fix(auth): allow self-signed JWT for non-GDU universe domain

[quartzmo]

No description provided.

[codyoss]

It is not clear to me this is the desired behavior. If a scope or auth is not present you can't really make a valid self-signed JWT. Instead of saying if nonGDU assume self-signed, maybe we should validate that it will be a self-signed JWT?

[quartzmo]

I found the original logic from the previous auth. This logic may also be flawed, but it looks to me that it only validates 1) non-GDU and 2) service account.

[codyoss]

yeah, to me that looks flawed too. I think we could make this change. But does it fix any bug? If it does fix a real use case I am fine with it, but it is not clear to me that it does.

[quartzmo]

I'll try to move this logic to a later stage at which 2) service account can be determined.

[codyoss]

Even if it is a service account, you need a scope or an aud for the JWT. Do you have a use-case to test this against?

[quartzmo]

Can theInternalOptions.DefaultScopes be used?

[codyoss]

Only if jwtscope is enabled. Iirc not all apis support scoped JWTs. Aud JWTs work for anything though I believe.

[quartzmo]

I'll see if I can get some info about how self-signed JWTs are intended to be used with universe domain.

[quartzmo]

My understanding is that non-GDU participating services must support self-signed JWTs, and my best guess is that the default scope(s) are good enough.

[quartzmo]

Manual testing in the PRPTST environment using SA JSON with private_key, this branch, and google.golang.org/api at HEAD to include googleapis/google-api-go-client#2773:

package main

import (
	"context"
	"log"

	"google.golang.org/api/compute/v1"
	"google.golang.org/api/option"
)

func main() {
	ctx := context.Background()

	tpcUniverse := "apis-tpczero.goog"

	computeService, err := compute.NewService(ctx, option.WithUniverseDomain(tpcUniverse), option.WithCredentialsFile("/Users/chrisdsmith/sa_keys/prptst.json"))
	if err != nil {
		log.Fatalf("[WARN] Error creating client compute: %s", err)

	}
	log.Printf("[INFO] Requesting instance creation")
	call, err := computeService.Instances.List("tpczero-system:bootstrap-libraries", "u-us-prp1-a").Do()
	if err != nil {
		log.Fatalf("[WARN] Error listing instances: %v", err)
	}
	log.Printf("[INFO] List instances operation: %d", len(call.Items))

}

➜  compute-apiary-ud-new-auth git:(main) ✗ go run main.go
2024/09/06 12:29:40 [INFO] Requesting instance creation
2024/09/06 12:29:41 [INFO] List instances operation: 3

[viacheslav-rostovtsev]

Left some questions

[viacheslav-rostovtsev]

this can now become
opts.UseSelfSignedJWT |= ud != "" && ud != internalauth.DefaultUniverseDomain