Google authentication for GCS file system.

Implements an authentication mechanism based on Application Default Credentials:
https://developers.google.com/identity/protocols/application-default-credentials
https://developers.google.com/identity/protocols/OAuth2ServiceAccount
Change: 122741738

tensorflow/core/platform/cloud/BUILD

@@ -36,6 +36,7 @@ cc_library(
  visibility = ["//visibility:public"],
  deps = [
  "@jsoncpp_git//:jsoncpp",
+ ":google_auth_provider",
  ":http_request",
  "//tensorflow/core:framework_headers_lib",
  "//tensorflow/core:lib_internal",
@@ -57,11 +58,74 @@ cc_library(
  ],
 )
 
+cc_library(
+ name = "http_request_fake",
+ testonly = 1,
+ hdrs = [
+ "http_request_fake.h",
+ ],
+ deps = [
+ ":http_request",
+ "//tensorflow/core:lib",
+ "//tensorflow/core:lib_internal",
+ "//tensorflow/core:test",
+ ],
+)
+
+cc_library(
+ name = "google_auth_provider",
+ srcs = [
+ "google_auth_provider.cc",
+ ],
+ hdrs = [
+ "auth_provider.h",
+ "google_auth_provider.h",
+ ],
+ deps = [
+ "@jsoncpp_git//:jsoncpp",
+ ":base64",
+ ":http_request",
+ ":oauth_client",
+ "//tensorflow/core:lib",
+ ],
+)
+
+cc_library(
+ name = "oauth_client",
+ srcs = [
+ "oauth_client.cc",
+ ],
+ hdrs = [
+ "oauth_client.h",
+ ],
+ deps = [
+ "@boringssl_git//:crypto",
+ "@jsoncpp_git//:jsoncpp",
+ ":base64",
+ ":http_request",
+ "//tensorflow/core:lib",
+ ],
+)
+
+cc_library(
+ name = "base64",
+ srcs = [
+ "base64.cc",
+ ],
+ hdrs = [
+ "base64.h",
+ ],
+ deps = [
+ "//tensorflow/core:lib",
+ ],
+)
+
 tf_cc_test(
  name = "gcs_file_system_test",
  size = "small",
  deps = [
  ":gcs_file_system",
+ ":http_request_fake",
  "//tensorflow/core:test",
  "//tensorflow/core:test_main",
  ],
@@ -77,3 +141,53 @@ tf_cc_test(
  "//tensorflow/core:test_main",
  ],
 )
+
+tf_cc_test(
+ name = "oauth_client_test",
+ size = "small",
+ data = [
+ "testdata/service_account_credentials.json",
+ "testdata/service_account_public_key.txt",
+ ],
+ deps = [
+ "@boringssl_git//:crypto",
+ ":base64",
+ ":http_request_fake",
+ ":oauth_client",
+ "//tensorflow/core:lib",
+ "//tensorflow/core:lib_internal",
+ "//tensorflow/core:test",
+ "//tensorflow/core:test_main",
+ ],
+)
+
+tf_cc_test(
+ name = "base64_test",
+ size = "small",
+ deps = [
+ ":base64",
+ "//tensorflow/core:lib",
+ "//tensorflow/core:lib_internal",
+ "//tensorflow/core:test",
+ "//tensorflow/core:test_main",
+ ],
+)
+
+tf_cc_test(
+ name = "google_auth_provider_test",
+ size = "small",
+ data = [
+ "testdata/application_default_credentials.json",
+ "testdata/service_account_credentials.json",
+ ],
+ deps = [
+ ":base64",
+ ":google_auth_provider",
+ ":http_request_fake",
+ ":oauth_client",
+ "//tensorflow/core:lib",
+ "//tensorflow/core:lib_internal",
+ "//tensorflow/core:test",
+ "//tensorflow/core:test_main",
+ ],
+)

tensorflow/core/platform/cloud/auth_provider.h

@@ -0,0 +1,52 @@
+/* Copyright 2016 Google Inc. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+ http:https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+==============================================================================*/
+
+#ifndef TENSORFLOW_CORE_PLATFORM_AUTH_PROVIDER_H_
+#define TENSORFLOW_CORE_PLATFORM_AUTH_PROVIDER_H_
+
+#include <string>
+#include "tensorflow/core/lib/core/errors.h"
+#include "tensorflow/core/lib/core/status.h"
+
+namespace tensorflow {
+
+/// Interface for a provider of authentication bearer tokens.
+class AuthProvider {
+ public:
+ virtual ~AuthProvider() {}
+
+ /// Returns the short-term authentication bearer token.
+ virtual Status GetToken(string* t) = 0;
+
+ static Status GetToken(AuthProvider* provider, string* token) {
+ if (!provider) {
+ return errors::Internal("Auth provider is required.");
+ }
+ return provider->GetToken(token);
+ }
+};
+
+/// No-op auth provider, which will only work for public objects.
+class EmptyAuthProvider : public AuthProvider {
+ public:
+ Status GetToken(string* token) override {
+ *token = "";
+ return Status::OK();
+ }
+};
+
+} // namespace tensorflow
+
+#endif // TENSORFLOW_CORE_PLATFORM_AUTH_PROVIDER_H_