docs(samples): add auth samples and tests

.github/sync-repo-settings.yaml

@@ -11,6 +11,10 @@ branchProtectionRules:
     - 'OwlBot Post Processor'
     - 'Kokoro system-3.7'
     - 'Kokoro'
+    - 'Samples - Python 3.7'
+    - 'Samples - Python 3.8'
+    - 'Samples - Python 3.9'
+    - 'Samples - Python 3.10'
 permissionRules:
   - team: actools-python
     permission: admin

.kokoro/samples-test-setup.sh

@@ -0,0 +1,48 @@
+#!/bin/bash
+# Copyright 2018 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -eo pipefail
+
+if [[ -z "${PROJECT_ROOT:-}" ]]; then
+    PROJECT_ROOT="github/google-auth-library-python"
+fi
+
+cd "${PROJECT_ROOT}"
+
+# Disable buffering, so that the logs stream through.
+export PYTHONUNBUFFERED=1
+
+# Remove old nox
+python3 -m pip uninstall --yes --quiet nox-automation
+
+# Install nox
+python3 -m pip install --upgrade --quiet nox
+python3 -m nox --version
+
+# Setup service account credentials.
+export GOOGLE_APPLICATION_CREDENTIALS=${KOKORO_GFILE_DIR}/service-account.json
+
+# Setup project id.
+export PROJECT_ID=$(cat "${KOKORO_GFILE_DIR}/project-id.txt")
+
+# Activate gcloud with service account credentials
+gcloud auth activate-service-account --key-file=$GOOGLE_APPLICATION_CREDENTIALS
+gcloud config set project ${PROJECT_ID}
+
+# Decrypt system test secrets
+./scripts/decrypt-secrets.sh
+
+# Run system tests which use a different noxfile
+python3 -m nox -f samples/cloud-client/snippets/noxfile.py

.kokoro/samples/lint/common.cfg

@@ -7,28 +7,25 @@ action {
   }
 }
 
-# Specify which tests to run
-env_vars: {
-    key: "RUN_TESTS_SESSION"
-    value: "lint"
-}
+# Download trampoline resources.
+gfile_resources: "/bigstore/cloud-devrel-kokoro-resources/trampoline"
 
-env_vars: {
-    key: "TRAMPOLINE_BUILD_FILE"
-    value: "github/google-auth-library-python/.kokoro/test-samples.sh"
-}
+# Download resources for system tests (service account key, etc.)
+gfile_resources: "/bigstore/cloud-devrel-kokoro-resources/google-auth-library-python"
+
+# Use the trampoline script to run in docker.
+build_file: "google-auth-library-python/.kokoro/trampoline.sh"
 
 # Configure the docker image for kokoro-trampoline.
 env_vars: {
     key: "TRAMPOLINE_IMAGE"
-    value: "gcr.io/cloud-devrel-kokoro-resources/python-samples-testing-docker"
+    value: "gcr.io/cloud-devrel-kokoro-resources/python-multi"
 }
-
-# Download secrets for samples
-gfile_resources: "/bigstore/cloud-devrel-kokoro-resources/python-docs-samples"
-
-# Download trampoline resources.
-gfile_resources: "/bigstore/cloud-devrel-kokoro-resources/trampoline"
-
-# Use the trampoline script to run in docker.
-build_file: "google-auth-library-python/.kokoro/trampoline_v2.sh"
+env_vars: {
+    key: "TRAMPOLINE_BUILD_FILE"
+    value: "github/google-auth-library-python/.kokoro/build.sh"
+}
+env_vars: {
+    key: "TRAMPOLINE_BUILD_FILE"
+    value: "github/google-auth-library-python/.kokoro/samples-test-setup.sh"
+}

.kokoro/samples/python3.10/common.cfg

@@ -7,34 +7,25 @@ action {
   }
 }
 
-# Specify which tests to run
-env_vars: {
-    key: "RUN_TESTS_SESSION"
-    value: "py-3.10"
-}
+# Download trampoline resources.
+gfile_resources: "/bigstore/cloud-devrel-kokoro-resources/trampoline"
 
-# Declare build specific Cloud project.
-env_vars: {
-    key: "BUILD_SPECIFIC_GCLOUD_PROJECT"
-    value: "python-docs-samples-tests-310"
-}
+# Download resources for system tests (service account key, etc.)
+gfile_resources: "/bigstore/cloud-devrel-kokoro-resources/google-auth-library-python"
 
-env_vars: {
-    key: "TRAMPOLINE_BUILD_FILE"
-    value: "github/google-auth-library-python/.kokoro/test-samples.sh"
-}
+# Use the trampoline script to run in docker.
+build_file: "google-auth-library-python/.kokoro/trampoline.sh"
 
 # Configure the docker image for kokoro-trampoline.
 env_vars: {
     key: "TRAMPOLINE_IMAGE"
-    value: "gcr.io/cloud-devrel-kokoro-resources/python-samples-testing-docker"
+    value: "gcr.io/cloud-devrel-kokoro-resources/python-multi"
 }
-
-# Download secrets for samples
-gfile_resources: "/bigstore/cloud-devrel-kokoro-resources/python-docs-samples"
-
-# Download trampoline resources.
-gfile_resources: "/bigstore/cloud-devrel-kokoro-resources/trampoline"
-
-# Use the trampoline script to run in docker.
-build_file: "google-auth-library-python/.kokoro/trampoline_v2.sh"
+env_vars: {
+    key: "TRAMPOLINE_BUILD_FILE"
+    value: "github/google-auth-library-python/.kokoro/build.sh"
+}
+env_vars: {
+    key: "TRAMPOLINE_BUILD_FILE"
+    value: "github/google-auth-library-python/.kokoro/samples-test-setup.sh"
+}

.kokoro/samples/python3.7/common.cfg

@@ -7,34 +7,25 @@ action {
   }
 }
 
-# Specify which tests to run
-env_vars: {
-    key: "RUN_TESTS_SESSION"
-    value: "py-3.7"
-}
+# Download trampoline resources.
+gfile_resources: "/bigstore/cloud-devrel-kokoro-resources/trampoline"
 
-# Declare build specific Cloud project.
-env_vars: {
-    key: "BUILD_SPECIFIC_GCLOUD_PROJECT"
-    value: "python-docs-samples-tests-py37"
-}
+# Download resources for system tests (service account key, etc.)
+gfile_resources: "/bigstore/cloud-devrel-kokoro-resources/google-auth-library-python"
 
-env_vars: {
-    key: "TRAMPOLINE_BUILD_FILE"
-    value: "github/google-auth-library-python/.kokoro/test-samples.sh"
-}
+# Use the trampoline script to run in docker.
+build_file: "google-auth-library-python/.kokoro/trampoline.sh"
 
 # Configure the docker image for kokoro-trampoline.
 env_vars: {
     key: "TRAMPOLINE_IMAGE"
-    value: "gcr.io/cloud-devrel-kokoro-resources/python-samples-testing-docker"
+    value: "gcr.io/cloud-devrel-kokoro-resources/python-multi"
 }
-
-# Download secrets for samples
-gfile_resources: "/bigstore/cloud-devrel-kokoro-resources/python-docs-samples"
-
-# Download trampoline resources.
-gfile_resources: "/bigstore/cloud-devrel-kokoro-resources/trampoline"
-
-# Use the trampoline script to run in docker.
-build_file: "google-auth-library-python/.kokoro/trampoline_v2.sh"
+env_vars: {
+    key: "TRAMPOLINE_BUILD_FILE"
+    value: "github/google-auth-library-python/.kokoro/build.sh"
+}
+env_vars: {
+    key: "TRAMPOLINE_BUILD_FILE"
+    value: "github/google-auth-library-python/.kokoro/samples-test-setup.sh"
+}

.kokoro/samples/python3.8/common.cfg

@@ -7,34 +7,25 @@ action {
   }
 }
 
-# Specify which tests to run
-env_vars: {
-    key: "RUN_TESTS_SESSION"
-    value: "py-3.8"
-}
+# Download trampoline resources.
+gfile_resources: "/bigstore/cloud-devrel-kokoro-resources/trampoline"
 
-# Declare build specific Cloud project.
-env_vars: {
-    key: "BUILD_SPECIFIC_GCLOUD_PROJECT"
-    value: "python-docs-samples-tests-py38"
-}
+# Download resources for system tests (service account key, etc.)
+gfile_resources: "/bigstore/cloud-devrel-kokoro-resources/google-auth-library-python"
 
-env_vars: {
-    key: "TRAMPOLINE_BUILD_FILE"
-    value: "github/google-auth-library-python/.kokoro/test-samples.sh"
-}
+# Use the trampoline script to run in docker.
+build_file: "google-auth-library-python/.kokoro/trampoline.sh"
 
 # Configure the docker image for kokoro-trampoline.
 env_vars: {
     key: "TRAMPOLINE_IMAGE"
-    value: "gcr.io/cloud-devrel-kokoro-resources/python-samples-testing-docker"
+    value: "gcr.io/cloud-devrel-kokoro-resources/python-multi"
 }
-
-# Download secrets for samples
-gfile_resources: "/bigstore/cloud-devrel-kokoro-resources/python-docs-samples"
-
-# Download trampoline resources.
-gfile_resources: "/bigstore/cloud-devrel-kokoro-resources/trampoline"
-
-# Use the trampoline script to run in docker.
-build_file: "google-auth-library-python/.kokoro/trampoline_v2.sh"
+env_vars: {
+    key: "TRAMPOLINE_BUILD_FILE"
+    value: "github/google-auth-library-python/.kokoro/build.sh"
+}
+env_vars: {
+    key: "TRAMPOLINE_BUILD_FILE"
+    value: "github/google-auth-library-python/.kokoro/samples-test-setup.sh"
+}

.kokoro/samples/python3.9/common.cfg

@@ -7,34 +7,25 @@ action {
   }
 }
 
-# Specify which tests to run
-env_vars: {
-    key: "RUN_TESTS_SESSION"
-    value: "py-3.9"
-}
+# Download trampoline resources.
+gfile_resources: "/bigstore/cloud-devrel-kokoro-resources/trampoline"
 
-# Declare build specific Cloud project.
-env_vars: {
-    key: "BUILD_SPECIFIC_GCLOUD_PROJECT"
-    value: "python-docs-samples-tests-py39"
-}
+# Download resources for system tests (service account key, etc.)
+gfile_resources: "/bigstore/cloud-devrel-kokoro-resources/google-auth-library-python"
 
-env_vars: {
-    key: "TRAMPOLINE_BUILD_FILE"
-    value: "github/google-auth-library-python/.kokoro/test-samples.sh"
-}
+# Use the trampoline script to run in docker.
+build_file: "google-auth-library-python/.kokoro/trampoline.sh"
 
 # Configure the docker image for kokoro-trampoline.
 env_vars: {
     key: "TRAMPOLINE_IMAGE"
-    value: "gcr.io/cloud-devrel-kokoro-resources/python-samples-testing-docker"
+    value: "gcr.io/cloud-devrel-kokoro-resources/python-multi"
 }
-
-# Download secrets for samples
-gfile_resources: "/bigstore/cloud-devrel-kokoro-resources/python-docs-samples"
-
-# Download trampoline resources.
-gfile_resources: "/bigstore/cloud-devrel-kokoro-resources/trampoline"
-
-# Use the trampoline script to run in docker.
-build_file: "google-auth-library-python/.kokoro/trampoline_v2.sh"
+env_vars: {
+    key: "TRAMPOLINE_BUILD_FILE"
+    value: "github/google-auth-library-python/.kokoro/build.sh"
+}
+env_vars: {
+    key: "TRAMPOLINE_BUILD_FILE"
+    value: "github/google-auth-library-python/.kokoro/samples-test-setup.sh"
+}

samples/cloud-client/snippets/authenticate_explicit_with_adc.py

@@ -0,0 +1,55 @@
+# Copyright 2022 Google Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# [START auth_cloud_explicit_adc]
+
+from google.cloud import storage
+
+import google.oauth2.credentials
+import google.auth
+
+
+def authenticate_explicit_with_adc():
+    """
+    List storage buckets by authenticating with ADC.
+
+    // TODO(Developer):
+    //  1. Before running this sample,
+    //  set up ADC as described in https://cloud.google.com/docs/authentication/external/set-up-adc
+    //  2. Replace the project variable.
+    //  3. Make sure you have the necessary permission to list storage buckets: "storage.buckets.list"
+    """
+
+    # Construct the Google credentials object which obtains the default configuration from your
+    # working environment.
+    # google.auth.default() will give you ComputeEngineCredentials
+    # if you are on a GCE (or other metadata server supported environments).
+    credentials, project_id = google.auth.default()
+    # If you are authenticating to a Cloud API, you can let the library include the default scope,
+    # https://www.googleapis.com/auth/cloud-platform, because IAM is used to provide fine-grained
+    # permissions for Cloud.
+    # If you need to provide a scope, specify it as follows:
+    # credentials = google.auth.default(scopes=scope)
+    # For more information on scopes to use,
+    # see: https://developers.google.com/identity/protocols/oauth2/scopes
+
+    # Construct the Storage client.
+    storage_client = storage.Client(credentials=credentials, project=project_id)
+    buckets = storage_client.list_buckets()
+    print("Buckets:")
+    for bucket in buckets:
+        print(bucket.name)
+    print("Listed all storage buckets.")
+
+# [END auth_cloud_explicit_adc]