Commits on Oct 1, 2021

1. fix: ADC with impersonated workforce pools …

   While service account impersonation is uncommonly used with workforce
   pool external credentials, there is a bug where the following commands
   raise exceptions when impersonated workforce pools are used:
   
   - `google.auth.default()`
   - `google.auth.load_credentials_from_file()`
   
   The issue is due to `google.auth.aws.Credentials` not supporting the
   `workforce_pool_user_project` argument in the constructor, unlike
   `google.auth.identity_pool.Credentials`.
   
   This was indirectly passed here:
   https://github.com/googleapis/google-auth-library-python/blob/a37ff00d7afd6c7aac2d0fab29e05708bbc068be/google/auth/external_account.py#L395
   Causing a TypeError to be raised (we only catch ValueError).
   
   Updated the credential determination logic to explicitly check the
   subject token type. This is a more reliable indicator instead of a
   try/catch.
   
   Increased unit test coverage in tests/test__default.py to cover these
   credentials.

   

   bojeil-google committed Oct 1, 2021
   Configuration menu

   • View commit details
   • Copy full SHA for 59c081b
   • Browse repository at this point

   Copy the full SHA

   59c081b View commit details

   Browse the repository at this point in the history