Class IAMCredentialsClient (2.28.0)

A service account is a special type of Google account that belongs to your application or a virtual machine (VM), instead of to an individual end user.

Your application assumes the identity of the service account to call Google APIs, so that the users aren't directly involved.

Service account credentials are used to temporarily assume the identity of the service account. Supported credential types include OAuth 2.0 access tokens, OpenID Connect ID tokens, self-signed JSON Web Tokens (JWTs), and more.

Equality

Instances of this class created via copy-construction or copy-assignment always compare equal. Instances created with equal std::shared_ptr<*Connection> objects compare equal. Objects that compare equal share the same underlying resources.

Performance

Creating a new instance of this class is a relatively expensive operation, new objects establish new connections to the service. In contrast, copy-construction, move-construction, and the corresponding assignment operations are relatively efficient as the copies share all underlying resources.

Thread Safety

Concurrent access to different instances of this class, even if they compare equal, is guaranteed to work. Two or more threads operating on the same instance of this class is not guaranteed to work. Since copy-construction and move-construction is a relatively efficient operation, consider using such a copy when using this class from multiple threads.

Constructors

IAMCredentialsClient(IAMCredentialsClient const &)

Copy and move support

Parameter
Name Description
IAMCredentialsClient const &

IAMCredentialsClient(IAMCredentialsClient &&)

Copy and move support

Parameter
Name Description
IAMCredentialsClient &&

IAMCredentialsClient(std::shared_ptr< IAMCredentialsConnection >, Options)

Parameters
Name Description
connection std::shared_ptr< IAMCredentialsConnection >
opts Options

Operators

operator=(IAMCredentialsClient const &)

Copy and move support

Parameter
Name Description
IAMCredentialsClient const &
Returns
Type Description
IAMCredentialsClient &

operator=(IAMCredentialsClient &&)

Copy and move support

Parameter
Name Description
IAMCredentialsClient &&
Returns
Type Description
IAMCredentialsClient &

Functions

GenerateAccessToken(std::string const &, std::vector< std::string > const &, std::vector< std::string > const &, google::protobuf::Duration const &, Options)

Generates an OAuth 2.0 access token for a service account.

Parameters
Name Description
name std::string const &

Required. The resource name of the service account for which the credentials are requested, in the following format: projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}. The - wildcard character is required; replacing it with a project ID is invalid.

delegates std::vector< std::string > const &

The sequence of service accounts in a delegation chain. Each service account must be granted the roles/iam.serviceAccountTokenCreator role on its next service account in the chain. The last service account in the chain must be granted the roles/iam.serviceAccountTokenCreator role on the service account that is specified in the name field of the request.
The delegates must have the following format: projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}. The - wildcard character is required; replacing it with a project ID is invalid.

scope std::vector< std::string > const &

Required. Code to identify the scopes to be included in the OAuth 2.0 access token. See https://developers.google.com/identity/protocols/googlescopes for more information. At least one value required.

lifetime google::protobuf::Duration const &

The desired lifetime duration of the access token in seconds. Must be set to a value less than or equal to 3600 (1 hour). If a value is not specified, the token's lifetime will be set to a default value of one hour.

opts Options

Optional. Override the class-level options, such as retry and backoff policies.

Returns
Type Description
StatusOr< google::iam::credentials::v1::GenerateAccessTokenResponse >

the result of the RPC. The response message type (google.iam.credentials.v1.GenerateAccessTokenResponse) is mapped to a C++ class using the Protobuf mapping rules. If the request fails, the StatusOr contains the error details.

GenerateAccessToken(google::iam::credentials::v1::GenerateAccessTokenRequest const &, Options)

Generates an OAuth 2.0 access token for a service account.

Parameters
Name Description
request google::iam::credentials::v1::GenerateAccessTokenRequest const &

Unary RPCs, such as the one wrapped by this function, receive a single request proto message which includes all the inputs for the RPC. In this case, the proto message is a google.iam.credentials.v1.GenerateAccessTokenRequest. Proto messages are converted to C++ classes by Protobuf, using the Protobuf mapping rules.

opts Options

Optional. Override the class-level options, such as retry and backoff policies.

Returns
Type Description
StatusOr< google::iam::credentials::v1::GenerateAccessTokenResponse >

the result of the RPC. The response message type (google.iam.credentials.v1.GenerateAccessTokenResponse) is mapped to a C++ class using the Protobuf mapping rules. If the request fails, the StatusOr contains the error details.

GenerateIdToken(std::string const &, std::vector< std::string > const &, std::string const &, bool, Options)

Generates an OpenID Connect ID token for a service account.

Parameters
Name Description
name std::string const &

Required. The resource name of the service account for which the credentials are requested, in the following format: projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}. The - wildcard character is required; replacing it with a project ID is invalid.

delegates std::vector< std::string > const &

The sequence of service accounts in a delegation chain. Each service account must be granted the roles/iam.serviceAccountTokenCreator role on its next service account in the chain. The last service account in the chain must be granted the roles/iam.serviceAccountTokenCreator role on the service account that is specified in the name field of the request.
The delegates must have the following format: projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}. The - wildcard character is required; replacing it with a project ID is invalid.

audience std::string const &

Required. The audience for the token, such as the API or account that this token grants access to.

include_email bool

Include the service account email in the token. If set to true, the token will contain email and email_verified claims.

opts Options

Optional. Override the class-level options, such as retry and backoff policies.

Returns
Type Description
StatusOr< google::iam::credentials::v1::GenerateIdTokenResponse >

the result of the RPC. The response message type (google.iam.credentials.v1.GenerateIdTokenResponse) is mapped to a C++ class using the Protobuf mapping rules. If the request fails, the StatusOr contains the error details.

GenerateIdToken(google::iam::credentials::v1::GenerateIdTokenRequest const &, Options)

Generates an OpenID Connect ID token for a service account.

Parameters
Name Description
request google::iam::credentials::v1::GenerateIdTokenRequest const &

Unary RPCs, such as the one wrapped by this function, receive a single request proto message which includes all the inputs for the RPC. In this case, the proto message is a google.iam.credentials.v1.GenerateIdTokenRequest. Proto messages are converted to C++ classes by Protobuf, using the Protobuf mapping rules.

opts Options

Optional. Override the class-level options, such as retry and backoff policies.

Returns
Type Description
StatusOr< google::iam::credentials::v1::GenerateIdTokenResponse >

the result of the RPC. The response message type (google.iam.credentials.v1.GenerateIdTokenResponse) is mapped to a C++ class using the Protobuf mapping rules. If the request fails, the StatusOr contains the error details.

SignBlob(std::string const &, std::vector< std::string > const &, std::string const &, Options)

Signs a blob using a service account's system-managed private key.

Parameters
Name Description
name std::string const &

Required. The resource name of the service account for which the credentials are requested, in the following format: projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}. The - wildcard character is required; replacing it with a project ID is invalid.

delegates std::vector< std::string > const &

The sequence of service accounts in a delegation chain. Each service account must be granted the roles/iam.serviceAccountTokenCreator role on its next service account in the chain. The last service account in the chain must be granted the roles/iam.serviceAccountTokenCreator role on the service account that is specified in the name field of the request.
The delegates must have the following format: projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}. The - wildcard character is required; replacing it with a project ID is invalid.

payload std::string const &

Required. The bytes to sign.

opts Options

Optional. Override the class-level options, such as retry and backoff policies.

Returns
Type Description
StatusOr< google::iam::credentials::v1::SignBlobResponse >

the result of the RPC. The response message type (google.iam.credentials.v1.SignBlobResponse) is mapped to a C++ class using the Protobuf mapping rules. If the request fails, the StatusOr contains the error details.

SignBlob(google::iam::credentials::v1::SignBlobRequest const &, Options)

Signs a blob using a service account's system-managed private key.

Parameters
Name Description
request google::iam::credentials::v1::SignBlobRequest const &

Unary RPCs, such as the one wrapped by this function, receive a single request proto message which includes all the inputs for the RPC. In this case, the proto message is a google.iam.credentials.v1.SignBlobRequest. Proto messages are converted to C++ classes by Protobuf, using the Protobuf mapping rules.

opts Options

Optional. Override the class-level options, such as retry and backoff policies.

Returns
Type Description
StatusOr< google::iam::credentials::v1::SignBlobResponse >

the result of the RPC. The response message type (google.iam.credentials.v1.SignBlobResponse) is mapped to a C++ class using the Protobuf mapping rules. If the request fails, the StatusOr contains the error details.

SignJwt(std::string const &, std::vector< std::string > const &, std::string const &, Options)

Signs a JWT using a service account's system-managed private key.

Parameters
Name Description
name std::string const &

Required. The resource name of the service account for which the credentials are requested, in the following format: projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}. The - wildcard character is required; replacing it with a project ID is invalid.

delegates std::vector< std::string > const &

The sequence of service accounts in a delegation chain. Each service account must be granted the roles/iam.serviceAccountTokenCreator role on its next service account in the chain. The last service account in the chain must be granted the roles/iam.serviceAccountTokenCreator role on the service account that is specified in the name field of the request.
The delegates must have the following format: projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}. The - wildcard character is required; replacing it with a project ID is invalid.

payload std::string const &

Required. The JWT payload to sign: a JSON object that contains a JWT Claims Set.

opts Options

Optional. Override the class-level options, such as retry and backoff policies.

Returns
Type Description
StatusOr< google::iam::credentials::v1::SignJwtResponse >

the result of the RPC. The response message type (google.iam.credentials.v1.SignJwtResponse) is mapped to a C++ class using the Protobuf mapping rules. If the request fails, the StatusOr contains the error details.

SignJwt(google::iam::credentials::v1::SignJwtRequest const &, Options)

Signs a JWT using a service account's system-managed private key.

Parameters
Name Description
request google::iam::credentials::v1::SignJwtRequest const &

Unary RPCs, such as the one wrapped by this function, receive a single request proto message which includes all the inputs for the RPC. In this case, the proto message is a google.iam.credentials.v1.SignJwtRequest. Proto messages are converted to C++ classes by Protobuf, using the Protobuf mapping rules.

opts Options

Optional. Override the class-level options, such as retry and backoff policies.

Returns
Type Description
StatusOr< google::iam::credentials::v1::SignJwtResponse >

the result of the RPC. The response message type (google.iam.credentials.v1.SignJwtResponse) is mapped to a C++ class using the Protobuf mapping rules. If the request fails, the StatusOr contains the error details.