Skip to content

Commit 1c395cf

Browse files
thomasdesplacesthomasdesplaces
committed
first commit
1 parent 2556b93 commit 1c395cf

18 files changed

+441
-2
lines changed

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
target/
12
# Logs
23
logs
34
*.log

‎README.md‎

Lines changed: 41 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,41 @@
1-
# apigee_get_oauth_gcp_token
2-
This repository demonstrate how to get a GCP OAuth Token without APIgee extension
1+
# APIGEE - SECURE GCP BACKEND WITH OAUTH OR IAP
2+
3+
[![Apigee](https://upload.wikimedia.org/wikipedia/commons/a/aa/Apigee_logo.svg)](https://cloud.google.com/apigee)
4+
5+
This is a code to deploy sharedflows which are used when your backend is secured by GCP OAuth (via Service Account) or IAP (via Service Account).
6+
7+
## Prerequisite
8+
9+
- A GCP Project with, for example, an App Engine.
10+
- A service Account with good rights to call your App Engine and it's JSON Key.
11+
- An Apigee account with an organization (free or paid).
12+
- [Maven](https://github.com/apigee/apigee-deploy-maven-plugin) or [apigeetools](https://github.com/apigee/apigeetool-node) install on your computer to deploy the sharedflow.
13+
- Maven install on local computer.
14+
15+
### Installation
16+
17+
- Create a new encrypted Key Value Map on your Apigee Organisation which name is _gcp-service-account-credentials_.
18+
- In this KVM, add a new key/value pair with a key name _credentials_ and for value the JSON Key value.
19+
- Update cache files with good timeout in seconds for each environment :
20+
- [Dev](sharedflows/gcp-token-oauth/env/dev/caches.json)
21+
- [Test](sharedflows/gcp-token-oauth/env/test/caches.json)
22+
- [Prd](sharedflows/gcp-token-oauth/env/prd/caches.json)
23+
24+
## Deploy
25+
26+
This repository contain the maven configuration to deploy this sharedflow on 3 environments : dev, test or prd.
27+
28+
How to use it :
29+
```
30+
cd gcp-token-oauth
31+
mvn install -P=dev -Dusername=XXXX -Dpassword=YYYY -Dorganization=ZZZZ
32+
```
33+
34+
## Versions
35+
36+
**Last version :** 1.0
37+
38+
## Auteurs
39+
40+
* **Thomas** _alias_ [@tonyglandyl](https://github.com/tonyglandyl28)
41+

‎sharedflows/gcp-token-oauth/README.md‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# Sharedflow gcp-token
2+
3+
## Description
4+
5+
Ce sharedflow va permettre de demander un jeton OAuth à Google en fonction du service account qui lui ai passé en paramètre.
6+
[Documentation Google](https://developers.google.com/identity/protocols/oauth2/service-account)
7+
8+
## Pré-requis
9+
Lors de l'utilisation de ce sharedflow dans un proxy il faut d'abord prévoir :
10+
11+
- Un sevice account qui a les droit d'appeler une API sur GCP
12+
- Le JSON de ce service account
13+
- Créer une entrée dans le KVM chiffré *gcp-service-account-credentials* avec en clé le nom du projet et en valeur le contenu du JSON du service account
14+
- Créer dans le proxy une variable nommée *private.credentialsjson* dont la valeur est le contenu du JSON du service account
15+
16+
## Fonctionnement
17+
18+
Ce sharedflow exécute 4 policies d'affilées :
19+
- js.extract-credentials
20+
- gjwt.generate-JWT
21+
- sc.gcp-oauth
22+
- ev.extract-json
23+
24+
### js.extract-credentials
25+
26+
Cette policy permet d'extraire chaque paire clé/valeur de la variable *private.credentialsjson* (qui contient le contenu du JSON du service account).
27+
28+
### gjwt.generate-JWT
29+
30+
Cette policy utilise les informations récupérées pour générer un jeton JWT. Ce jeton est inscrit dans la variable *output_jwt*.
31+
32+
### sc.gcp-oauth
33+
34+
Cette policy demande à GCP la création d'un jeton OAuth à partir du jeton JWT généré précédemment. Ce jeton est inscrit dans la variable *callout-token*.
35+
36+
### ev.extract-json
37+
38+
Cette policy extrait le jeton OAuth renvoyé précédemment et crée une variable *google-credentials.access-token*.

‎sharedflows/gcp-token-oauth/env/dev/caches.json‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
[
2+
{
3+
"name": "gcp-token-oauth-cache",
4+
"description": "Cache For GCP OAuth SharedFlow",
5+
"expirySettings": {
6+
"timeoutInSec": {
7+
"value": "10"
8+
},
9+
"valuesNull": false
10+
}
11+
}
12+
]

‎sharedflows/gcp-token-oauth/env/prd/caches.json‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
[
2+
{
3+
"name": "gcp-token-oauth-cache",
4+
"description": "Cache For GCP OAuth SharedFlow",
5+
"expirySettings": {
6+
"timeoutInSec": {
7+
"value": "3500"
8+
},
9+
"valuesNull": false
10+
}
11+
}
12+
]

‎sharedflows/gcp-token-oauth/env/test/caches.json‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
[
2+
{
3+
"name": "gcp-token-oauth-cache",
4+
"description": "Cache For GCP OAuth SharedFlow",
5+
"expirySettings": {
6+
"timeoutInSec": {
7+
"value": "60"
8+
},
9+
"valuesNull": false
10+
}
11+
}
12+
]

‎sharedflows/gcp-token-oauth/pom.xml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
2+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
3+
<parent>
4+
<groupId>com.apigee.sharedflows</groupId>
5+
<artifactId>apigee-sharedflow-parent</artifactId>
6+
<version>1.0</version>
7+
<relativePath>../sharedflow-shared-pom.xml</relativePath>
8+
</parent>
9+
10+
<modelVersion>4.0.0</modelVersion>
11+
<groupId>com.apigee.sharedflows</groupId>
12+
<artifactId>apigee-sharedflow-gcp-token-oauth</artifactId>
13+
<name>gcp-token-oauth</name>
14+
<version>1.0</version>
15+
<packaging>pom</packaging>
16+
</project>

‎sharedflows/gcp-token-oauth/sharedflowbundle/gcp-token-oauth.xml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
2+
<SharedFlowBundle revision="1" name="gcp-token-oauth">
3+
<ConfigurationVersion majorVersion="4" minorVersion="0"/>
4+
<Description>Shared flow permettant de récupérer un token OAuth2 pour appeler un backend GCP</Description>
5+
<DisplayName>gcp-token-oauth</DisplayName>
6+
<Policies>
7+
<Policy>am.create-oauth-header</Policy>
8+
<Policy>ev.extract-json</Policy>
9+
<Policy>gjwt.generate-JWT</Policy>
10+
<Policy>js.extract-credentials</Policy>
11+
<Policy>kvm.gcp-service-account</Policy>
12+
<Policy>lc.gcp-token</Policy>
13+
<Policy>pc.gcp-token</Policy>
14+
<Policy>sc.gcp-oauth</Policy>
15+
</Policies>
16+
<Resources/>
17+
<Spec></Spec>
18+
<subType>SharedFlow</subType>
19+
<SharedFlows>
20+
<SharedFlow>default</SharedFlow>
21+
</SharedFlows>
22+
</SharedFlowBundle>

‎sharedflows/gcp-token-oauth/sharedflowbundle/policies/am.add-authorization.xml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
2+
<AssignMessage async="false" continueOnError="false" enabled="true" name="am.add-authorization">
3+
<DisplayName>am.add-authorization</DisplayName>
4+
<Add>
5+
<Headers>
6+
<Header name="Authorization">Bearer {google-credentials.access-token}</Header>
7+
</Headers>
8+
</Add>
9+
<IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
10+
</AssignMessage>

‎sharedflows/gcp-token-oauth/sharedflowbundle/policies/ev.extract-json.xml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
2+
<ExtractVariables async="false" continueOnError="false" enabled="true" name="ev.extract-json">
3+
<DisplayName>ev.extract-json</DisplayName>
4+
<JSONPayload>
5+
<Variable name="access-token">
6+
<JSONPath>$.access_token</JSONPath>
7+
</Variable>
8+
</JSONPayload>
9+
<Source clearPayload="false">callout-token</Source>
10+
<VariablePrefix>google-credentials</VariablePrefix>
11+
</ExtractVariables>

0 commit comments

Comments
 (0)