Package: dj-gcp-rest-auth
Provides a way to determine if an incoming request is coming from a GCP service account that
you have authorized.  You can also use this module to as a way of wrapping an identity token
which on its own has no access claims.  The wrapped token is an authenticated GCP token and
the inner token specifies the Django user.For instance, an authenticated user requests anidentity tokenusing the/identity/endpoint.
This token on its own can not be used to access services.  The user then gives this identity token
to an IoT device that can obtain its own GCP Token.  When the IoT device wants to make a request on behalf
of the authenticated user, it adds the X-GCP-IDTOKEN header.In another example, you may be using Google Functions from a pub/sub model to make a request to an API
endpoint on your Django server.  In this case your Google Function will have a default service
account and you can obtain an id-token within your Google Function.  An id-token is a JWT token
that contains various claims.  You will need to get an id-token that contains the email claim.
You can pass this token into your request using the Authorization header.  This module can then be
used to verify the token and make sure that the identity of the user belongs a list of
allowed service accounts that you configure.Free software: MIT licenseDocumentation:https://dj_gcp_rest_auth.readthedocs.io.InstallationInstalldj_gcp_rest_authfrom pip$ pip install dj_gcp_rest_authUpdate your top levelsettings.pyGCP_REST_AUTH = {
    'IDENTITY_TOKEN_LIFETIME_DAYS': 7,
    'ALLOWED_SERVICE_ACCOUNTS': ['11111122222-compute@developer.gserviceaccount.com']
}IDENTITY_TOKEN_LIFETIME_DAYSis optional and if specified specify the lifetime of an identity token in days.
Identity tokens can be generated from this package.ALLOWED_SERVICE_ACCOUNTSis a list of regex patterns representing the service account emails that
are allowed to use your API.In your views, setfrom dj_gcp_rest_auth.authentication import GCPTokenAuthentication

class MyView(GenericAPIView):
    authentication_classes = ( GCPTokenAuthentication, )Optionally, in your urls.py, setimport dj_gcp_rest_auth

path('', include(dj_gcp_rest_auth.urls))Optionally, you can use the IsGCPUser custom permission.  This permission is useful to indicate that the
GCP Token is valid and from an authorized service account.from dj_gcp_rest_auth.permissions import IsGCPUserObtaining an id-tokenThere are several ways to obtain anid-tokenfrom your Google service (Compute, GAE, Cloud Run, Function, etc.).The following method only depends oncurland makes use of the internal meta data to retrieve theid-tokencurl -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=arbitrary&format=full"AuthorizationOnce you obtain anid-token, your GCP service can authenticate with Django by passing yourid-tokenwith theAuthorizationheader as shown in the following requestcurl -H "X-GCP-IDTOKEN: <user-id-token>" -H "Authorization: Bearer <my-id-token>" http://localhost:8000/protected/resourceTheuser-id-tokenis obtained from the/identity/endpoint.EndpointsThis package can be used to expose an endpoint to generate an identity token for the authenticated userGET /identity