0

I am trying to set up the development environment for a project that uses an API hosted in GCP. We are using the Google Auth Library: Node.js Client, and it tries to pull an ID token automatically, and fails. This is the error:

Error: Cannot fetch ID token in this environment, use GCE or set the GOOGLE_APPLICATION_CREDENTIALS environment variable to a service account credentials JSON file.

So, I've solved this by manually downloading a service account key and pointing the GOOGLE_APPLICATION_CREDENTIALS environment variable to it. However, when more developers start to work on this project, it would be great to have a somewhat more automatic or streamlined solution.

I've been reading around, and was hoping that setting the GOOGLE_APPLICATION_CREDENTIALS to the key file generated by gcloud auth application-default login would do the trick. But, it seems like the library doesn't work with user credentials? At least it doesn't work when I try it.

Having a way where the developer setting up the project in development would either simply authenticate with Google in the terminal, or point the GOOGLE_APPLICATION_CREDENTIALS to a file generated by a gcloud command would be great, instead of having the person go into GCP to download a service account key.

Is this possible somehow? It's been a little tricky to find out. Thanks!

Some other questions I've seen:

Linda Lawton - DaImTo
  • 106,405
  • 32
  • 180
  • 449
ptf
  • 485
  • 5
  • 14
  • If you required an OIDC Identity Token, then you cannot use ADC with a user account. You must use a service account OR use a user account and impersonate a service account, which does not require the JSON file. https://www.jhanley.com/google-cloud-improving-security-with-impersonation/ – John Hanley Aug 22 '22 at 09:19
  • @JohnHanley It is the google auth library that fetches the ID token itself, and that is where the error occurs. I'll try the approach in the article you linked. – ptf Aug 22 '22 at 11:07
  • The ID Token would allow the impersonation of the user. Google does not provide that ability via the CLI by design. You can of course write your own code to request an Identity Token at the time of the OAuth authorization flow - which the user must approve. – John Hanley Aug 22 '22 at 19:06

0 Answers0