Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

auth: `impersonated_credentials` loses `subject` on copy, so `with_scopes()` and `with_quota_project()` turn off domain wide delegation

Abierto Apto para principiantes
  • ¿Algo no está bien?
#18,428 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

@Om-singhaI ya está trabajando en esto.

Desde el 20/9/2026.

  • #18429 de @Om-singhaI — abierto

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
88/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
python
Área
authentication

Línea de trabajo

Comienza en impersonated_credentials.Credentials._make_copy y compáralo con la implementación que conserva el subject en google/oauth2/service_account.py. Ejecuta la reproducción de main.py para observar los endpoints de las credenciales base y de las credenciales copiadas. Se considera terminado cuando las copias creadas con with_scopes(), with_quota_project() y with_trust_boundary() conservan el subject y utilizan el mismo flujo de delegación que la credencial base.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

auth priority: p2 type: bug
  • I determined this is the correct repository in which to report this bug.

Context

impersonated_credentials.Credentials takes a subject so it can act as a Workspace user through domain wide delegation. _make_copy rebuilds the credential without it, so with_scopes(), with_quota_project() and the deprecated with_trust_boundary() all hand back a copy whose subject is None. Deriving a narrower scoped credential from one base credential is the normal way to use this, and a quota project is common for Workspace APIs.

Nothing raises. The copy refreshes fine, it just authenticates as somebody else: it posts to :generateAccessToken instead of :signJwt plus the OAuth2 token endpoint, so the token belongs to the service account and not to the user. Whatever you call next runs as the service account instead of the user. The copy also starts building a Regional Access Boundary lookup URL again, which #17763 skips while a subject is set. google/oauth2/service_account.py carries the same subject field and its _make_copy does pass it on.

Expected Behavior: the copy keeps subject, the same way it keeps target_principal, target_scopes, delegates, lifetime, quota_project_id, iam_endpoint_override and trust_boundary.

Actual Behavior: subject is None on the copy, and the copy runs the plain service account impersonation flow.

API client name and version

google-auth 2.58.0, packages/google-auth on main at 47b2845.

Reproduction steps: code

file: main.py

import json

from google.auth import credentials as ga_credentials
from google.auth import impersonated_credentials


class FakeSource(ga_credentials.Credentials):
    """Stands in for the source credential so this runs without a key file."""

    def refresh(self, request):
        self.token = "source-token"


class FakeResponse:
    def __init__(self, data):
        self.status = 200
        self.data = json.dumps(data).encode("utf-8")


class FakeRequest:
    """Records the endpoints refresh() posts to."""

    def __init__(self):
        self.urls = []

    def __call__(self, url=None, method=None, headers=None, body=None, **kwargs):
        self.urls.append(url)
        if ":signJwt" in url:
            return FakeResponse({"signedJwt": "a.b.c"})
        if url.endswith("oauth2.googleapis.com/token"):
            return FakeResponse({"access_token": "user-token", "expires_in": 3600})
        return FakeResponse(
            {"accessToken": "sa-token", "expireTime": "2099-01-01T00:00:00Z"}
        )


base = impersonated_credentials.Credentials(
    source_credentials=FakeSource(),
    target_principal="[email protected]",
    target_scopes=["https://www.googleapis.com/auth/drive.readonly"],
    subject="[email protected]",
)
scoped = base.with_scopes(["https://www.googleapis.com/auth/drive.metadata.readonly"])

for label, cred in [("base", base), ("scoped", scoped)]:
    request = FakeRequest()
    cred.refresh(request)
    print("{} subject={!r}".format(label, cred._subject))
    for url in request.urls:
        print("  POST", url)

Reproduction steps: actual results

base subject='[email protected]'
  POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/[email protected]:signJwt
  POST https://oauth2.googleapis.com/token
scoped subject=None
  POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/[email protected]:generateAccessToken

Reproduction steps: expected results

scoped keeps the subject and makes the same two posts as base:

scoped subject='[email protected]'
  POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/[email protected]:signJwt
  POST https://oauth2.googleapis.com/token

OS & version + platform

macOS 26.6.2 on arm64

Python environment

Python 3.13.15

Lenguaje dominante
Python
Estrellas
5.4k
Forks
1.8k
Merge medio
2 d 11 h
PR fusionados (30 d)
129

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de googleapis/google-cloud-python

Todos los issues de googleapis/google-cloud-python

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.