oauth2: cannot fetch token: 400 Bad Request about gcs-helper

[sqdk]

Works exactly as expected!

Many, many thanks @fsouza

[fsouza]

Hey @sqdk, thanks for opening this issue. I wonder if there's something going on with that credentials file. Is it for a service account? Does gsutil work with that file?

export GOOGLE_APPLICATION_CREDENTIALS=/credentials.json
gsutil cp gs://my-bucket-name/test_report/index.html /tmp

[sqdk]

@fsouza sorry for the dupe!

The credentials is a service account, yes. And great idea to test locally.

I just checked that the credential file works with gsutil:

$ gcloud auth activate-service-account --key-file credentials.json
Activated service account credentials for: [OMITTED]
$ gsutil ls                                                       
gs://my-bucket-name/
$ gsutil cp gs://my-bucket-name/test_report/index.html .
Copying gs://my-bucket-name/test_report/index.html...
/ [1 files][ 97.3 KiB/ 97.3 KiB]                                                
Operation completed over 1 objects/97.3 KiB.

This leads me to believe that SOMETHING is confusing the library as to what auth method to use. It seems to look for something it shouldn't.

Do you usually run this in a container or a VM?

[sqdk]

To clarify, I am basically running the image on dockerhub except for a couple of lines that injects the credentials file.

[fsouza]

Yeah I just realized we've never ran this with a SA (we run it locally with user accounts and in GCE/GKE with roles), but we assumed it would work.

Let me give it a shot then I'll get back to you. Sorry about that.

[sqdk]

Well, good to know I am not going crazy!

Thanks for helping me out. Really appreciated!

[fsouza]

@sqdk it looks it's an issue with using a custom http client + service accounts, it would end-up with an empty scope ¯_(ツ)_/¯ I just pushed a fix that worked for me, can you confirm it works for you too?

I'll also make a follow up change improving the logging in the proxy method.

[sqdk]

@fsouza It all makes sense then! Thanks for the quick reply!

I got my test setup ready so I'll check it out right now.

[fsouza]

@sqdk thanks for confirming!