如何获取用于调用 google api 的委托凭证对象？

Question

我正在尝试通过 API 获取 gsuite 警报。我已经根据他们的文档创建了一个服务帐户，并将该服务帐户分配给我的谷歌云功能。

我不想使用环境变量或上传凭据以及源代码，但我想利用函数使用的默认服务帐户。

from googleapiclient.discovery import build

def get_credentials():

    # if one knows credentials file location(when one uploads the json credentials file or specify them in environment variable) one can easily get the credentials by specify the path.
    # In case of google cloud functions atleast I couldn't find it the path as the GOOGLE_APPLICATION_CREDENTIALS is empty in python runtime

    # the below code work find if one uncomments the below line
    #credentials = ServiceAccountCredentials.from_json_keyfile_name(key_file_location)

    credentials = < how to get default credentials object for default service account?>

    delegated_credentials = credentials.create_delegated('admin@alertcenter1.bigr.name').create_scoped(SCOPES)
    return delegated_credentials

def get_alerts(api_name, api_version, key_file_location=None):

    delegated_credentials = get_credentials()
    alertcli = build(api_name, api_version, credentials=delegated_credentials)
    resp = alertcli.alerts().list(pageToken=None).execute()
    print(resp)

有什么方法可以创建默认凭据对象。我尝试过使用 from google.auth 导入凭据，但这不包含 create_deleated 函数，我也尝试过 ServiceAccountCredentials() 但这需要签名者。

Answer 1

以下是使用具有委派凭据的 Gmail API 的示例。服务帐户凭据需要启用“启用 G Suite 域范围委派”。

from google.oauth2 import service_account
from googleapiclient.discovery import build

credentials = service_account.Credentials.from_service_account_file(
                        credentials_file,
                        scopes=['https://www.googleapis.com/auth/gmail.send'])

impersonate = 'username@example.com'

credentials = credentials.with_subject(impersonate)

service = build('gmail', 'v1', credentials=credentials)