自更新以来，Appengine remote_api_shell不能与应用程序默认凭据一起使用 [英] Appengine remote_api_shell not working with application-default credentials since update

问题描述

我最近将我的gcloud库从118.0.0更新到了132.0.0，并且立即remote_api_shell不再有效。我经历了许多重新登录的排列，通过gcloud设置应用程序默认凭据，并使用服务帐户和环境变量。所有排列均失败，并显示相同的错误消息：

pre code Traceback最近一次调用最后一次
文件/ Users / mbostwick / google-cloud-sdk / bin / remote_api_shell.py，第133行，位于< module>
在run_file $ b $ execfile（_PATHS.script_file （script_name），globals_）
文件/Users/mbostwick/google-cloud-sdk/platform/google_appengine/google/appengine/tools/remote_api_shell.py，第160行，位于< module>
main（sys.argv）
在主$ b $中的文件/Users/mbostwick/google-cloud-sdk/platform/google_appengine/google/appengine/tools/remote_api_shell.py，行156 b oauth2 = True）
文件/Users/mbostwick/google-cloud-sdk/platform/google_appengine/google/appengine/tools/remote_api_shell.py，第74行，位于remote_api_shell
secure = secure， app_id = appid）
在ConfigureRemoteApiForOAuth
中的文件/Users/mbostwick/google-cloud-sdk/platform/google_appengine/google/appengine/ext/remote_api/remote_api_stub.py，第769行rpc_server_factory = rpc_server_factory ）
在ConfigureRemoteApi
中的第839行文件/Users/mbostwick/google-cloud-sdk/platform/google_appengine/google/appengine/ext/remote_api/remote_api_stub.pyapp_id = GetRemoteAppIdFromServer（服务器， path，rtok）
在GetRemoteAppIdFromServer
response = server中的文件/Users/mbostwick/google-cloud-sdk/platform/google_appengine/google/appengine/ext/remote_api/remote_api_stub.py，第569行。发送（PA th，payload = None，** urlargs）
在发送$ b $文件/Users/mbostwick/google-cloud-sdk/platform/google_appengine/google/appengine/tools/appengine_rpc_httplib2.py，第259行b NeedAuth（）
文件/Users/mbostwick/google-cloud-sdk/platform/google_appengine/google/appengine/tools/appengine_rpc_httplib2.py，第235行，位于NeedAuth
RaiseHttpError（url，response_info ）
在RaiseHttpError $ b中的文件/Users/mbostwick/google-cloud-sdk/platform/google_appengine/google/appengine/tools/appengine_rpc_httplib2.py，第85行$ b raise urllib2.HTTPError（url，response_info.status，msg，response_info，stream）
urllib2.HTTPError：HTTP错误401：未经授权尝试过多尝试。

在回到131.0.0和130.0.0之后，我回到了118.0.0，重新登录并且一切正常。

在更新gcloud后，我没有更新正在运行的应用程序，因为我目前正处于发布周期中，所以这可能是问题，但任何帮助，将不胜感激。感谢！

解决方案

TL; DR ：这已在gcloud版本134中修复b
$ b

原始答案：运行

  gcloud auth application-default login --scopes = https：//www.googleapis.com/auth/cloud-platform,https：//www.googleapis.com/auth/userinfo.email 
  

现在您的远程shell应该能够再次运行。

详情：
我认为这被128.0.0更新所破坏，同时还有对 gcloud auth login 命令的更改。旧的令牌具有以下范围（根据Google的tokeninfo端点）：

  https://www.googleapis.com/auth /userinfo.email https://www.googleapis.com/auth/cloud-platform https://www.googleapis.com/auth/appengine.admin https://www.googleapis.com/auth/compute https：/ /www.googleapis.com/auth/plus.me 
  

来自 gcloud auth application-default login 没有任何选项只有：

  https：// www。 googleapis.com/auth/cloud-platform 
  

记录在 gcloud auth应用程序默认登录--help

版本134详细信息：请求的范围现在是：

  https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/cloud-platform 
  

请参阅 https://groups.google.com/d/msg/google-appengine/ptc-76K6Kk4/9qr4601BBgAJ

I recently updated my gcloud libraries from 118.0.0 to 132.0.0 and immediately remote_api_shell no longer worked. I went through a number of permutations of re-logging in, to set the application-default credentials through gcloud, and to use a service account and environment variable. All permutations failed with the same error message:

    Traceback (most recent call last):
  File "/Users/mbostwick/google-cloud-sdk/bin/remote_api_shell.py", line 133, in <module>
    run_file(__file__, globals())
  File "/Users/mbostwick/google-cloud-sdk/bin/remote_api_shell.py", line 129, in run_file
    execfile(_PATHS.script_file(script_name), globals_)
  File "/Users/mbostwick/google-cloud-sdk/platform/google_appengine/google/appengine/tools/remote_api_shell.py", line 160, in <module>
    main(sys.argv)
  File "/Users/mbostwick/google-cloud-sdk/platform/google_appengine/google/appengine/tools/remote_api_shell.py", line 156, in main
    oauth2=True)
  File "/Users/mbostwick/google-cloud-sdk/platform/google_appengine/google/appengine/tools/remote_api_shell.py", line 74, in remote_api_shell
    secure=secure, app_id=appid)
  File "/Users/mbostwick/google-cloud-sdk/platform/google_appengine/google/appengine/ext/remote_api/remote_api_stub.py", line 769, in ConfigureRemoteApiForOAuth
    rpc_server_factory=rpc_server_factory)
  File "/Users/mbostwick/google-cloud-sdk/platform/google_appengine/google/appengine/ext/remote_api/remote_api_stub.py", line 839, in ConfigureRemoteApi
    app_id = GetRemoteAppIdFromServer(server, path, rtok)
  File "/Users/mbostwick/google-cloud-sdk/platform/google_appengine/google/appengine/ext/remote_api/remote_api_stub.py", line 569, in GetRemoteAppIdFromServer
    response = server.Send(path, payload=None, **urlargs)
  File "/Users/mbostwick/google-cloud-sdk/platform/google_appengine/google/appengine/tools/appengine_rpc_httplib2.py", line 259, in Send
    NeedAuth()
  File "/Users/mbostwick/google-cloud-sdk/platform/google_appengine/google/appengine/tools/appengine_rpc_httplib2.py", line 235, in NeedAuth
    RaiseHttpError(url, response_info, response, 'Too many auth attempts.')
  File "/Users/mbostwick/google-cloud-sdk/platform/google_appengine/google/appengine/tools/appengine_rpc_httplib2.py", line 85, in RaiseHttpError
    raise urllib2.HTTPError(url, response_info.status, msg, response_info, stream)
urllib2.HTTPError: HTTP Error 401: Unauthorized Too many auth attempts.

After back revving through 131.0.0 and 130.0.0, I just went back to 118.0.0, re-logged in and everything worked fine.

I did not update the running application after updating gcloud, as I'm in the middle of a release cycle at the moment, so that may have been the issue, but any help would be appreciated. Thanks!

解决方案

TL;DR: This was fixed in gcloud version 134

Original answer: Run

gcloud auth application-default login --scopes=https://www.googleapis.com/auth/cloud-platform,https://www.googleapis.com/auth/userinfo.email

Now your remote shell should work again.

Details: I think this was broken by the 128.0.0 update, along with the changes to the gcloud auth login command. The old tokens have the following scopes (according to Google's tokeninfo endpoint):

https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/cloud-platform https://www.googleapis.com/auth/appengine.admin https://www.googleapis.com/auth/compute https://www.googleapis.com/auth/plus.me

The new tokens from gcloud auth application-default login without any options only have:

https://www.googleapis.com/auth/cloud-platform

This is documented in gcloud auth application-default login --help

Version 134 details: The scopes requested are now:

https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/cloud-platform

See discussion at https://groups.google.com/d/msg/google-appengine/ptc-76K6Kk4/9qr4601BBgAJ

这篇关于自更新以来，Appengine remote_api_shell不能与应用程序默认凭据一起使用的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！