NIFI-14163: Enhance GCP Credential to use delegate user #9635
+78
−0
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
pvillard31
requested changes
Jan 15, 2025
There was a problem hiding this comment.
Thanks @bobpaulin - left some code style related comments. Will give this a try!
...n/java/org/apache/nifi/processors/gcp/credentials/factory/CredentialPropertyDescriptors.java
Outdated
Show resolved
Hide resolved
...n/java/org/apache/nifi/processors/gcp/credentials/factory/CredentialPropertyDescriptors.java
Outdated
Show resolved
Hide resolved
...n/java/org/apache/nifi/processors/gcp/credentials/factory/CredentialPropertyDescriptors.java
Outdated
Show resolved
Hide resolved
...processors/gcp/credentials/factory/strategies/AbstractServiceAccountCredentialsStrategy.java
Show resolved
Hide resolved
|
Thank you for the review @pvillard31 ! Updates made. |
pvillard31
approved these changes
Jan 15, 2025
There was a problem hiding this comment.
Made some tests and it worked as expected. Assuming all checks are green, I'm a +1. Thanks for the improvement @bobpaulin
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
NIFI-14163
Tracking
Please complete the following tracking steps prior to pull request creation.
Issue Tracking
Pull Request Tracking
NIFI-00000NIFI-00000Pull Request Formatting
mainbranchVerification
Please indicate the verification steps performed prior to pull request creation.
To verify this change you must use a service account credential that has been configured to use domain-wide delegation with the scopes that your processors are expecting to use (per https://developers.google.com/identity/protocols/oauth2/service-account#delegatingauthority). Ex ListGoogleDrive specifically requires the https://www.googleapis.com/auth/drive.metadata.readonly scope.
To verify positve and negative cases:
Use a Google Drive that has the service account user added and configure the GCPCredentialControllerService to use a Service Account JSON.
Expected Result: Drive Files should appear
Remove the same Service Account email from the drive permissions.
Expected Result: Drive Files will not appear. (Service Account can't access them)
Configure GCPCredentialControllerService to use the delegation user of an email that currently has access to the drive.
Expected Result: Drive Files will appear.,
Build
mvn clean install -P contrib-checkLicensing
LICENSEandNOTICEfilesDocumentation