Repository navigation
In auth/cloud-client/snippets.py explicitly use service account credentials file is not working. But working implicitly. #972
Description
In which file did you encounter the issue?
In the python-docs-samples/auth/cloud-client/snippets.py
Did you change the file? If so, how?
No.
Describe the issue
In the python-docs-samples/auth/cloud-client/snippets.py the explicit()
is not working. It should "Explicitly use service account credentials by specifying the private key file".
The virtualenv is env GOOGLE_APPLICATION_CREDENTIALS and is not set to make the clean test.
Meanwhile an implicit auth working when I try another ssh session and provide env
"export GOOGLE_APPLICATION_CREDENTIALS=/home/ban/pcap2/cdr-testing-3986cdf1eacb.json"
Python 3.5.2 (default, Apr 21 2017, 14:35:03)
Type 'copyright', 'credits' or 'license' for more information
IPython 6.0.0 -- An enhanced Interactive Python. Type '?' for help.
In [1]: def implicit():
...: from google.cloud import storage
...:
...: # If you don't specify credentials when constructing the client, the
...: # client library will look for credentials in the environment.
...: storage_client = storage.Client()
...:
...: # Make an authenticated API request
...: buckets = list(storage_client.list_buckets())
...: print(buckets)
...:
In [2]: implicit()
[<Bucket: cdr_testing1>, <Bucket: opentact1>]
The output of explicit():
Python 3.5.2 (default, Apr 21 2017, 14:35:03)
Type 'copyright', 'credits' or 'license' for more information
IPython 6.0.0 -- An enhanced Interactive Python. Type '?' for help.
In [1]: filename = 'service_account.json'
In [2]: def explicit():
...: from google.cloud import storage
...:
...: # Explicitly use service account credentials by specifying the private key
...: # file. All clients in google-cloud-python have this helper, see
...: # https://google-cloud-python.readthedocs.io/en/latest/core/modules.html
...: # #google.cloud.client.Client.from_service_account_json
...: storage_client = storage.Client.from_service_account_json(
...: 'service_account.json')
...:
...: # Make an authenticated API request
...: buckets = list(storage_client.list_buckets())
...: print(buckets)
...:
In [3]: explicit()
---------------------------------------------------------------------------
DefaultCredentialsError Traceback (most recent call last)
<ipython-input-3-58d4038d92ac> in <module>()
----> 1 explicit()
<ipython-input-2-f3ef044d040a> in explicit()
7 # #google.cloud.client.Client.from_service_account_json
8 storage_client = storage.Client.from_service_account_json(
----> 9 'service_account.json')
10
11 # Make an authenticated API request
/home/ban/.virtualenvs/py3/lib/python3.5/site-packages/google/cloud/client.py in from_service_account_json(cls, json_credentials_path, *args, **kwargs)
69 json_credentials_path)
70 kwargs['credentials'] = credentials
---> 71 return cls(*args, **kwargs)
72
73
/home/ban/.virtualenvs/py3/lib/python3.5/site-packages/google/cloud/storage/client.py in __init__(self, project, credentials, _http)
57 self._base_connection = None
58 super(Client, self).__init__(project=project, credentials=credentials,
---> 59 _http=_http)
60 self._connection = Connection(self)
61 self._batch_stack = _LocalStack()
/home/ban/.virtualenvs/py3/lib/python3.5/site-packages/google/cloud/client.py in __init__(self, project, credentials, _http)
209
210 def __init__(self, project=None, credentials=None, _http=None):
--> 211 _ClientProjectMixin.__init__(self, project=project)
212 Client.__init__(self, credentials=credentials, _http=_http)
/home/ban/.virtualenvs/py3/lib/python3.5/site-packages/google/cloud/client.py in __init__(self, project)
165
166 def __init__(self, project=None):
--> 167 project = self._determine_default(project)
168 if project is None:
169 raise EnvironmentError('Project was not passed and could not be '
/home/ban/.virtualenvs/py3/lib/python3.5/site-packages/google/cloud/client.py in _determine_default(project)
178 def _determine_default(project):
179 """Helper: use default project detection."""
--> 180 return _determine_default_project(project)
181
182
/home/ban/.virtualenvs/py3/lib/python3.5/site-packages/google/cloud/_helpers.py in _determine_default_project(project)
179 """
180 if project is None:
--> 181 _, project = google.auth.default()
182 return project
183
/home/ban/.virtualenvs/py3/lib/python3.5/site-packages/google/auth/_default.py in default(scopes, request)
280 return credentials, explicit_project_id or project_id
281
--> 282 raise exceptions.DefaultCredentialsError(_HELP_MESSAGE)
DefaultCredentialsError: Could not automatically determine credentials. Please set GOOGLE_APPLICATION_CREDENTIALS or
explicitly create credential and re-run the application. For more
information, please see
https://developers.google.com/accounts/docs/application-default-credentials.
ckecking key file OK:
In [7]: import json
In [8]: filename = 'service_account.json'
In [9]: with open(filename, 'r') as file_obj:
...: info = json.load(file_obj)
...: print(info['project_id'])
...:
...:
cdr-testing
linux
CentOS Linux release 7.2.1511 (Core)
Linux testing 3.10.0-327.36.2.el7.x86_64 #1 SMP Mon Oct 10 23:08:37 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
virtualenv params:
pip freeze
appdirs==1.4.3
asn1crypto==0.22.0
cachetools==2.0.0
certifi==2015.4.28
cffi==1.10.0
chardet==3.0.3
click==6.7
cryptography==1.8.2
decorator==4.0.11
docutils==0.13.1
Flask==0.12.2
gcs-client==0.2.2
google-auth==1.0.1
google-auth-httplib2==0.0.2
google-cloud-core==0.24.1
google-cloud-storage==1.1.1
google-resumable-media==0.0.2
googleapis-common-protos==1.5.2
httplib2==0.10.3
idna==2.5
ipython==6.0.0
ipython-genutils==0.2.0
itsdangerous==0.24
jedi==0.10.2
Jinja2==2.9.6
lockfile==0.12.2
MarkupSafe==1.0
oauth2client==1.5.2
packaging==16.8
paramiko==2.1.2
pexpect==4.2.1
pickleshare==0.7.4
prompt-toolkit==1.0.14
protobuf==3.3.0
psycopg2==2.7.1
ptyprocess==0.5.1
pyasn1==0.2.3
pyasn1-modules==0.0.8
pycparser==2.17
pycrypto==2.6.1
Pygments==2.2.0
pyOpenSSL==17.0.0
pyparsing==2.2.0
python-daemon==2.1.2
requests==2.17.3
rsa==3.4.2
simplegeneric==0.8.1
six==1.10.0
traitlets==4.3.2
urllib3==1.21.1
wcwidth==0.1.7
Werkzeug==0.12.2
The only outdated package is set explicitly the certifi==2015.4.28 as a workaround for CentOS trouble with SSL2.
Activity
[-]Explicitly use service account credentials file is not working. But working implicitly.[/-][+]In auth/cloud-client/snippets.py explicitly use service account credentials file is not working. But working implicitly.[/+]theacodes commentedon Jun 2, 2017
@denis-trofimov quick sanity check - does your service account keyfile have the project ID in it?
denis-trofimov commentedon Jun 4, 2017
@jonparrott, thank you for a swift reply.
After day off I have checked that I do send project ID. I excluded private info with [***].
{
"type": "service_account",
"project_id": "cdr-testing",
"private_key_id": "[some *** alfanumber literal]",
"private_key": "-----BEGIN PRIVATE KEY-----[some *** alfanumber literal]==\n-----END PRIVATE KEY-----\n",
"client_email": "[some *** email]",
"client_id": "[some *** number literal]",
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
"token_uri": "https://accounts.google.com/o/oauth2/token",
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
"client_x509_cert_url": "[***].gserviceaccount.com"
}
I don't think this is some magic. What i am doing wrong!?
robmarkcole commentedon Oct 26, 2017
Likewise on following this example, I receive the error:
denis-trofimov commentedon Oct 26, 2017
@robmarkcole I suggest you to
engelke commentedon Dec 6, 2018
Sorry about the gap in responses. It's been over a year, and the examples you show are working properly for me. Perhaps the client libraries or services have changed slightly since your report. If the problem still persists please reopen this issue or submit a new one. Thanks.
chore(deps): update dependency google-cloud-pubsub to v2.13.12 (#972)