Clarify the status of this project in Relationship to oauth2client,OAuthLib, google-auth

[kaliberto]

As of release 4.10, the oauth2client is being deprecated. The replacement tools, OAuthLib and google-auth both use newer HTTP libraries that are not supported by google-api-python-client. Is there a plan to update this project to support urllib3 or requests? Or is this functionality going to be rolled into google-cloud?

[theacodes]

This project supports google-auth through the supplementary library google-auth-httplib2. There are no plans to move this library to use anything other than httplib2, as it's pretty inextricably integrated into this library. Although @dhermes' work on google-resumable-media probably made the prospect significantly easier.

[kaliberto]

@jonparrott is there a reason why the isn't part of google-auth? The pypi page doesn't link to a readme that explains what the heck it is, it sends you to the main google-auth documents. I kept staring at the transports available in google-auth thinking I was an idiot, till I realized google-auth-httplib2 wasn't documented there.

Putting a deprecation notice on an authentication library, without some clear instructions on how the successor tools work together, is a little unfortunate. How many new developers are going to land on that page from a piece of Google API documentation and not understand the situation? It's a pretty similar situation to the gdata to google-api-python-client transition. I am not sure when GRPC will make the jump from Cloud Platform APIs to application APIs but when that happens it's liable to make things even less clear.

I get that no one is excited to write documentation but I think there's a reasonable expectation that prior to the deprecation notice going up, that at least hello world documentation on how to setup and integrate the new authentication approach would exist.

[theacodes]

@jonparrott is there a reason why the isn't part of google-auth?

Because long term we do not plan to support httplib2.

The pypi page doesn't link to a readme that explains what the heck it is

I'm working on fixing that, along with the documentation for google-auth-oauthlib.

without some clear instructions on how the successor tools work together, is a little unfortunate.

I hear you, but we can't afford to continue to mislead users by not marking an abandoned library as well, abandoned. This might seem a bit like the cart leading the horse, but oauth2client deprecation had to happen as an impetus for transitioning a lot of the documentation over.

We were very careful in this library in particular to support both oauth2client and google-auth so that no documentation is broken (well, no more than it already was). Although oauth2client is deprecated, we do anticipate some security releases will be made over the next year or so.

We're also working very hard (we being me and @vchudnov-g) to prepare a great story for non-Cloud APIs, specifically the user auth / 3LO story. We're iterating on that over at google-auth-oauthlib and would love to hear feedback. Once we've achieved our goal there of "one or zero line user auth" we'll get user-auth focused documentation updated.