You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "Tim Swast (JIRA)" <ji...@apache.org> on 2018/05/24 22:08:00 UTC
[jira] [Created] (AIRFLOW-2522) Cannot use
GOOGLE_APPLICATION_CREDENTIALS to authenticate for GCP connections
Tim Swast created AIRFLOW-2522:
----------------------------------
Summary: Cannot use GOOGLE_APPLICATION_CREDENTIALS to authenticate for GCP connections
Key: AIRFLOW-2522
URL: https://issues.apache.org/jira/browse/AIRFLOW-2522
Project: Apache Airflow
Issue Type: Bug
Components: contrib
Reporter: Tim Swast
Assignee: Tim Swast
If you try to use the GOOGLE_APPLICATION_CREDENTIALS environment variable with a service account key to authenticate to Google Cloud, as described at [https://cloud.google.com/docs/authentication/production] you get an error "HttpAccessTokenRefreshError: invalid_scope: Empty or missing scope not allowed."
This error occurs even if you fill in the scope field of the GCP connection.
The root cause is that scopes are ignored by the GCP hook when using application default credentials. They should not be ignored when the default credentials are using a service account. (And probably shouldn't be ignored at all, preferring an error when scopes are filled in but don't apply to the credential type)
I'll try to fix this while I'm working on https://issues.apache.org/jira/projects/AIRFLOW/issues/AIRFLOW-2512.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)