identity sdk-j9九游会登录

场景介绍

identity sdk提供华为云身份认证服务的管理能力，支持工作负载身份、凭证提供者、访问令牌等管理功能。

原理优势

identityclient是身份认证服务的高级客户端。

文件位置：src/agentarts/sdk/services/identity/identity_client.py

from agentarts.sdk.service.identity import identityclient
client = identityclient(region="cn-southwest-2")

操作步骤

1. 创建工作负载身份。

   workload = client.create_workload_identity(
       name="my-workload",
       )
   print(f"urn: {workload.urn}")

2. 创建访问令牌。

   # 使用用户token创建
   token = client.create_workload_access_token(
       workload_name="my-workload",
       user_token="user-oauth-token"
   )
   # 使用用户id创建
   token = client.create_workload_access_token_for_user_id(
       workload_name="my-workload",
       user_id="user-123"
   )
   print(f"access token: {token}")

3. 配置凭证提供者管理。
   • api key凭证提供者

     provider = client.create_api_key_credential_provider(
         name="my-api-key-provider",
         api_key="your-api-key"
     )
     print(f"provider urn: {provider.urn}")

   • oauth2凭证提供者

     # github oauth2
     provider = client.create_oauth2_credential_provider(
         name="github-provider",
         vendor="githuboauth2",
         client_id="your-client-id",
         client_secret="your-client-secret"
     )
     # google oauth2
     provider = client.create_oauth2_credential_provider(
         name="google-provider",
         vendor="googleoauth2",
         client_id="your-client-id",
         client_secret="your-client-secret"
     )
     # microsoft oauth2
     provider = client.create_oauth2_credential_provider(
         name="microsoft-provider",
         vendor="microsoftoauth2",
         client_id="your-client-id",
         client_secret="your-client-secret"
     )

   • sts凭证提供者

     provider = client.create_sts_credential_provider(
         name="my-sts-provider",
         agency_urn="agency-urn:your-agency",
         tags=[{"key": "env", "value": "prod"}]
     )

4. 使用客户端进行凭证获取。
   • 获取oauth2 token

     token = client.get_resource_oauth2_token(
         provider_name="github-provider",
         scopes=["user:email", "read:user"],
         workload_access_token="agent-identity-token"
     )
     print(f"token: {token}")

   • 获取api key

     api_key = client.get_resource_api_key(
         provider_name="my-api-key-provider",
         workload_access_token="workload-token"
     )
     print(f"api key: {api_key}")

   • 获取sts token

     sts_token = client.get_resource_sts_token(
         provider_name="my-sts-provider",
         workload_access_token="workload-token",
         agency_session_name="session-name"
     )
     print(f"access key: {sts_token.access_key_id}")
     print(f"secret key: {sts_token.secret_access_key}")
     print(f"security token: {sts_token.security_token}")

5. 推荐使用装饰器来处理凭据生命周期。它们会自动将令牌或密钥注入到你的函数参数中。

   from typing import optional
   from agentarts.sdk import require_access_token, require_api_key, require_sts_token
   from agentarts.sdk.identity.types import stscredentials
   # oauth2 access token 注入 (异步)
   @require_access_token(
       provider_name="google",
       scopes=["https://www.googleapis.com/auth/userinfo.email"],
       auth_flow="user_federation"
   )
   async def fetch_google_data(access_token: optional[str] = none):
       print(f"using oauth2 token: {access_token}")
   # m2m access token 注入 (异步)
   @require_access_token(
       provider_name="my-company-api",
       auth_flow="m2m"
   )
   async def call_internal_service(access_token: optional[str] = none):
       print(f"using m2m oauth2 token: {access_token}")
   # api key 注入 (同步)
   @require_api_key(provider_name="openai")
   def call_llm(api_key: optional[str] = none):
       print(f"using api key: {api_key}")
   # sts token 注入
   @require_sts_token(provider_name="huaweicloud-iam", agency_session_name="example-session")
   async def access_huawei_resource(sts_credentials: optional[stscredentials] = none):
       # 直接访问 sdk 对象字段
       print(f"ak: {sts_credentials.access_key_id}")
       print(f"sk: {sts_credentials.secret_access_key}")
       print(f"securitytoken: {sts_credentials.security_token}")