
                             S r SSKJr  SSKJr  SSKJr  SSKJr  SSKJ	r	  SSKJr
  SSKJr  SSKJr  SS	KJr  SS
KJr  SSKJr  SSKJr  S r\	R0                   " S S\	R2                  5      5       rg)z&A command that prints identity token.
    )absolute_import)division)unicode_literals)
exceptions)base)	auth_util)flags)config_helper)config)store)clientc           	         U R                  S5      n[        R                  " U R                  USS9n[        R
                  " U5      nU R                  (       aF  [        R                  " U5      (       d  [        R                  " S5      eU R                  [        l        U R                  S5      (       d  U R                  S5      (       a1  [        R                  " U5      (       d  [        R                  " S5      eU R                  S:X  a'  U R                  (       a  [        R                  " S	5      eU R                  S
5      (       a1  [        R
                  " U5      (       d  [        R                  " S5      e[        R                   " UUU R"                  U R                  U R                  SS9  [$        R&                  " U5      nUR(                  (       d  [        R*                  " S5      eU$ )%Run the print_identity_token command.impersonate_service_accountT)allow_account_impersonationuse_google_authzGInvalid account type for `--audiences`. Requires valid service account.token_formatinclude_licensezgInvalid account type for `--token-format` or `--include-license`. Requires a valid GCE service account.standardzE`--include-license` can only be specified when `--token-format=full`.include_emailzTInvalid account type for `--include-email`. Requires an impersonate service account.)is_impersonated_credentialr   gce_token_formatgce_include_license refresh_user_account_credentialsz?No identity token can be obtained from the current credentials.)IsSpecifiedc_storeLoadaccountr   IsImpersonationCredential	audiencesValidIdTokenCredentialauth_exceptionsWrongAccountTypeErrorr   CLOUDSDK_CLIENT_IDIsGceAccountCredentialsr   r   GCEIdentityTokenError_RefreshGoogleAuthIdTokenr   r
   
Credentialid_tokenInvalidIdentityTokenError)argsdo_impersonationcredis_impersonated_account
credentials        (lib/surface/auth/print_identity_token.py_Runr1   "   s   %%&CD	
ll"2
$ &??E	^^++D1111,- - !%F	n%%)9)9:K)L)L,,T221123 3 
*$11#$ $ 
o&&..t441156 6 
##
!8&&((..'+ ''-*			

3
3IK K	    c                       \ rS rSrSrSSS.r\S 5       r\R                  " \
R                  \R                  5      S 5       rSrg	)
IdentityTokenT   z2Print an identity token for the specified account.z        {description}
        a          To print identity tokens:

          $ {command}

        To print identity token for account 'foo@example.com' whose audience
        is 'https://service-hash-uc.a.run.app', run:

          $ {command} foo@example.com --audiences="https://service-hash-uc.a.run.app"

        To print identity token for an impersonated service account 'my-account@example.iam.gserviceaccount.com'
        whose audience is 'https://service-hash-uc.a.run.app', run:

          $ {command} --impersonate-service-account="my-account@example.iam.gserviceaccount.com" --audiences="https://service-hash-uc.a.run.app"

        To print identity token of a Compute Engine instance, which includes
        project and instance details as well as license codes for images
        associated with the instance, run:

          $ {command} --token-format=full --include-license

        To print identity token for an impersonated service account
        'my-account@example.iam.gserviceaccount.com', which includes the email
        address of the service account, run:

          $ {command} --impersonate-service-account="my-account@example.iam.gserviceaccount.com" --include-email
        )DESCRIPTIONEXAMPLESc                     [         R                  " U 5        [         R                  " U 5        [         R                  " U 5        [         R                  " U 5        U R
                  R                  S5        g )Nzvalue(id_token))r	   AddAccountArgAddAudienceArgAddGCESpecificArgsAddIncludeEmailArgdisplay_info	AddFormat)parsers    r0   ArgsIdentityToken.Argsz   sO    		 	V$	V$
!!"34r2   c                     [        U5      nU$ )r   )r1   )selfr+   r/   s      r0   RunIdentityToken.Run   s     dJr2    N)__name__
__module____qualname____firstlineno____doc__detailed_helpstaticmethodr@   c_excRaiseErrorInsteadOfr"   AuthenticationErrorr   ErrorrD   __static_attributes__rF   r2   r0   r4   r4   T   sW    :!-F 5 5 	_@@&,,O Pr2   r4   N)rK   
__future__r   r   r   googlecloudsdk.api_lib.authr   r"   googlecloudsdk.callioper   rN   googlecloudsdk.command_lib.authr   r	   !googlecloudsdk.command_lib.configr
   googlecloudsdk.corer   googlecloudsdk.core.credentialsr   r   oauth2clientr   r1   UniverseCompatibleCommandr4   rF   r2   r0   <module>r]      s[     '  ' E ( 7 5 1 ; & < /d 1DLL 1 1r2   