Error Getting Access Token for Service Account

[ZonerDan]

Hello again,

I'm setting GOOGLE_APPLICATION_CREDENTIALS and I have the same file it is referencing set within configuration.conf for gcloud service-account-key-path. However, Im getting the following error:
"Exception in thread "main" com.google.cloud.bigquery.BigQueryException: Error getting access token for service account:"

I have admin permissions set on the only service account I have as admin for GCS and BigQuery.

[sderosiaux]

Hey,

Here it does not even try to validate the permission, it's failing before. It seems the client can't even contact Google to authenticate the token. Is it a transient error? if you try several times, do you always get the error? Is your key file a proper .json format (not P12) ?

[ZonerDan]

I’ve tried numerous times and always receive the error. I did not modify the key file after it was generated. All I did was place it on my server. I’ve copied the content into an online json validator which has confirmed the content is valid. The file extension is also .json. From: Stéphane Derosiaux [mailto:notifications@github.com] Sent: Tuesday, February 20, 2018 3:55 PM To: Powerspace/pg2bq <pg2bq@noreply.github.com> Cc: Hendrix, Daniel <Daniel.Hendrix@autozone.com>; Author <author@noreply.github.com> Subject: Re: [Powerspace/pg2bq] Error Getting Access Token for Service Account (#5) Hey, Here it does not even try to validate the permission, it's failing before. It seems the client can't even contact Google to authenticate the token. Is it a transient error? if you try several times, do you always get the error? Is your key file a proper .json format (not P12) ? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub<#5 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/Ai-DFcpXe67O6l7yZTJN1Q4pclhlv0ZMks5tWz8ygaJpZM4SMs5K>.

[sderosiaux]

All right.

Can you execute those commands and ensure it looks fine to you (particularly the key id should be the same you find in the .json you get, the project is good etc.)

$ gcloud iam service-accounts keys list --iam-account=<service>@<project>.iam.gserviceaccount.com
KEY_ID                                    CREATED_AT            EXPIRES_AT
...
$ gcloud iam service-accounts describe <service>@<project>.iam.gserviceaccount.com

Are you using an absolute path to refer to the file in your command ? (in GAC= and configuration.conf) ? Can you try export GOOGLE_APPLICATION_CREDENTIALS=/path/to/xxx.json then launch pg2bq ?

Not quite sure where to look, sorry. ;-)

[ZonerDan]

Only oddity I see is that list returns 4 keys and I only see one when viewing the service account in the Google Cloud Console. When attempting to delete any of the other 3 keys I get this error: ERROR: (gcloud.beta.iam.service-accounts.keys.delete) INVALID_ARGUMENT: Request contains an invalid argument. The syntax of my command matches what is documented at https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/keys/delete I havent found any posts or stackoverflow articles discussing this error.

[ZonerDan]

After multiple tweaks I now no longer receive the token related error but instead receive a new error: cloud.bigquery.BigQueryException: Connection refused or sometimes it shows the following:
aused by: com.google.api.client.googleapis.json.GoogleJsonResponseException: 401 Unauthorized
{
"code" : 401,
"errors" : [ {
"domain" : "global",
"location" : "Authorization",
"locationType" : "header",
"message" : "Login Required",
"reason" : "required"
} ],
"message" : "Login Required"
}