How to obtain identity token of a service account associated with a project programmatically?

[Renee]

Hi,

I need to authenticate cloud functions using a service account. I have to pass the token of the service account for authenticating the cloud functions. I have been searching for solutions to the problem. I came across this command:

gcloud auth print-identity-token projectId@appspot.gserviceaccount.com 

The command gives a generic token which authenticates all my cloud functions. I want to try to do this programmatically.  I tried the code in the link mentioned below. 

https://cloud.google.com/functions/docs/securing/authenticating#functions-bearer-token-example-nodej...

It uses the cloud function as the target audience. It would mean, one token for one cloud function but I want to use a generic token for authenticating all cloud functions.  Is there a way to do it?

Any solution or reference would be appreciated!

[Marramirez]

Hello @Renee,

Welcome to the Google Cloud Community!

There is no documented way of using a generic token for authenticating all cloud functions.

Part of an ID token's content is the aud claim. This is the audience of the token. The value of this claim must match the application or service that uses the token to authenticate the request. If a service receives an ID token, it verifies its integrity, validity, and the aud claim it expects. If it does not match, the service rejects the token, because it could be a replay intended for another system.

Additionally, ID tokens are valid for up to 1 hour. When an ID token expires, you must acquire a new one. That is why Generating Tokens Programmatically only uses a single token per cloud function.

You can also contact Google Cloud Support to further look into your case. Let me know if it helped, thanks!

[Renee]

Hi @Marramirez  

Thank you for your reply. I will try it that way it is given then. Thank you!