update expiry timestamp parsing to use datetime.utcfromtimestamp

[devonsparks]

In the current build, credentials.expiry is populated with datetime.fromtimestamp, which returns a localized datetime. google.auth.credentials.Credentials.expired compares datetimes relative to UTC. As a result, depending on locale, it's possible to get a Credentials object whose expired property returns True immediately after creation, even if the access token its holds can be confirmed unexpired by Google's tokeninfo endpoint. Changing credentials.expiry to return a utc-normalized datetime fixes the problem.

[googlebot]

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please visit https://cla.developers.google.com/ to sign.

Once you've signed, please reply here (e.g. I signed it!) and we'll verify. Thanks.

---

• If you've already signed a CLA, it's possible we don't have your GitHub username or you're using a different email address. Check your existing CLA data and verify that your email is set on your git commits.
• If your company signed a CLA, they designated a Point of Contact who decides which employees are authorized to participate. You may need to contact the Point of Contact for your company and ask to be added to the group of authorized contributors. If you don't know who your Point of Contact is, direct the project maintainer to go/cla#troubleshoot.
• In order to pass this check, please resolve this problem and have the pull request author add another comment and the bot will run again.

[devonsparks]

I signed it!

…

On Sat, Dec 9, 2017 at 10:23 AM, googlebot ***@***.***> wrote: Thanks for your pull request. It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). 📝 *Please visit https://cla.developers.google.com/ <https://cla.developers.google.com/> to sign.* Once you've signed, please reply here (e.g. I signed it!) and we'll verify. Thanks. ------------------------------ - If you've already signed a CLA, it's possible we don't have your GitHub username or you're using a different email address. Check your existing CLA data <https://cla.developers.google.com/clas> and verify that your email is set on your git commits <https://help.github.com/articles/setting-your-email-in-git/>. - If your company signed a CLA, they designated a Point of Contact who decides which employees are authorized to participate. You may need to contact the Point of Contact for your company and ask to be added to the group of authorized contributors. If you don't know who your Point of Contact is, direct the project maintainer to go/cla#troubleshoot. - In order to pass this check, please resolve this problem and have the pull request author add another comment and the bot will run again. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#26 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AO4J-IXyXD6uR5mfFwjAor5Gg5pas14wks5s-tAIgaJpZM4Q8MQ9> .

[googlebot]

CLAs look good, thanks!

[theacodes]

Thanks, @devonsparks, great catch!

[jwmerrill]

Would it be possible to create a new release of this project? It would be very useful to have this fix in a release version.

[jwmerrill]

Leaving this here for the benefit of search engines:

RefreshError: The credentials do not contain the necessary fields need to refresh the access token. You must specify refresh_token, token_uri, client_id, and client_secret.

This error may occur if:

1. Your machine is configured with a non-utc timezone that is more than 1 hour behind utc
2. You request access_type='online' in your authorization_url, in which case you will not get a refresh token

In this case, when you attempt to make a request with your access token, version 0.2.0 of this library will immediately believe that the access token is expired because of the time zone mismatch.

The library's response to an expired access token is to attempt to obtain a new access token using a refresh token with the refresh method, and if you have not asked for a refresh token, you will get the error above. This may be confusing because it's not immediately clear why the library is attempting to refresh the access token you just obtained.

Until a new version of this library is released containing this fix, you can mitigate this issue by loading an unreleased version, e.g. by replacing

google-auth-oauthlib==0.2.0

with

git+git://github.com/GoogleCloudPlatform/google-auth-library-python-oauthlib.git@d6e922b8f816d4e2cc37455d94ae982ba19c541e#egg=google-auth-oauthlib

in a requirements file.

I suspect there might be a higher-than-usual number of devs hitting this issue currently during the process of switching away from the deprecated "plus" scopes.

[prseshad]

+1, I just found this problem myself and was about to open an issue. I convert the expiry after credentials creation as a workaround, but given that oauth2client is deprecated, it would surely benefit a lot of people to release this fix.

[corby]

+1. When will this be released?

[busunkim96]

Thank you all for your patience! I am working on a release right now. There should be a new release by the end of this week.

[busunkim96]

v0.3.0 is released and includes this fix.