Package: gcp-process-credentials
Process Credentials for GCP Client Library - pythonGoogle Cloud Credential provider which allows sourcing credentials from an external process.Essentially, its a credential source which allows the delegation of acquiring GCPaccess_tokensto arbitrary binaries you have access to at runtime.The arbitrary binary would use whatever means it has available (kerberos, ldap, saml-cli, etc) to get a GCPaccess_token.From there, the token is given surfaced as a refreshable credential source you can directly use with a GCP library.This is similar to several systems that provide such delegation.Kubernetes kubectlcredential pluginAWS Process CredentialsNeedless to say, use this after very careful consideration:  this library will attempt to execute a binary on the system where its run (ofcource the process running using the library would need access to run the binary anyway)NOTEthese samples are NOT supported by google; its just something done on a weekend...ImplementationsAs its a weekend project, caveat emptor.  The code is alpha quality and I didn't have time to push it to maven central, npm, etc.If you want it there, please review the code, provide suggestions and improvementsgolang:https://github.com/salrashid123/gcp_process_credentials_gopython:https://github.com/salrashid123/gcp_process_credentials_pyjava:https://github.com/salrashid123/gcp_process_credentials_javanode:https://github.com/salrashid123/gcp_process_credentials_nodeSee the "examples" folder in eachBinary Response ContractEach library above will invoke a binary, pass it some args and env var.The response back from the binary mustbe valid JSON in the form{"access_token":"ya29....","expires_in":3600,"token_type":"Bearer"}access_token: your access tokenexpires_in: how many seconds this token is valid fortoken_type:  usually just a bearer tokenQuickstartFor a quick example in python, the following will read a token file and use that for credentials:pipinstallgoogle-authgcp-process-credentialsfromgcp_process_credentials.credentialsimportProcessCredentialse=os.environ.copy()e.update({'foo':'bar'})pc=ProcessCredentials(command=["/usr/bin/cat"],args=['/tmp/token.txt'],env=e,)storage_client=storage.Client(project=project_id,credentials=pc)buckets=storage_client.list_buckets()forbktinbuckets:print(bkt.name)ofcourse the file  here/tmp/token.txtmust be the json file format described aboveParser InterfaceIf your binary does not provide the exact json format, your can define a parser interface to 'translate' the credential for you.For example,gcloud auth print-access-tokenreturns just the access token with an annoying newline character from stdout.You an provide an interface to do the translation like this:defgcloud_parser(req):data={}data["access_token"]=''.join(req.decode().split('\n'))data["expires_in"]=3600data["token_type"]="Bearer"returnstr(json.dumps(data))pc=ProcessCredentials(command=["gcloud"],args=['auth','print-access-token'],env=e,parser=gcloud_parser)Injecting tokens vs Wrapped CredentialsYou might be asking...why cant' i just run the binary on my own in code, get the token an inject it as a credential like this??importgoogle.oauth2.credentialscredentials=google.oauth2.credentials.Credentials("thetoken")storage_client=storage.Client(credentials=credentials)forbinstorage_client.list_buckets():print(b.name)Well, the, token isnotrefreshable and your client library will need to manage that.  On the other hand, if you use this library, it will automatically refresh the token by calling the binary when its nearing expirationOther ReferencesAWS->GCP Process Credential Pluginto generate the library from scratch and run local, runpython3setup.pysdistbdist_wheelcdexample
virtualenvenv

pip3install../
pip3install-rrequirements.txt