How to get a GCP identity-token programmatically with python

Question

What is the python programmatic alternative to the gcloud command line gcloud auth print-identity-token?

I am trying to invoke Google Cloud Function by http trigger (only for auth users) and i need to pass the identity token in the Authentication header. I have method which works great when i run the code on GCP app engine. However, i struggle to find a way to get this identity token when i run the program on my own machine (where i can create the token with gcloud command line gcloud auth print-identity-token)

I found how to create access-token according to this answer but i didn't managed to understand how can i create identity-token.

Thank you in advance!

score 5 · Accepted Answer · answered Feb 06 '21 at 20:05

Great topic! And it's a long long way, and months of tests and discussion with Google.

TL;DR: you can't generate an identity token with your user credential, you need to have a service account (or to impersonate a service) to generate an identity token.

If you have a service account key file, I can share a piece of code to generate an identity token, but generating and having a service account key file is globally a bad practice.

I released an article on this and 2 merge requests to implement an evolution in the Java Google auth library (I'm more Java developer that python developer even if I also contribute to python OSS project) here and here. You can read them if you want to understand what is missing and how works the gcloud command today.

On the latest merge request, I understood that something is coming from google, internally, but up to now, I didn't see anything...

score 0 · Answer 2 · answered Aug 24 '21 at 14:30

If you have a service account you can impersonate this is one way to get an ID token in Python from a local/dev machine.

import google.auth
from google.auth.transport.requests import AuthorizedSession


def impersonated_id_token():
    credentials, project = google.auth.default(scopes=['https://www.googleapis.com/auth/cloud-platform'])
    authed_session = AuthorizedSession(credentials)
    sa_to_impersonate = "<SA_NAME>@<GCP_PROJECT>.iam.gserviceaccount.com"
    request_body = {"audience": "<SOME_URL>"}
    response = authed_session.post( f'https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/{sa_to_impersonate}:generateIdToken',request_body)
    return response

if __name__ == "__main__":
    print(impersonated_id_token().json())

score 0 · Answer 3 · answered Jun 29 '23 at 15:06

You can run the shell command via subprocess.check_output from python and use the returned value as well.

This worked for me:

gcloud_itoken = subprocess.check_output(["gcloud","auth", "print-identity-token"])
gcloud_itoken_str = gcloud_itoken.decode().strip()
do_something(gcloud_itoken_str)

How to get a GCP identity-token programmatically with python

3 Answers3