Skip to content

BuildIapRequest: Switch aud to client ID #699

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
matthewg wants to merge 1 commit into from
Closed

BuildIapRequest: Switch aud to client ID #699

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 5 additions & 13 deletions iap/src/main/java/com/example/iap/BuildIapRequest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,13 +50,6 @@ public class BuildIapRequest {

private BuildIapRequest() {}

private static String getBaseUrl(URL url) throws Exception {
String urlFilePath = url.getFile();
int pathDelim = urlFilePath.lastIndexOf('/');
String path = (pathDelim > 0) ? urlFilePath.substring(0, pathDelim) : "";
return (url.getProtocol() + "://" + url.getHost() + path).trim();
}

private static ServiceAccountCredentials getCredentials() throws Exception {
GoogleCredentials credentials =
GoogleCredentials.getApplicationDefault().createScoped(Collections.singleton(IAM_SCOPE));
Expand All @@ -67,7 +60,7 @@ private static ServiceAccountCredentials getCredentials() throws Exception {
return (ServiceAccountCredentials) credentials;
}

private static String getSignedJWToken(ServiceAccountCredentials credentials, String baseUrl)
private static String getSignedJWToken(ServiceAccountCredentials credentials, String iapClientId)
throws IOException {
Instant now = Instant.now(clock);
long expirationTime = now.getEpochSecond() + EXPIRATION_TIME_IN_SECONDS;
Expand All @@ -80,7 +73,7 @@ private static String getSignedJWToken(ServiceAccountCredentials credentials, St
.setSubject(credentials.getClientEmail())
.setIssuedAt(Date.from(now))
.setExpiration(Date.from(Instant.ofEpochSecond(expirationTime)))
.claim("target_audience", baseUrl)
.claim("target_audience", iapClientId)
.signWith(SignatureAlgorithm.RS256, credentials.getPrivateKey())
.compact();
}
Expand All @@ -105,16 +98,15 @@ private static String getGoogleIdToken(String jwt) throws Exception {
return idToken;
}

public static HttpRequest buildIAPRequest(HttpRequest request) throws Exception {
public static HttpRequest buildIAPRequest(HttpRequest request, String iapClientId) throws Exception {
// get service account credentials
ServiceAccountCredentials credentials = getCredentials();
// get the base url of the request URL
String baseUrl = getBaseUrl(request.getUrl().toURL());
String jwt = getSignedJWToken(credentials, baseUrl);
String jwt = getSignedJWToken(credentials, iapClientId);
if (jwt == null) {
throw new Exception(
"Unable to create a signed jwt token for : "
+ baseUrl
+ iapClientId
+ "with issuer : "
+ credentials.getClientEmail());
}
Expand Down