Document how to use Service Accounts with dev_appserver

[dhermes]

It can be done via

$ dev_appserver.py \
> --appidentity_email_address ${EMAIL_ADDRESS} \
> --appidentity_private_key_path ${PATH_TO_KEY} \
> ${APPLICATION_DIR}

This will make implicit credentials "just work" on the dev appserver for GAE.

[dhermes]

From dev_appserver.py --help

Application Identity:
  --appidentity_email_address APPIDENTITY_EMAIL_ADDRESS
                        email address associated with a service account that
                        has a downloadable key. May be None for no local
                        application identity. (default: None)
  --appidentity_private_key_path APPIDENTITY_PRIVATE_KEY_PATH
                        path to private key file associated with service
                        account (.pem format). Must be set if
                        appidentity_email_address is set. (default: None)

ISTM that .pem is not necessary, but if it is, that is quite alright

[dhermes]

Played around a bit with this and the dev_appserver support is pretty bad. It doesn't support JSON keyfiles or P12 keyfiles, so a user has manually take one of them and extract the PEM contents of the key. Even still, after doing that, it only supports PEM PKCS#1 keys (BEGIN RSA PRIVATE KEY) while the keys in JSON keyfiles are PKCS#8 (BEGIN PRIVATE KEY).

[dhermes]

OK I was able to get it working with a JSON keyfile (H/T S/O), but I don't know if it's worth documenting since it is so broken difficult to use:

$ python
>>> import os
>>> JSON_CREDS = os.getenv('GOOGLE_APPLICATION_CREDENTIALS')
>>> JSON_CREDS
'/path/to/keyfile.json'
>>> import json
>>> with open(JSON_CREDS, 'rb') as fh:
...     key_json = json.load(fh)
...
>>> pkcs8_pem = key_json['private_key']
>>> key_json['client_email']
'foo@proj.gserviceaccount.com'
>>> name, ext = os.path.splitext(JSON_CREDS)
>>> PEM_FILE = name + '-PKCS8.pem'
>>> with open(PEM_FILE, 'wb') as fh:
...     fh.write(pkcs8_pem)
...
>>>
$ # Then convert to PKCS1
$ openssl rsa -in /path/to/keyfile-PKCS8.pem -out /path/to/keyfile-PKCS1.pem

and after doing this, the PKCS#1 PEM-file can be used:

$ dev_appserver.py \
> --appidentity_email_address=foo@proj.gserviceaccount.com \
> --appidentity_private_key_path=/path/to/keyfile-PKCS1.pem \
> ${APPLICATION_DIR}

[dhermes]

@jgeewax Do you think this is worth adding to our auth doc or should I just give up on it and close out this issue?

[voscausa]

Yes, because you do not have to store the key in your project. You can also use this setup to create signed urls to access Google Cloud storage in the development server using app_identity.sign blob() and the app default service account, without modifying your application. This default service account cannot be used as an ouath2client service account, because it does not have a client_id.

[dhermes]

@jgeewax Can you weigh in here?

[dhermes]

@jgeewax Bump