Reference documentation and code samples for the Google Auth Library Client class GCECredentials.
GCECredentials supports authorization on Google Compute Engine.
It can be used to authorize requests using the AuthTokenMiddleware, but will only succeed if being run on GCE:
use Google\Auth\Credentials\GCECredentials; use Google\Auth\Middleware\AuthTokenMiddleware; use GuzzleHttp\Client; use GuzzleHttp\HandlerStack;
$gce = new GCECredentials(); $middleware = new AuthTokenMiddleware($gce); $stack = HandlerStack::create(); $stack->push($middleware);
$client = new Client([ 'handler' => $stack, 'base_uri' => ' https://www.googleapis.com/taskqueue/v1beta2/projects/ ', 'auth' => 'google_auth' ]);
$res = $client->get('myproject/taskqueues/myqueue');
Namespace
Google \ Auth \ CredentialsMethods
__construct
iam
scope
string|string[]
[optional] the scope of the access request, expressed either as an array or as a space-delimited string.
targetAudience
string
[optional] The audience for the ID token.
quotaProject
string
[optional] Specifies a project to bill for access charges associated with the request.
serviceAccountIdentity
string
[optional] Specify a service account identity name to use instead of "default".
universeDomain
string|null
[optional] Specify a universe domain to use instead of fetching one from the metadata server.
fetchAuthToken
Implements FetchAuthTokenInterface#fetchAuthToken.
Fetches the auth tokens from the GCE metadata host if it is available. If $httpHandler is not specified a the default HttpHandler is used.
httpHandler
callable|null
callback which delivers psr7 request
headers
array
[optional] Headers to be inserted into the token endpoint request present.
array
getCacheKey
Returns the Cache Key for the credential token.
The format for the cache key is: TokenURI
string
getLastReceivedToken
Returns an associative array with the token and expiration time.
array|null
getClientName
Get the client name from GCE metadata.
Subsequent calls will return a cached value.
httpHandler
callable|null
callback which delivers psr7 request
string
getProjectId
Fetch the default Project ID from compute engine.
Returns null if called outside GCE.
httpHandler
callable|null
Callback which delivers psr7 request
string|null
getUniverseDomain
Fetch the default universe domain from the metadata server.
httpHandler
callable|null
Callback which delivers psr7 request
string
getQuotaProject
Get the quota project used for this API request
string|null
setIsOnGce
Set whether or not we've already checked the GCE environment.
isOnGce
bool
void
static::getTokenUri
The full uri for accessing the default token.
serviceAccountIdentity
string
[optional] Specify a service account identity name to use instead of "default".
string
static::getClientNameUri
The full uri for accessing the default service account.
serviceAccountIdentity
string
[optional] Specify a service account identity name to use instead of "default".
string
static::onAppEngineFlexible
Determines if this an App Engine Flexible instance, by accessing the GAE_INSTANCE environment variable.
bool
static::onGce
Determines if this a GCE instance, by accessing the expected metadata host.
If $httpHandler is not specified a the default HttpHandler is used.
httpHandler
callable|null
callback which delivers psr7 request
bool
Constants
cacheKey
Value: 'GOOGLE_AUTH_PHP_GCE'
METADATA_IP
Value: '169.254.169.254'
The metadata IP address on appengine instances.
The IP is used instead of the domain 'metadata' to avoid slow responses when not on Compute Engine.
TOKEN_URI_PATH
Value: 'v1/instance/service-accounts/default/token'
The metadata path of the default token.
ID_TOKEN_URI_PATH
Value: 'v1/instance/service-accounts/default/identity'
The metadata path of the default id token.
CLIENT_ID_URI_PATH
Value: 'v1/instance/service-accounts/default/email'
The metadata path of the client ID.
PROJECT_ID_URI_PATH
Value: 'v1/project/project-id'
The metadata path of the project ID.
UNIVERSE_DOMAIN_URI_PATH
Value: 'v1/universe/universe-domain'
The metadata path of the project ID.
FLAVOR_HEADER
Value: 'Metadata-Flavor'
The header whose presence indicates GCE presence.
MAX_COMPUTE_PING_TRIES
Value: 3
Note: the explicit timeout
and tries
below is a workaround. The underlying
issue is that resolving an unknown host on some networks will take
20-30 seconds; making this timeout short fixes the issue, but
could lead to false negatives in the event that we are on GCE, but
the metadata resolution was particularly slow. The latter case is
"unlikely" since the expected 4-nines time is about 0.5 seconds.
This allows us to limit the total ping maximum timeout to 1.5 seconds for developer desktop scenarios.
COMPUTE_PING_CONNECTION_TIMEOUT_S
Value: 0.5
