Authentication using a service account file
Note
The article is being updated.
Below are examples of the code for authentication using a service account file in different YDB SDKs.
Go (native)
Go (database/sql)
Java
Node.js
Python
Python (asyncio)
C# (.NET)
PHP
package main
import (
"context"
"os"
"github.com/ydb-platform/ydb-go-sdk/v3"
yc "github.com/ydb-platform/ydb-go-yc"
)
func main() {
ctx, cancel := context.WithCancel(context.Background())
defer cancel()
db, err := ydb.Open(ctx,
os.Getenv("YDB_CONNECTION_STRING"),
yc.WithServiceAccountKeyFileCredentials(
os.Getenv("YDB_SERVICE_ACCOUNT_KEY_FILE_CREDENTIALS"),
),
yc.WithInternalCA(), // append Yandex Cloud certificates
)
if err != nil {
panic(err)
}
defer db.Close(ctx)
...
}
package main
import (
"context"
"database/sql"
"os"
"github.com/ydb-platform/ydb-go-sdk/v3"
yc "github.com/ydb-platform/ydb-go-yc"
)
func main() {
ctx, cancel := context.WithCancel(context.Background())
defer cancel()
nativeDriver, err := ydb.Open(ctx,
os.Getenv("YDB_CONNECTION_STRING"),
yc.WithServiceAccountKeyFileCredentials(
os.Getenv("YDB_SERVICE_ACCOUNT_KEY_FILE_CREDENTIALS"),
),
yc.WithInternalCA(), // append Yandex Cloud certificates
)
if err != nil {
panic(err)
}
defer nativeDriver.Close(ctx)
connector, err := ydb.Connector(nativeDriver)
if err != nil {
panic(err)
}
db := sql.OpenDB(connector)
defer db.Close()
...
}
public void work(String connectionString, String saKeyPath) {
AuthProvider authProvider = CloudAuthHelper.getServiceAccountFileAuthProvider(saKeyPath);
GrpcTransport transport = GrpcTransport.forConnectionString(connectionString)
.withAuthProvider(authProvider)
.build());
TableClient tableClient = TableClient.newClient(transport).build();
doWork(tableClient);
tableClient.close();
transport.close();
}
Loading service account data from a file:
import { Driver, getSACredentialsFromJson, IamAuthService } from 'ydb-sdk';
export async function connect(endpoint: string, database: string, serviceAccountFilename: string) {
const saCredentials = getSACredentialsFromJson(serviceAccountFilename);
const authService = new IamAuthService(saCredentials);
const driver = new Driver({endpoint, database, authService});
const timeout = 10000;
if (!await driver.ready(timeout)) {
console.log(`Driver has not become ready in ${timeout}ms!`);
process.exit(1);
}
console.log('Driver connected')
return driver
}
Loading service account data from a third-party source (for example, a secret storage):
import { Driver, IamAuthService } from 'ydb-sdk';
import { IIamCredentials } from 'ydb-sdk/build/cjs/src/credentials';
export async function connect(endpoint: string, database: string) {
const saCredentials: IIamCredentials = {
serviceAccountId: 'serviceAccountId',
accessKeyId: 'accessKeyId',
privateKey: Buffer.from('-----BEGIN PRIVATE KEY-----\nyJ1yFwJq...'),
iamEndpoint: 'iam.api.cloud.yandex.net:443',
};
const authService = new IamAuthService(saCredentials);
const driver = new Driver({endpoint, database, authService});
const timeout = 10000;
if (!await driver.ready(timeout)) {
console.log(`Driver has not become ready in ${timeout}ms!`);
process.exit(1);
}
console.log('Driver connected')
return driver
}
import os
import ydb
import ydb.iam
with ydb.Driver(
connection_string=os.environ["YDB_CONNECTION_STRING"],
# service account key should be in the local file,
# and SA_KEY_FILE environment variable should point to it
credentials=ydb.iam.ServiceAccountCredentials.from_file(os.environ["SA_KEY_FILE"]),
) as driver:
driver.wait(timeout=5)
...
import os
import asyncio
import ydb
import ydb.iam
async def ydb_init():
async with ydb.aio.Driver(
endpoint=os.environ["YDB_ENDPOINT"],
database=os.environ["YDB_DATABASE"],
# service account key should be in the local file,
# and SA_KEY_FILE environment variable should point to it
credentials=ydb.iam.ServiceAccountCredentials.from_file(os.environ["SA_KEY_FILE"]),
) as driver:
await driver.wait()
...
asyncio.run(ydb_init())
using Ydb.Sdk;
using Ydb.Sdk.Yc;
const string endpoint = "grpc://localhost:2136";
const string database = "/local";
var saProvider = new ServiceAccountProvider(
saFilePath: "path/to/sa_file.json" // Path to file with service account JSON info);
);
await saProvider.Initialize();
var config = new DriverConfig(
endpoint: endpoint,
database: database,
credentials: saProvider
);
await using var driver = await Driver.CreateInitialized(config);
<?php
use YdbPlatform\Ydb\Ydb;
use YdbPlatform\Ydb\Auth\JwtWithJsonAuthentication;
$config = [
'database' => '/ru-central1/b1glxxxxxxxxxxxxxxxx/etn0xxxxxxxxxxxxxxxx',
'endpoint' => 'ydb.serverless.yandexcloud.net:2135',
'discovery' => false,
'iam_config' => [
'temp_dir' => './tmp', // Temp directory
// 'root_cert_file' => './CA.pem', // Root CA file (uncomment for dedicated server)ы
],
'credentials' => new JwtWithJsonAuthentication('./jwtjson.json')
];
$ydb = new Ydb($config);
or
<?php
use YdbPlatform\Ydb\Ydb;
use YdbPlatform\Ydb\Auth\JwtWithPrivateKeyAuthentication;
$config = [
'database' => '/ru-central1/b1glxxxxxxxxxxxxxxxx/etn0xxxxxxxxxxxxxxxx',
'endpoint' => 'ydb.serverless.yandexcloud.net:2135',
'discovery' => false,
'iam_config' => [
'temp_dir' => './tmp', // Temp directory
// 'root_cert_file' => './CA.pem', // Root CA file (uncomment for dedicated server)
],
'credentials' => new JwtWithPrivateKeyAuthentication(
"ajexxxxxxxxx","ajeyyyyyyyyy",'./private.key')
];
$ydb = new Ydb($config);