Authentication Issue with Google Vertex AI API

[olivebess]

We are encountering authentication issues while trying to access the Google Vertex AI API.

Below are the steps we have taken in our production environment and the corresponding issue.We have verified the service account roles, key file integrity, and environment variable configurations but are unable to resolve the issue. We would appreciate your guidance on resolving this problem

Steps Undertaken:

1. Service Account Creation and Configuration:

• Service Account with JSON Key: We created a service account and generated a JSON key in the production environment by navigating to "IAM & Admin" > "Service Accounts" > "CREATE SERVICE ACCOUNT".
• Role Configuration: We assigned the following roles to the service account:
  • Editor
  • Owner
  • AI Platform Notebooks Service Agent
  • Colab Enterprise Admin
  • Colab Enterprise User
  • Notebook Runtime Admin
  • Notebook Runtime User
  • Service Account Token Creator
  • Vertex AI Administrator
  • Vertex AI Custom Code Service Agent
  • Vertex AI Service Agent
  • Vertex AI User
  • Vertex AI Viewer
• Key Generation: We created a new key for the service account by selecting JSON as the key type and downloaded the JSON file locally from the service account key management page.

2. Local Testing with a Spring Boot Project:

• Maven Dependencies: We included the following Maven dependencies in our project:
  xml

  <dependency>
  <groupId>com.google.cloud</groupId>
  <artifactId>google-cloud-vertexai</artifactId>
  <version>0.1.0</version>
  </dependency>
  <dependency>
  <groupId>com.google.cloud</groupId>
  <artifactId>google-cloud-aiplatform</artifactId>
  <version>3.33.0</version>
  </dependency>
  
• Environment Variable Configuration:
  • In PowerShell: $env:GOOGLE_APPLICATION_CREDENTIALS="xxxxx.json"
  • In IDEA: Configured GOOGLE_APPLICATION_CREDENTIALS in the startup configurations to the same path.
• Test Code Implementation: We implemented the following test code:
  • Retrieved the GOOGLE_APPLICATION_CREDENTIALS environment variable.
  • Initialized VertexAI with our project ID and location, and configured GenerationConfig and GenerativeModel with the model name and parameters.
  • Created a list of contents with messages and attempted to generate content stream using the model, printing out the responses.

Issue Encountered:

During the API call, we received the following error:

• Error Message: UNAUTHENTICATED: Request had invalid authentication credentials. Expected OAuth 2 access token, login cookie, or other valid authentication credentials.

[nceniza]

Can you try making another Json Key ? (Or an SA) for troubleshooting.  Also can you try logging in with the gcloud command: 

gcloud auth application-default login

[rishabh-malik]

works, thanks 

[olivebess]

We attempted to introduce new json keys, yet encountered the same problems. Logging in with gcloud auth application-default login proceeds without issues, but we continue to receive the same error message.

[ArnoldTurdean]

I have the same problem. We assigned the following roles to the service account:

• Vertex AI Administrator
• Vertex AI User

Do we need to assign any other or what are we doing wrong ?

[lurumad]

Did you resolve the issue? I have the same problem

[Marçal]

I have the same problem, any news?

[ArnoldTurdean]

Actually I did.

In my case (at least) the problem was that the scopes were not specified during the GoogleCredential initialization.

This is how it looks like in my case:

@Lazy

@Bean

GoogleCredentials googleCredentials() throws IOException {

return GoogleCredentials.fromStream(new ClassPathResource(this.config.getCredential().getPath()).getInputStream())

.createScoped("https://www.googleapis.com/auth/cloud-platform", "https://www.googleapis.com/auth/cloud-platform.read-only");

}

I hope this will help to you as well.

[Mounim_IA_Exper]

Hello , 
I had the same problem as you .

I resolved it as following : 

run the following command (either on gcp (the website) cloud shell or on your local cloud shell) and then you will have a json to download , once downloaded , replace "account" field by any of your services account and make in it all the needed permissions for you use of vertexAI.

And boom it's done :D, don't hesitate to reach me by mail if you need any details "(PII Removed by Staff)".

best,

gcloud auth application-default login