Skip to content

Commit bfc07e1

Browse files
authored
fix: detect correct auth when ADC env var is set but empty (#1374)
Treat empty strings as if the env var was not set. This fixes an issue where an environment variable for `GOOGLE_APPLICATION_CREDENTIALS` is set, but it empty. Because the default sentinel is `None`, the auth library attempts to load this file. Some systems can set or update an env var, but not unset an env var (e.g. Docker). Fixes: https://togithub.com/googleapis/python-pubsub/issues/983
1 parent 383c982 commit bfc07e1

File tree

1 file changed

+6
-6
lines changed

1 file changed

+6
-6
lines changed

google/auth/_default.py

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -330,31 +330,31 @@ def _get_explicit_environ_credentials(quota_project_id=None):
330330
from google.auth import _cloud_sdk
331331

332332
cloud_sdk_adc_path = _cloud_sdk.get_application_default_credentials_path()
333-
explicit_file = os.environ.get(environment_vars.CREDENTIALS)
333+
explicit_file = os.environ.get(environment_vars.CREDENTIALS, "")
334334

335335
_LOGGER.debug(
336-
"Checking %s for explicit credentials as part of auth process...", explicit_file
336+
"Checking '%s' for explicit credentials as part of auth process...",
337+
explicit_file,
337338
)
338339

339-
if explicit_file is not None and explicit_file == cloud_sdk_adc_path:
340+
if explicit_file != "" and explicit_file == cloud_sdk_adc_path:
340341
# Cloud sdk flow calls gcloud to fetch project id, so if the explicit
341342
# file path is cloud sdk credentials path, then we should fall back
342343
# to cloud sdk flow, otherwise project id cannot be obtained.
343344
_LOGGER.debug(
344-
"Explicit credentials path %s is the same as Cloud SDK credentials path, fall back to Cloud SDK credentials flow...",
345+
"Explicit credentials path '%s' is the same as Cloud SDK credentials path, fall back to Cloud SDK credentials flow...",
345346
explicit_file,
346347
)
347348
return _get_gcloud_sdk_credentials(quota_project_id=quota_project_id)
348349

349-
if explicit_file is not None:
350+
if explicit_file != "":
350351
with warnings.catch_warnings():
351352
warnings.simplefilter("ignore", DeprecationWarning)
352353
credentials, project_id = load_credentials_from_file(
353354
os.environ[environment_vars.CREDENTIALS],
354355
quota_project_id=quota_project_id,
355356
)
356357
credentials._cred_file_path = f"{explicit_file} file via the GOOGLE_APPLICATION_CREDENTIALS environment variable"
357-
358358
return credentials, project_id
359359

360360
else:

0 commit comments

Comments
 (0)