From cc2f78a426efdede7d734081164b16cc494b5769 Mon Sep 17 00:00:00 2001 From: Bruno Rodrigues Date: Wed, 20 Jan 2021 23:01:42 +0000 Subject: [PATCH] Add required scope to GCP SignJwt credentials. Resolves gh-617. Original pull request: gh-618. --- .../vault/authentication/GcpIamAuthentication.java | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/spring-vault-core/src/main/java/org/springframework/vault/authentication/GcpIamAuthentication.java b/spring-vault-core/src/main/java/org/springframework/vault/authentication/GcpIamAuthentication.java index 5ed934c6..34f5b98a 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/authentication/GcpIamAuthentication.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/authentication/GcpIamAuthentication.java @@ -17,6 +17,7 @@ package org.springframework.vault.authentication; import java.io.IOException; import java.time.Instant; +import java.util.Collections; import java.util.LinkedHashMap; import java.util.Map; @@ -67,6 +68,8 @@ public class GcpIamAuthentication extends GcpJwtAuthenticationSupport implements private static final JsonFactory JSON_FACTORY = new JacksonFactory(); + private static final String SCOPE = "https://www.googleapis.com/auth/iam"; + private final GcpIamAuthenticationOptions options; private final HttpTransport httpTransport; @@ -103,7 +106,7 @@ public class GcpIamAuthentication extends GcpJwtAuthenticationSupport implements this.options = options; this.httpTransport = httpTransport; - this.credential = options.getCredentialSupplier().get(); + this.credential = options.getCredentialSupplier().get().createScoped(Collections.singletonList(SCOPE)); } @Override