Skip to content

Commit e4a5458

Browse files
ilyakharevilyakharev
committed
Added credentials authentication
1 parent 8c88ee3 commit e4a5458

14 files changed

+607
-89
lines changed

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
* added credentials authentication
12
* added access token authentication
23

34
## 1.5.0 (2023-02-22)

‎README.md‎

Lines changed: 152 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ First, create a database using [Yandex Cloud Console](https://cloud.yandex.com/d
2828

2929
YDB supports the following authentication methods:
3030

31+
- Access token
3132
- OAuth token
3233
- JWT + private key
3334
- JWT + JSON file
@@ -65,7 +66,33 @@ $config = [
6566

6667
$ydb = new Ydb($config);
6768
```
69+
or:
70+
```php
71+
<?php
72+
73+
use YdbPlatform\Ydb\Ydb;
74+
75+
$config = [
76+
77+
// Database path
78+
'database' => '/ru-central1/b1glxxxxxxxxxxxxxxxx/etn0xxxxxxxxxxxxxxxx',
79+
80+
// Database endpoint
81+
'endpoint' => 'ydb.serverless.yandexcloud.net:2135',
82+
83+
// Auto discovery (dedicated server only)
84+
'discovery' => false,
85+
86+
// IAM config
87+
'iam_config' => [
88+
'root_cert_file' => './CA.pem', // Root CA file (dedicated server only!)
89+
],
90+
91+
'credentials' => new AccessTokenAuthentication('AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA')
92+
];
6893

94+
$ydb = new Ydb($config);
95+
```
6996
## OAuth token
7097

7198
You should obtain [a new OAuth token](https://cloud.yandex.com/docs/iam/concepts/authorization/oauth-token).
@@ -101,6 +128,34 @@ $config = [
101128
$ydb = new Ydb($config);
102129
```
103130

131+
or
132+
```php
133+
<?php
134+
135+
use YdbPlatform\Ydb\Ydb;
136+
137+
$config = [
138+
139+
// Database path
140+
'database' => '/ru-central1/b1glxxxxxxxxxxxxxxxx/etn0xxxxxxxxxxxxxxxx',
141+
142+
// Database endpoint
143+
'endpoint' => 'ydb.serverless.yandexcloud.net:2135',
144+
145+
// Auto discovery (dedicated server only)
146+
'discovery' => false,
147+
148+
// IAM config
149+
'iam_config' => [
150+
'temp_dir' => './tmp', // Temp directory
151+
'root_cert_file' => './CA.pem', // Root CA file (dedicated server only!)
152+
],
153+
154+
'credentials' => new OAuthTokenAuthentication('AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA')
155+
];
156+
157+
$ydb = new Ydb($config);
158+
```
104159
## JWT + private key
105160

106161
Create [a service account](https://cloud.yandex.com/docs/iam/operations/sa/create) with the `editor` role, then create a private key. Also you need a key ID and a service account ID.
@@ -128,10 +183,35 @@ $config = [
128183
];
129184

130185
$ydb = new Ydb($config);
131-
132186
```
133187

188+
or
189+
```php
190+
<?php
191+
192+
use YdbPlatform\Ydb\Ydb;
193+
194+
$config = [
195+
'database' => '/ru-central1/b1glxxxxxxxxxxxxxxxx/etn0xxxxxxxxxxxxxxxx',
196+
'endpoint' => 'ydb.serverless.yandexcloud.net:2135',
197+
'discovery' => false,
198+
'iam_config' => [
199+
'temp_dir' => './tmp', // Temp directory
200+
'root_cert_file' => './CA.pem', // Root CA file (dedicated server only!)
201+
202+
// Private key authentication
203+
'key_id' => 'ajexxxxxxxxx',
204+
'service_account_id' => 'ajeyyyyyyyyy',
205+
'private_key_file' => './private.key',
206+
],
207+
208+
'credentials' => new JwtWithPrivateKeyAuthentication(
209+
"ajexxxxxxxxx","ajeyyyyyyyyy",'./private.key')
210+
211+
];
134212

213+
$ydb = new Ydb($config);
214+
```
135215
## JWT + JSON file
136216

137217
Create [a service account](https://cloud.yandex.com/docs/iam/operations/sa/create) with the `editor` role.
@@ -161,6 +241,26 @@ $config = [
161241
$ydb = new Ydb($config);
162242
```
163243

244+
or:
245+
```php
246+
<?php
247+
248+
use YdbPlatform\Ydb\Ydb;
249+
250+
$config = [
251+
'database' => '/ru-central1/b1glxxxxxxxxxxxxxxxx/etn0xxxxxxxxxxxxxxxx',
252+
'endpoint' => 'ydb.serverless.yandexcloud.net:2135',
253+
'discovery' => false,
254+
'iam_config' => [
255+
'temp_dir' => './tmp', // Temp directory
256+
'root_cert_file' => './CA.pem', // Root CA file (dedicated server only!)
257+
],
258+
259+
'credentials' => new JwtWithJsonAuthentication('./jwtjson.json')
260+
];
261+
262+
$ydb = new Ydb($config);
263+
```
164264
## Metadata URL
165265

166266
When you deploy a project to VM or function at Yandex.Cloud, you are able to connect to the database using [Metadata URL](https://cloud.yandex.com/docs/compute/operations/vm-connect/auth-inside-vm). Before you start, you should link your service account to an existing or new VM or function.
@@ -189,7 +289,31 @@ $config = [
189289
];
190290

191291
$ydb = new Ydb($config);
292+
```
192293

294+
```php
295+
<?php
296+
297+
use YdbPlatform\Ydb\Ydb;
298+
299+
$config = [
300+
301+
// Database path
302+
'database' => '/ru-central1/b1glxxxxxxxxxxxxxxxx/etn0xxxxxxxxxxxxxxxx',
303+
304+
// Database endpoint
305+
'endpoint' => 'ydb.serverless.yandexcloud.net:2135',
306+
307+
// Auto discovery (dedicated server only)
308+
'discovery' => false,
309+
310+
// IAM config
311+
'iam_config' => [
312+
'temp_dir' => './tmp', // Temp directory
313+
],
314+
];
315+
316+
$ydb = new Ydb($config);
193317
```
194318

195319
## Anonymous
@@ -218,7 +342,34 @@ $config = [
218342
];
219343

220344
$ydb = new Ydb($config);
345+
```
346+
347+
or:
348+
```php
349+
<?php
350+
351+
use YdbPlatform\Ydb\Ydb;
352+
353+
$config = [
221354

355+
// Database path
356+
'database' => '/local',
357+
358+
// Database endpoint
359+
'endpoint' => 'localhost:2136',
360+
361+
// Auto discovery (dedicated server only)
362+
'discovery' => false,
363+
364+
// IAM config
365+
'iam_config' => [
366+
'insecure' => true,
367+
],
368+
369+
'credentials' => new AnonymousAuthentication()
370+
];
371+
372+
$ydb = new Ydb($config);
222373
```
223374

224375
# Usage

‎src/Auth/Auth.php‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
<?php
2+
3+
namespace YdbPlatform\Ydb\Auth;
4+
5+
use DateTime;
6+
use YdbPlatform\Ydb\Iam;
7+
8+
abstract class Auth
9+
{
10+
public abstract function getTokenInfo(): TokenInfo;
11+
12+
public abstract function getName(): string;
13+
14+
protected $logger;
15+
16+
public function logger(){
17+
return $this->logger;
18+
}
19+
20+
public function setLogger($logger){
21+
$this->logger = $logger;
22+
}
23+
24+
/**
25+
* @param string $expiresAt
26+
* @return int
27+
*/
28+
protected function convertExpiresAt($expiresAt)
29+
{
30+
if (is_int($expiresAt)) {
31+
return $expiresAt;
32+
}
33+
34+
$time = time() + 60 * 60 * Iam::DEFAULT_TOKEN_EXPIRES_AT;
35+
if (preg_match('/^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})(?:\.\d+)?(.*)$/', $expiresAt, $matches)) {
36+
$time = new DateTime($matches[1] . $matches[2]);
37+
$time = (int)$time->format('U');
38+
}
39+
return $time;
40+
}
41+
}

‎src/Auth/IamAuth.php‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
<?php
2+
3+
namespace YdbPlatform\Ydb\Auth;
4+
5+
use YdbPlatform\Ydb\Exception;
6+
use YdbPlatform\Ydb\Iam;
7+
8+
abstract class IamAuth extends Auth
9+
{
10+
/**
11+
* @return mixed|null
12+
* @throws Exception
13+
*/
14+
public function requestToken($request_data): mixed
15+
{
16+
$this->logger()->info('YDB: Obtaining new IAM token...');
17+
18+
$curl = curl_init(Iam::IAM_TOKEN_API_URL);
19+
20+
curl_setopt_array($curl, [
21+
CURLOPT_RETURNTRANSFER => 1,
22+
CURLOPT_SSL_VERIFYPEER => 0,
23+
CURLOPT_SSL_VERIFYHOST => 0,
24+
CURLOPT_HEADER => 0,
25+
CURLOPT_POSTFIELDS => json_encode($request_data),
26+
CURLOPT_HTTPHEADER => [
27+
'Accept: application/json',
28+
'Content-Type: application/json',
29+
],
30+
]);
31+
32+
$result = curl_exec($curl);
33+
34+
$status = curl_getinfo($curl, CURLINFO_HTTP_CODE);
35+
36+
if ($status === 200) {
37+
$token = json_decode($result);
38+
39+
if (isset($token->iamToken)) {
40+
$this->logger()->info('YDB: Obtained new IAM token [...' . substr($token->iamToken, -6) . '].');
41+
return $token;
42+
} else {
43+
$this->logger()->error('YDB: Failed to obtain new IAM token', [
44+
'status' => $status,
45+
'result' => $token,
46+
]);
47+
throw new Exception('Failed to obtain new iamToken: no token was received.');
48+
}
49+
} else {
50+
$this->logger()->error('YDB: Failed to obtain new IAM token', [
51+
'status' => $status,
52+
'result' => $result,
53+
]);
54+
throw new Exception('Failed to obtain new iamToken: response status is ' . $status);
55+
}
56+
}
57+
}

‎src/Auth/Implement/AccessTokenAuthentication.php‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
<?php
2+
3+
namespace YdbPlatform\Ydb\Auth\Implement;
4+
5+
use YdbPlatform\Ydb\Auth\TokenInfo;
6+
7+
class AccessTokenAuthentication extends \YdbPlatform\Ydb\Auth\Auth
8+
{
9+
/**
10+
* @var string
11+
*/
12+
protected $access_token;
13+
14+
public function __construct(string $access_token)
15+
{
16+
$this->access_token = $access_token;
17+
}
18+
19+
public function getTokenInfo(): TokenInfo
20+
{
21+
return new TokenInfo($this->access_token, time()+24*60*60);
22+
}
23+
24+
public function getName(): string
25+
{
26+
return 'Access token';
27+
}
28+
}

‎src/Auth/Implement/AnonymousAuthentication.php‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
<?php
2+
3+
namespace YdbPlatform\Ydb\Auth\Implement;
4+
5+
use YdbPlatform\Ydb\Auth\TokenInfo;
6+
7+
class AnonymousAuthentication extends \YdbPlatform\Ydb\Auth\Auth
8+
{
9+
10+
public function __construct()
11+
{
12+
}
13+
14+
public function getTokenInfo(): TokenInfo
15+
{
16+
return new TokenInfo("", time()+24*3600);
17+
}
18+
19+
public function getName(): string
20+
{
21+
return 'Anonymous';
22+
}
23+
}

0 commit comments

Comments
 (0)