Fetch ID Token for an External Account Credential (w/Impersonation)

[mrogg]

Problem

I want to retrieve an ID token for a Credential returned from google.auth.default(), specifically an aws.Credentials that is impersonating a Google Service Account.

Unfortunately, the most straightforward approach seems to be passing the private _impersonated_credentials of the underlying external_account.Credentials to google.auth.impersonated_credentials.IDTokenCredentials().

Potential Solutions

• Make the private _impersonated_credentials of the underlying external_account.Credentials a public property
• Add an id_token() method that makes the google.auth.impersonated_credentials.IDTokenCredentials() call with the private _impersonated_credentials.
• Add an external_account.IDTokenCredentials that takes an external_account.Credentials and does the necessary work to fetch an ID token it whatever way is most consistent with the rest of the google auth library.

Please let me know if I'm missing an existing simpler solution.