
                             S r SSKJr  SSKJr  SSKJr  SSKJr  SSK	J
r
  SSK	Jr  SSKJr  SSKJr  SSKJr  S	 r\R(                   " S
 S\R*                  5      5       rg)z&A command that prints identity token.
    )
exceptions)base)	auth_util)flags)config_helper)config)storec           	         U R                  S5      n[        R                  " U R                  US9n[        R
                  " U5      nU R                  (       aF  [        R                  " U5      (       d  [        R                  " S5      eU R                  [        l        U R                  S5      (       d  U R                  S5      (       a1  [        R                  " U5      (       d  [        R                  " S5      eU R                  S:X  a'  U R                  (       a  [        R                  " S5      eU R                  S	5      (       a1  [        R
                  " U5      (       d  [        R                  " S
5      e[        R                   " UUU R"                  U R                  U R                  SS9  [$        R&                  " U5      nUR(                  (       d  [        R*                  " S5      eU$ )%Run the print_identity_token command.impersonate_service_account)allow_account_impersonationzGInvalid account type for `--audiences`. Requires valid service account.token_formatinclude_licensezgInvalid account type for `--token-format` or `--include-license`. Requires a valid GCE service account.standardzE`--include-license` can only be specified when `--token-format=full`.include_emailzTInvalid account type for `--include-email`. Requires an impersonate service account.T)is_impersonated_credentialr   gce_token_formatgce_include_license refresh_user_account_credentialsz?No identity token can be obtained from the current credentials.)IsSpecifiedc_storeLoadaccountr   IsImpersonationCredential	audiencesValidIdTokenCredentialauth_exceptionsWrongAccountTypeErrorr   CLOUDSDK_CLIENT_IDIsGceAccountCredentialsr   r   GCEIdentityTokenError_RefreshGoogleAuthIdTokenr   r   
Credentialid_tokenInvalidIdentityTokenError)argsdo_impersonationcredis_impersonated_account
credentials        (lib/surface/auth/print_identity_token.py_Runr,      s   %%&CD	
ll"2
4$ &??E	^^++D1111,- - !%F	n%%)9)9:K)L)L,,T221123 3 
*$11#$ $ 
o&&..t441156 6 
##
!8&&((..'+ ''-*			

3
3IK K	    c                       \ rS rSrSrSSS.r\S 5       r\R                  " \
R                  \R                  5      S 5       rSrg	)
IdentityTokenP   z2Print an identity token for the specified account.z        {description}
        a          To print identity tokens:

          $ {command}

        To print identity token for account 'foo@example.com' whose audience
        is 'https://service-hash-uc.a.run.app', run:

          $ {command} foo@example.com --audiences="https://service-hash-uc.a.run.app"

        To print identity token for an impersonated service account 'my-account@example.iam.gserviceaccount.com'
        whose audience is 'https://service-hash-uc.a.run.app', run:

          $ {command} --impersonate-service-account="my-account@example.iam.gserviceaccount.com" --audiences="https://service-hash-uc.a.run.app"

        To print identity token of a Compute Engine instance, which includes
        project and instance details as well as license codes for images
        associated with the instance, run:

          $ {command} --token-format=full --include-license

        To print identity token for an impersonated service account
        'my-account@example.iam.gserviceaccount.com', which includes the email
        address of the service account, run:

          $ {command} --impersonate-service-account="my-account@example.iam.gserviceaccount.com" --include-email
        )DESCRIPTIONEXAMPLESc                     [         R                  " U 5        [         R                  " U 5        [         R                  " U 5        [         R                  " U 5        U R
                  R                  S5        g )Nzvalue(id_token))r   AddAccountArgAddAudienceArgAddGCESpecificArgsAddIncludeEmailArgdisplay_info	AddFormat)parsers    r+   ArgsIdentityToken.Argsv   sO    		 	V$	V$
!!"34r-   c                     [        U5      nU$ )r   )r,   )selfr&   r*   s      r+   RunIdentityToken.Run~   s     dJr-    N)__name__
__module____qualname____firstlineno____doc__detailed_helpstaticmethodr;   c_excRaiseErrorInsteadOfr   AuthenticationErrorgoogle_auth_exceptionsGoogleAuthErrorr?   __static_attributes__rA   r-   r+   r/   r/   P   s]    :!-F 5 5 	_@@3CCEEr-   r/   N)rF   google.authr   rL   googlecloudsdk.api_lib.authr   googlecloudsdk.callioper   rI   googlecloudsdk.command_lib.authr   r   !googlecloudsdk.command_lib.configr   googlecloudsdk.corer   googlecloudsdk.core.credentialsr	   r   r,   UniverseCompatibleCommandr/   rA   r-   r+   <module>rX      sR     = E ( 7 5 1 ; & <.b 2DLL 2 2r-   