Google service account to verify API requests to node application on GCP - node.js

Question

We're building out an api service for a node application that's running on Google app engine. Currently, I have setup passport to use the 'passport-http-bearer' strategy to handle browserless http requests to our api. This takes a token from the authorization header of the request and uses that to authenticate it.
We're also building out an on-prem python program that will request Google for a token, which we will send to the node app to make an api call. Based on what I've seen around the web, it seems like the best way to do this is to use a service account that is associated with the GCP project. Unfortunately, all the tutorials I've seen use the service account credentials to make authorized calls to Google APIs. I would like to use the service account credentials to make authorized calls to our application's API. My problem is that I can't seem to find any code to take the bearer token from the request and then check against the service account to say either "Yes this was generated from the right account" or "No this request should be rejected". Any insights into how to bridge this gap would be very helpful. Currently my (initial, very poor) bearer strategy is:
passport.use(new BearerStrategy((token, done) => {
console.log('Bearer called with token: ', token);
if (token === '<Fake test token for SO>') {
console.log(' valid token!');
return done(null, { name: 'api_service' });
}
console.log(' invalid token...');
return done(null, false);
}));

Answer 1

We ended up using an https request directly to the google auth endpoint. Here's the code:
// Bearer token strategy for headless requests. This is used to authenticate API calls
passport.use(new BearerStrategy((token, done) => {
//forming the request to hit the google auth endpoint
const options = {
host: 'www.googleapis.com',
path: `/oauth2/v1/tokeninfo?access_token=${token}`,
headers: {
Accept: 'application/json'
}
};
//ask google endpoint if the token has the service account's email
https.get(options, (res) => {
res.setEncoding('utf8');
res.on('data', (chunk) => {
if (JSON.parse(chunk).email === config.get('SVCACCT_NAME')) {
//good request from the service account
return done(null, { name: 'api_service' });
}
//not the service account
return done(null, false);
});
}).on('error', (err) => {
console.log('Got API auth error: ', err.message);
//error or bad token. Either way reject it
return done(err, false);
});
}));
We used a shell script with the service account json file from the project console to generate the token for testing purposes (This won't run on mac. I had to use a docker container with jq installed.). Later we'll translate this to python:
#!/bin/bash
if [ -z "${1}" ]; then
PROG=$( basename $0 )
echo "usage: ${PROG} <JSON account file>"
exit 1
fi
keyfile="${1}"
client_email=$( jq -r '.client_email' $keyfile )
if [ -z "${client_email}" ]; then
echo "JSON file does not appear to be valid"
exit 2
fi
private_key=$( jq '.private_key' $keyfile | tr -d '"' )
if [ -z "${private_key}" ]; then
echo "JSON file does not appear to be valid"
exit 3
fi
keyfile=$( mktemp -p . privkeyXXXXX )
echo -e $private_key > $keyfile
now=$( date "+%s" )
later=$( date -d '+30 min' "+%s" )
header=$( echo -n "{\"alg\":\"RS256\",\"typ\":\"JWT\"}" | base64 -w 0 )
claim=$( echo -n "{ \"iss\":\"${client_email}\", \"scope\":\"email profile\", \"aud\":\"https://www.googleapis.com/oauth2/v4/token\", \"exp\":${later}, \"iat\":${now} }" | base64 -w 0 )
data="${header}.${claim}"
sig=$( echo -n $data | openssl dgst -sha256 -sign $keyfile -keyform PEM -binary | base64 -w 0 )
rm -f $keyfile
stuff=$( echo "${header}.${claim}.${sig}" | sed 's!\/!%2F!g' | sed 's/=/%3D/g' | sed 's/\+/%2B/g' )
curl -d "grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer&assertion=${stuff}" https://www.googleapis.com/oauth2/v4/token

Answer 2

Google offers google.oauth2.id_token module to help verify tokens.
verify_oauth2_token can ve used to check a Google token:
verify_oauth2_token(id_token, request, audience=None)[source]
Verifies an ID Token issued by Google’s OAuth 2.0 authorization server.
[ ... ]
Returns: The decoded token.