x-goog-user-project header has gone in second request

[hideto0710]

Environment details

• OS: macOS BigSur 11.1
• Node.js version: v14.15.3
• npm version: 6.14.10
• google-auth-library version: 6.1.4

Steps to reproduce

1. gcloud auth application-default set-quota-project MY_PROJECT_ID

export const authTest = async () => {
  const auth = new GoogleAuth();
  const client = await auth.getClient();
  const headersFirst = await client.getRequestHeaders();
  console.log(headersFirst);
  const headersSecond = await client.getRequestHeaders();
  console.log(headersSecond);
}
authTest();

{
  Authorization: 'Bearer xxxx',
  'x-goog-user-project': 'MY_PROJECT_ID'
}
{
  Authorization: 'Bearer xxxx'
}

As a result, I got the following error in second request.

    7 PERMISSION_DENIED: Your application has authenticated using end user credentials from the Google Cloud SDK or Google Cloud Shell which are not supported by the datacatalog.googleapis.com. We recommend configuring the billing/quota_project setting in gcloud or using a service account through the auth/impersonate_service_account setting. For more information about service accounts and how to use them in your application, see https://cloud.google.com/docs/authentication/.

Any help would be appreciated.

[sofisl]

Hi @hideto0710,

Do you have a service account that you could use to test out this solution? If not, you can login to your console through APIs & Services>Credentials>Create Credentials>Service Account.

Then, instead of running gcloud auth application-default set-quota-project MY_PROJECT_ID, try the following:

1. gcloud auth activate-service-account <service-account-email> --key-file=<path-to-JSON> where the service account email can be found in the JSON file for your service account credentials, and the path to your JSON file is just the path to wherever you downloaded your service account credentials.
2. gcloud config set account <your-project-name>

Then give your code a try!

[hideto0710]

Thanks for your reply!

Do you have a service account that you could use to test out this solution?

Yes, for now I use service account credential.
But I want to use end user ADC because I am developing CLI tool, and downloading service account credential per user is insecure I think.

Python SDK supports quota_project_id option. Also golang SDK.
Is there any way to configure quota project explicitly?

[hideto0710]

I think we have to call addSharedMetadataHeaders when isTokenExpiring is false.
hideto0710@699282f

I will try to write some tests.