Sign google cloud storage blob using access token

Question

Goal: Generate Signed-URL Using OAuth2.0 Access Token

The examples and source codes I find for signing Google Cloud Storage blobs all require service account credentials file (the private key to be specific). For instance:

https://cloud.google.com/storage/docs/access-control/signing-urls-with-helpers#storage-signed-url-get-object-python

However, since I follow the authorization flow discussed here, I only have OAuth2.0 access token (and I do NOT have the credentials file and private key of a service account with access to GCS bucket/object). Hence, I was wondering how I can sign blobs using OAuth2.0 access tokens.

The Code Used:

I use the following to sign blob:


# First, get access token:
service_account = "<email address of a service account>"
access_token = build(
    serviceName='iamcredentials',
    version='v1',
    http=http
).projects().serviceAccounts().generateAccessToken(
    name="projects/{}/serviceAccounts/{}".format(
        "-",
        service_account),
    body=body
).execute()["accessToken"]

credentials = AccessTokenCredentials(access_token, "MyAgent/1.0", None)

# Second, use the access token to sign a blob
url = "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/{}:signBlob".format(service_account)
encoded = base64.b64encode(blob)
sign_blob_request_body = {"payload": encoded}

response = requests.post(url,
                         data=json.dumps(sign_blob_request_body),
                         headers={
                             'Content-Type': 'application/json',
                             'Authorization': 'Bearer {}'.format(credentials.access_token)})
signature = response.json()["signedBlob"]

# Third, use the signature to create signed URL:
encoded_signature = base64.b64encode(signature)
signed_url = "https://storage.googleapis.com/<BUCKET>/<OBJECT>?" \
             "GoogleAccessId={}&" \
             "Expires={}&" \
             "Signature={}".format(service_account, 
                                   expiration, 
                                   encoded_signature)

The Error Message Received:

<Error>
    <Code>SignatureDoesNotMatch</Code>
    <Message>
        The request signature we calculated does not match the signature you provided. Check your Google secret key and signing method.
    </Message>
    <StringToSign>GET 1561832204 /<BUCKET>/<OBJECT></StringToSign>
</Error>

You can also consider using blob.generate_signed_url, here you have example code how to sign url — Pawel Czuczwara
how do you run that method with access token? do you have a working example? to be specific, how do you construct the client with access token? — Hamed
Using blob.generate_signed_url you do not need access token. To use access token and no API Key please check updated answer for example. — Pawel Czuczwara

Pawel Czuczwara Pawel Czuczwara · Accepted Answer · 2019-06-28T14:10:09

In case you do NOT want to use API secret key, follow procedure described in this sample that is using iamcredentials.signBlob() API signing URL 'remotely' for a service account with no need to distribute API secret key.

Signature string (that has to be signed) has this format:

signature_string = ('{verb}\n'
                    '{content_md5}\n'
                    '{content_type}\n'
                    '{expiration}\n'
                    '{resource}')

Sign google cloud storage blob using access token

Goal: Generate Signed-URL Using OAuth2.0 Access Token

The Code Used:

The Error Message Received:

1 Answers