Include Multi Scope Tests When Generating Service Account Credentials

[djaquels]

For Service Account credentials generation test

There is the following var for testing oauth scopes:

ScopedEnvironment adc_env_var(GoogleAdcEnvVar(), filename.c_str());
auto creds = CreateServiceAccountCredentialsFromDefaultPaths(
{{"https://www.googleapis.com/auth/devstorage.full_control"}},
"user@foo.bar");

But there is no doc neither examples on how to use the scopes param when using multiple scopes.

For example, the following doesn't work, it crashes the program.

auto creds = CreateServiceAccountCredentialsFromDefaultPaths(
{{"https://www.googleapis.com/auth/devstorage.full_control","https://www.googleapis.com/auth/cloud-platform"}},
"user@foo.bar");
But the following snippet does work, it generates the credentials and can be used for authentication, in other words using a single string line with the scopes separated by a space, in contrast to an array of string as intuitively may be thought.

auto creds = CreateServiceAccountCredentialsFromDefaultPaths(
{{"https://www.googleapis.com/auth/devstorage.full_control https://www.googleapis.com/auth/cloud-platform"}},
"user@foo.bar");

[coryan]

This looks like a bug to me, the AIP for service account credentials says scopes should be separated by spaces:

https://google.aip.dev/auth/4117

Thanks for letting us know. I will send a PR to fix the problem. I would like to understand what you mean by "it crashes the program". I would expect that it creates credentials that are unusable, but no crashes.

[coryan]

Filed #8974 and fixed in #8975

[djaquels]

It' throws an Exception at line: https://github.com/googleapis/google-cloud-cpp/blob/v1.39.1/google/cloud/storage/oauth2/service_account_credentials.cc#L258

And got the following message:
terminate called after throwing an instance of 'google:☁️:v1_40_1::RuntimeStatusError'
what(): UNKNOWN: Could not create service account credentials using ApplicationDefault Credentials paths. For more information, please see https://developers.google.com/identity/protocols/application-default-credentials

Thank you very much for the documentation link, since the type for scope param is std::setstd::string it leads to think about using an array of strings.

[coryan]

Okay, seems like the client library was sending an invalid assertion and the request failed. That should be fixed by #8975.

Thank you very much for the documentation link, since the type for scope param is std::set<std::string> it leads to think about using an array of strings.

The intent was (and is) that you can use an array of strings, the code had a bug that prevented you from using with more than one entry. The bug is now fixed.