{"action":"created","issue":{"url":"https://api.github.com/repos/fog/fog-google/issues/38","labels_url":"https://api.github.com/repos/fog/fog-google/issues/38/labels{/name}","comments_url":"https://api.github.com/repos/fog/fog-google/issues/38/comments","events_url":"https://api.github.com/repos/fog/fog-google/issues/38/events","html_url":"https://github.com/fog/fog-google/issues/38","id":82992215,"number":38,"title":"Improve authentication mechanisms","user":{"login":"plribeiro3000","id":672952,"avatar_url":"https://avatars.githubusercontent.com/u/672952?v=3","gravatar_id":"","url":"https://api.github.com/users/plribeiro3000","html_url":"https://github.com/plribeiro3000","followers_url":"https://api.github.com/users/plribeiro3000/followers","following_url":"https://api.github.com/users/plribeiro3000/following{/other_user}","gists_url":"https://api.github.com/users/plribeiro3000/gists{/gist_id}","starred_url":"https://api.github.com/users/plribeiro3000/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/plribeiro3000/subscriptions","organizations_url":"https://api.github.com/users/plribeiro3000/orgs","repos_url":"https://api.github.com/users/plribeiro3000/repos","events_url":"https://api.github.com/users/plribeiro3000/events{/privacy}","received_events_url":"https://api.github.com/users/plribeiro3000/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-05-31T04:04:59Z","updated_at":"2015-05-31T04:07:07Z","closed_at":null,"body":"google/storage uses a legacy Amazon-compatible authentication system that still works, but has some limitations and requires some hackery to get working in a non-trivial case. It looks for the parameters :google_storage_access_key_id and :google_storage_secret_access_key\r\n\r\ngoogle/compute embraces the newer service account model, and accepts :google_project, google_client_email, :google_key_location, :google_key_string and :google_client\r\n\r\nInstances provisioned on Google Compute Engine can be authorized at launch time with service_account_scopes, which preauthorize the instance on various Google OAuth scopes, e.g.: https://www.googleapis.com/auth/devstorage.full_control -- once this is done, a GET query to the Google metadata server from that instance will return a valid token for the service for that instance scoped to its own project -- no other service accounts required.\r\n\r\nI would propose:\r\n\r\n1) expanding google/storage's vocabulary to accept the same service account parameters as google/compute\r\n\r\n2) expanding the vocabulary of google/compute to allow service_account_scopes to be set at instance launch time\r\n\r\n3) adding a parameter to both google/compute and google/storage to attempt using an OAuth token from the metadata service if fog is running on a preauthorized instance\r\n\r\nThis would allow a fog user to provision a Compute Engine node using fog and a provisioning service account, preauthorize that node to connect to Cloud Storage (and/or other Google OAuth scopes), and then have that node be able to run and interact with Cloud Storage, Datastore, etc. without needing to be issued its own unique service account.\r\n\r\nI can work on this and it doesn't look too terribly difficult, but I haven't contributed to fog before and this is really my first time looking at its internals. Before I waste too much effort, does this all sound worthwhile, and is there anyone actively maintaining the google stuff that I can coordinate with?"},"comment":{"url":"https://api.github.com/repos/fog/fog-google/issues/comments/107122905","html_url":"https://github.com/fog/fog-google/issues/38#issuecomment-107122905","issue_url":"https://api.github.com/repos/fog/fog-google/issues/38","id":107122905,"user":{"login":"plribeiro3000","id":672952,"avatar_url":"https://avatars.githubusercontent.com/u/672952?v=3","gravatar_id":"","url":"https://api.github.com/users/plribeiro3000","html_url":"https://github.com/plribeiro3000","followers_url":"https://api.github.com/users/plribeiro3000/followers","following_url":"https://api.github.com/users/plribeiro3000/following{/other_user}","gists_url":"https://api.github.com/users/plribeiro3000/gists{/gist_id}","starred_url":"https://api.github.com/users/plribeiro3000/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/plribeiro3000/subscriptions","organizations_url":"https://api.github.com/users/plribeiro3000/orgs","repos_url":"https://api.github.com/users/plribeiro3000/repos","events_url":"https://api.github.com/users/plribeiro3000/events{/privacy}","received_events_url":"https://api.github.com/users/plribeiro3000/received_events","type":"User","site_admin":false},"created_at":"2015-05-31T04:07:07Z","updated_at":"2015-05-31T04:07:07Z","body":"The original issue is at fog/fog#2945.\r\n\r\ncc/ @rfc2616 @geemus @icco @erjohnso "}}