idtoken: NewValidator broken after #738

[codyoss]

(ds.DefaultAudience != "" || len(ds.Audiences) > 0)

The above change appears to be the faulting change.

Using cloud.google.com/go v0.72.0 + google.golang.org/api v0.35.0 works. Upgrading either with 1 minor version causes runtime errors.

Reproducing code:

opt := option.WithCredentialsFile("path/to/svc-acc.json")
validator, err := idtoken.NewValidator(ctx, opt)
validator.Validate(ctx, "some-token", "some-audience")

The fault happens during idtoken.NewValidator, where the self-signing JWT token source is not set, due to the changes in this PR. There is no error returned from running NewValidator. When running validator.Validate, an error occurs during the roundtrip when retrieving the certificates from google.

Originally posted by @bendiknesbo in #738 (comment)

[codyoss]

@bendiknesbo Do you have a use case for needing an authenticated client for these validation requests? If you don't pass in that option I think your code will still work, would you mind trying that?

[codyoss]

If you are not passing WithHTTPClient just calling the function Validate might work just as well for your use case.

[codyoss]

It is not expected that you use a validated client with this function. If you have a valid use case for this please let me know and we can discuss more. It is true our client has become more restrictive about when to use self-signed JWTs but this is correct as an audience, default or user set, should be provided when using this feature. It was a bug that this worked before. Closing as by design.