范围委托(delegate)的服务帐户时有何不同?

GAE 上的 .with_subject() 在哪里?

收到的 creds 对象是 compute_engine.credentials.Credentials 类型。

完整回溯:

Traceback (most recent call last):
File "/env/lib/python3.7/site-packages/gunicorn/arbiter.py", line 583, in spawn_worker
worker.init_process()
File "/env/lib/python3.7/site-packages/gunicorn/workers/gthread.py", line 104, in init_process
super(ThreadWorker, self).init_process()
File "/env/lib/python3.7/site-packages/gunicorn/workers/base.py", line 129, in init_process
self.load_wsgi()
File "/env/lib/python3.7/site-packages/gunicorn/workers/base.py", line 138, in load_wsgi
self.wsgi = self.app.wsgi()
File "/env/lib/python3.7/site-packages/gunicorn/app/base.py", line 67, in wsgi
self.callable = self.load()
File "/env/lib/python3.7/site-packages/gunicorn/app/wsgiapp.py", line 52, in load
return self.load_wsgiapp()
File "/env/lib/python3.7/site-packages/gunicorn/app/wsgiapp.py", line 41, in load_wsgiapp
return util.import_app(self.app_uri)
File "/env/lib/python3.7/site-packages/gunicorn/util.py", line 350, in import_app
__import__(module)
File "/srv/main.py", line 1, in <module>
from config.wsgi import application
File "/srv/config/wsgi.py", line 38, in <module>
call_command('gsuite_sync_users')
File "/env/lib/python3.7/site-packages/django/core/management/__init__.py", line 148, in call_command
return command.execute(*args, **defaults)
File "/env/lib/python3.7/site-packages/django/core/management/base.py", line 353, in execute
output = self.handle(*args, **options)
File "/srv/metanube_i4/users/management/commands/gsuite_sync_users.py", line 14, in handle
gsuite_sync_users()
File "/env/lib/python3.7/site-packages/celery/local.py", line 191, in __call__
return self._get_current_object()(*a, **kw)
File "/env/lib/python3.7/site-packages/celery/app/task.py", line 375, in __call__
return self.run(*args, **kwargs)
File "/srv/metanube_i4/users/tasks.py", line 22, in gsuite_sync_users
creds = creds.with_subject(settings.GSUITE_ADMIN_USER)
AttributeError: 'Credentials' object has no attribute 'with_subject'"

包(部分列表):

google-api-core==1.5.0
google-api-python-client==1.7.4
google-auth==1.5.1
google-auth-httplib2==0.0.3
google-cloud-bigquery==1.6.0
google-cloud-core==0.28.1
google-cloud-logging==1.8.0
google-cloud-storage==1.13.0
google-resumable-media==0.3.1
googleapis-common-protos==1.5.3
httplib2==0.11.3
oauthlib==2.1.0

最佳答案

的确,您不能将 with_subject 方法与 GAE 或 GCE 凭据一起使用。但是,有一个解决方法可以让我在我的 GCE 服务器上工作,我认为这也适用于 GAE 默认服务帐户。解决方案是使用具有所需 subjectscopes 的服务帐户身份来构建新凭证。可以找到详细的指南here ,但我也会在下面解释这个过程。

首先,服务帐户需要为自己创建服务帐户 token 的权限。这可以通过转到项目 IAM 和 admin > 服务帐户 页面来完成(确保信息面板可见,它可以从右上角切换)。复制服务帐户电子邮件地址并通过勾选复选框来选择有问题的服务帐户。现在信息面板应该有 ADD MEMBER 按钮。单击它并将服务帐户电子邮件粘贴到 New members 文本框。单击 Select role 下拉菜单并选择角色 Service Accounts -> Service Account Token Creator。您可以使用以下 gcloud 命令检查角色是否已分配:

gcloud iam service-accounts get-iam-policy [SERVICE_ACCOUNT_EMAIL]

现在是实际的 Python 代码。此示例是对上面链接的文档的轻微修改。

from googleapiclient.discovery import build
from google.auth import default, iam
from google.auth.transport import requests
from google.oauth2 import service_account

TOKEN_URI = 'https://accounts.google.com/o/oauth2/token'
SCOPES = ['https://www.googleapis.com/auth/admin.directory.user']
GSUITE_ADMIN_USER = 'admin@example.com'

def delegated_credentials(credentials, subject, scopes):
try:
# If we are using service account credentials from json file
# this will work
updated_credentials = credentials.with_subject(subject).with_scopes(scopes)
except AttributeError:
# This exception is raised if we are using GCE default credentials

request = requests.Request()

# Refresh the default credentials. This ensures that the information
# about this account, notably the email, is populated.
credentials.refresh(request)

# Create an IAM signer using the default credentials.
signer = iam.Signer(
request,
credentials,
credentials.service_account_email
)

# Create OAuth 2.0 Service Account credentials using the IAM-based
# signer and the bootstrap_credential's service account email.
updated_credentials = service_account.Credentials(
signer,
credentials.service_account_email,
TOKEN_URI,
scopes=scopes,
subject=subject
)
except Exception:
raise

return updated_credentials


creds, project = default()
creds = delegated_credentials(creds, GSUITE_ADMIN_USER, SCOPES)

service = build('admin', 'directory_v1', credentials=creds)

如果您将 GOOGLE_APPLICATION_CREDENTIALS 环境变量设置为服务帐户文件的路径,则 try block 不会失败。如果应用程序在 Google Cloud 上运行,则会出现 AttributeError 并通过创建具有正确 subjectscopes 的新凭据来处理。

您还可以将 None 作为 delegated_credentials 函数的 subject 传递,它会在没有委托(delegate)的情况下创建凭据,因此该函数可以与 or 一起使用没有委托(delegate)。

关于python - GAE 属性错误 : 'Credentials' object has no attribute 'with_subject' ,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/53202767/

25 4 0
Copyright 2021 - 2024 cfsdn All Rights Reserved 蜀ICP备2022000587号
广告合作:1813099741@qq.com 6ren.com