[Google Drive Connector] Support OAuth 2.0 Client Credentials and Workload Identity Federation as alternatives to Service Account JSON
Describe the feature request:
The Google Drive connector currently requires a Service Account JSON key file (containing an RSA private key) as the only authentication method. This is blocked in many enterprise environments where GCP organisation policy explicitly forbids the creation of service account keys (e.g. via constraints/iam.disableServiceAccountKeyCreation).The connector exposes an auth_type: "oauth2" config option but the underlying code (datasource.py, google.py) calls service_account.Credentials.from_service_account_info() regardless, making OAuth 2.0 Client ID/Secret non-functional.
Requested alternatives:
- OAuth 2.0 Client Credentials with domain-wide delegationSupport client_id + client_secret + subject (impersonation) as a fully functional auth path — without requiring a private key.
- Workload Identity FederationAllow the connector to pick up credentials from the GCP metadata server when running on GCP infrastructure (GKE, Compute Engine, Cloud Run), so no key file is ever generated or stored.
Current behaviour:
google.auth.exceptions.InvalidValue: None could not be converted to bytes
The connector fails at _helpers.to_bytes(key) because no private key is present — even when auth_type: "oauth2" is explicitly set in config.yml.
Expected behaviour:
The connector should authenticate successfully using OAuth 2.0 Client Credentials or ambient GCP credentials without requiring a Service Account JSON key file.
Environment:
- Connector service version: 9.4.2
- Deployment: Self-managed Docker / Kibana-managed
- Google Drive connector: google_drive
Why this matters:
Enterprise GCP organisations commonly enforce constraints/iam.disableServiceAccountKeyCreation as a security baseline. This policy makes the Google Drive connector completely unusable in those environments. Supporting keyless authentication would unblock a significant number of enterprise customers.
[Google Drive Connector] Support OAuth 2.0 Client Credentials and Workload Identity Federation as alternatives to Service Account JSON
Describe the feature request:
The Google Drive connector currently requires a Service Account JSON key file (containing an RSA private key) as the only authentication method. This is blocked in many enterprise environments where GCP organisation policy explicitly forbids the creation of service account keys (e.g. via constraints/iam.disableServiceAccountKeyCreation).The connector exposes an auth_type: "oauth2" config option but the underlying code (datasource.py, google.py) calls service_account.Credentials.from_service_account_info() regardless, making OAuth 2.0 Client ID/Secret non-functional.
Requested alternatives:
Current behaviour:
google.auth.exceptions.InvalidValue: None could not be converted to bytesThe connector fails at _helpers.to_bytes(key) because no private key is present — even when auth_type: "oauth2" is explicitly set in config.yml.
Expected behaviour:
The connector should authenticate successfully using OAuth 2.0 Client Credentials or ambient GCP credentials without requiring a Service Account JSON key file.
Environment:
Why this matters:
Enterprise GCP organisations commonly enforce constraints/iam.disableServiceAccountKeyCreation as a security baseline. This policy makes the Google Drive connector completely unusable in those environments. Supporting keyless authentication would unblock a significant number of enterprise customers.