Repository: rucio/rucio

Issue:
Replace deprecated `oauth2client` dependency
Motivation
----------
Dependency is deprecated since 2018. Needs to be replaced. Common recommendation seems to be http://oauthlib.readthedocs.io/

Modification
------------
Investigate `oauth2client` alternatives and change the dependency. 


Discussion:
This dependency is only used in the context of the service account credentials that we need to sign urls for Google Cloud Storage. I believe this [1] library is a better fit, I already figured out and tested the changes that are needed and everything seems to work fine. I haven't yet explored [2] in depth, but from a quick look it doesn't seem to have out of the box support for managing these credentials.

[1] https://google-auth.readthedocs.io/en/latest/index.html
[2] http://oauthlib.readthedocs.io/
👍 Thanks Rizart. That makes sense. I thought at first that this is used for the oauth tokens, did not see that it is only used for the signed urls. Since [1] also supports AWS that should be fine.
@cserf ?

Resolving patch:
diff --git a/lib/rucio/core/credential.py b/lib/rucio/core/credential.py
--- a/lib/rucio/core/credential.py
+++ b/lib/rucio/core/credential.py
@@ -20,6 +20,7 @@
 # - Benedikt Ziemons <benedikt.ziemons@cern.ch>, 2021
 # - Radu Carpa <radu.carpa@cern.ch>, 2022
 # - Cedric Serfon <cedric.serfon@cern.ch>, 2022
+# - Rizart Dona <rizart.dona@cern.ch>, 2022
 
 import base64
 import datetime
@@ -30,7 +31,7 @@
 import boto3
 from botocore.client import Config
 from dogpile.cache.api import NO_VALUE
-from oauth2client.service_account import ServiceAccountCredentials
+from google.oauth2.service_account import Credentials
 from six import integer_types
 from six.moves.urllib.parse import urlparse, urlencode
 
@@ -79,9 +80,9 @@ def get_signed_url(rse_id, service, operation, url, lifetime=600):
     signed_url = None
     if service == 'gcs':
         if not CREDS_GCS:
-            CREDS_GCS = ServiceAccountCredentials.from_json_keyfile_name(config_get('credentials', 'gcs',
-                                                                                    raise_exception=False,
-                                                                                    default='/opt/rucio/etc/google-cloud-storage-test.json'))
+            CREDS_GCS = Credentials.from_service_account_file(config_get('credentials', 'gcs',
+                                                                         raise_exception=False,
+                                                                         default='/opt/rucio/etc/google-cloud-storage-test.json'))
         components = urlparse(url)
         host = components.netloc
 
@@ -106,7 +107,7 @@ def get_signed_url(rse_id, service, operation, url, lifetime=600):
 
         # create URL-capable signature
         # first character is always a '=', remove it
-        signature = urlencode({'': base64.b64encode(CREDS_GCS.sign_blob(to_sign)[1])})[1:]
+        signature = urlencode({'': base64.b64encode(CREDS_GCS.sign_bytes(to_sign))})[1:]
 
         # assemble final signed URL
         signed_url = 'https://%s%s?GoogleAccessId=%s&Expires=%s&Signature=%s' % (host,
diff --git a/setuputil.py b/setuputil.py
--- a/setuputil.py
+++ b/setuputil.py
@@ -93,7 +93,7 @@
         'stomp.py',
         'statsd',
         'geoip2',
-        'oauth2client',
+        'google-auth',
         'retrying',
         'redis',
         'flask',


Test patch: