Tim Swast created AIRFLOW-2522:
----------------------------------
Summary: Cannot use GOOGLE_APPLICATION_CREDENTIALS to authenticate
for GCP connections
Key: AIRFLOW-2522
URL: https://issues.apache.org/jira/browse/AIRFLOW-2522
Project: Apache Airflow
Issue Type: Bug
Components: contrib
Reporter: Tim Swast
Assignee: Tim Swast
If you try to use the GOOGLE_APPLICATION_CREDENTIALS environment variable with
a service account key to authenticate to Google Cloud, as described at
[https://cloud.google.com/docs/authentication/production] you get an error
"HttpAccessTokenRefreshError: invalid_scope: Empty or missing scope not
allowed."
This error occurs even if you fill in the scope field of the GCP connection.
The root cause is that scopes are ignored by the GCP hook when using
application default credentials. They should not be ignored when the default
credentials are using a service account. (And probably shouldn't be ignored at
all, preferring an error when scopes are filled in but don't apply to the
credential type)
I'll try to fix this while I'm working on
https://issues.apache.org/jira/projects/AIRFLOW/issues/AIRFLOW-2512.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
