是否在没有gcloud的情况下获取服务帐户身份验证令牌? [英] Get service account auth token without gcloud?
问题描述
是否可以在不使用gcloud的情况下获取Google Cloud服务帐户的授权承载令牌?
Is it possible to get an authorization bearer token for a Google Cloud service account without the use of gcloud?
也就是说，我想发出一个HTTP请求(大概是通过我的JSON密钥文件进行了签名)，该请求将为我提供
That is, I would like to make an HTTP request (presumably signed in some way by my JSON key file) that would provide me the equivalent of
gcloud auth application-default print-access-token
该请求将在我自己的服务器上进行，我可能不希望在其中安装gcloud，并且我无法访问可能提供此服务的任何内部服务器元数据(例如，Compute Engine的情况)
This request would be made on my own server, where I may not wish to install gcloud and where I do not have access to any internal server metadata that might provide this (e.g., as is the case with Compute Engine).
是否有一些提供此类信息的oauth端点?
Is there some oauth endpoint that provides something like this?
或者，有什么方法可以用gcloud生成长期令牌吗?
Alternately, is there some way to generate long-lived tokens with gcloud?
我是Google Cloud生态系统的新手，请原谅我的无知和术语...
I'm new to the Google Cloud ecosystem, so excuse my ignorance and terminology...
推荐答案
我认为这正是您想要的:
I think that this is exactly what you are looking for:
https://developers.google.com/identity/protocols/OAuth2#serviceaccount
老实说，我认为您尝试实现的目标是正确的，运行
Honestly I don't think that what you were trying to achieve was correct, running
gcloud auth application-default print-access-token
您获得的令牌并非旨在执行您想要的操作:
you get a token that is not intended to do what you were looking for:
当您开发通常使用服务帐户的代码，但需要在更易于提供用户凭据的本地开发环境中运行代码时，此命令很有用."
"This command is useful when you are developing code that would normally use a service account but need to run the code in a local development environment where it's easier to provide user credentials."
这应该在实施此解决方案方面为您提供更多指导: https://developers.google.com/identity/protocols/OAuth2ServiceAccount
This should guide you a bit more in the implementation of this solution: https://developers.google.com/identity/protocols/OAuth2ServiceAccount
这篇关于是否在没有gcloud的情况下获取服务帐户身份验证令牌?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
