Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

samples: remove browser option from user credentials sample #1147

Merged
merged 4 commits into from
Mar 2, 2022
Merged

samples: remove browser option from user credentials sample #1147

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
75bc445
samples: remove run_console from user credentials sample
busunkim96 Feb 22, 2022
533bcac
Update samples/snippets/user_credentials.py
busunkim96 Feb 23, 2022
ae15d1d
🦉 Updates from OwlBot post-processor
gcf-owl-bot[bot] Feb 24, 2022
3bea73e
Merge branch 'main' into oob-deprecation
tswast Mar 2, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 9 additions & 13 deletions samples/snippets/user_credentials.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,26 +23,22 @@
import argparse


def main(project, launch_browser=True):
def main(project):
# [START bigquery_auth_user_flow]
from google_auth_oauthlib import flow

# TODO: Uncomment the line below to set the `launch_browser` variable.
# launch_browser = True
#
# The `launch_browser` boolean variable indicates if a local server is used
# as the callback URL in the auth flow. A value of `True` is recommended,
# but a local server does not work if accessing the application remotely,
# such as over SSH or from a remote Jupyter notebook.
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

gcloud allows you to complete auth on a remote machine with no browser gcloud auth application-default login --no-browser, available in >=372.0.0.

This doc has an overview of what the flow looks like. I believe this new flag will take care of the general 'accessing the application remotely case' as long as the user can run gcloud on the target machine.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tswast @shollyman Are there cases where a user might not be able to run gcloud on the machine where the notebook is hosted?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tswast @shollyman Are there cases where a user might not be able to run gcloud on the machine where the notebook is hosted?

Oh dear. 😱 I'm not sure about "can't" but this will add significant friction to folks using hosted notebooks on other clouds such as Azure Machine Learning Notebooks or Amazon SageMaker.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for bringing this to my attention. I believe I'll need to prioritize pydata/pydata-google-auth#53 and ideally pydata/pydata-google-auth#48 as well due to this auth change.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Kubeflow notebooks and other self-hosted notebook systems like Jupyter Hub will also have a problem.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks Tim, it looked like some other teams working with Notebooks are also trying to figure out how this impacts their users. dujinhui@ is on the team leading the OOB deprecation if you need a point of contact.


# A local server is used as the callback URL in the auth flow.
appflow = flow.InstalledAppFlow.from_client_secrets_file(
"client_secrets.json", scopes=["https://www.googleapis.com/auth/bigquery"]
)

if launch_browser:
appflow.run_local_server()
else:
appflow.run_console()
# This launches a local server to be used as the callback URL in the desktop
# app auth flow. If you are accessing the application remotely, such as over
# SSH or a remote Jupyter notebook, this flow will not work. Use the
# `gcloud auth application-default login --no-browser` command or workload
# identity federation to get authentication tokens, instead.
#
appflow.run_local_server()
busunkim96 marked this conversation as resolved.
Show resolved Hide resolved

credentials = appflow.credentials
# [END bigquery_auth_user_flow]
Expand Down
2 changes: 1 addition & 1 deletion samples/snippets/user_credentials_test.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ def mock_flow():


def test_auth_query_console(mock_flow, capsys):
main(PROJECT, launch_browser=False)
main(PROJECT)
out, _ = capsys.readouterr()
# Fun fact: William P. Wood was the 1st director of the US Secret Service.
assert "William" in out