search order in provider is incorrect?

[aaron-tillekeratne]

gcp_auth == 0.12.5

Looking through the docs shows the following.

1. GOOGLE_APPLICATION_CREDENTIALS env var is used for ADC. So when we declare this provider fails because the json file read is incorrect.

The correct way should be somthing like the below?

gcp_auth::provider(key_file="path")

Key files can go anywhere, but GOOGLE_APPLICATION_CREDENTIALS is a special variable specific to ADC and the gcloud SDK? AFAIK.

Cheers,
A

[djc]

You haven't really argued why or by what measure the search order is incorrect. If you know the credentials are in a different file, you can use CustomServiceAccount::from_file() explicitly.

[aaron-tillekeratne]

Sorry what I meant was.

in point number 1 it says if "GOOGLE_APPLICATION_CREDENTIALS" environment variable is set use a custom service account as the token source. By which I understand that this is looking to parse the output of a key.json file when you download a service account key.

I get the error that "private_key" field is missing when I use gcloud auth application-default login in the same terminal session as im running the binary.

but if I run the code in a different terminal session, the library seems to pickup the step 2 .config/gcloud/application_default_credentials.json (i.e. skipping the step 1).

My thoughts are GOOGLE_APPLICATION_CREDENTIALS is a variable typically set by google, so it should load the ADC creds not the service account key creds. I would have thought it would be better to signal exported key locations with a variable such as GCP_AUTH_KEY_FILE or similar.

[djc]

I think your thinking is confused but as a volunteer maintainer I don't have time to go chase down documentation to explain why that is the case. So far you haven't convinced me there's an issue with this crate's logic (and I can assure you the logic was thoroughly reviewed when I was paid to work on it a few years ago).