Consider implementing OpenID Connect ID Token-based credentials for service accounts

[theacodes]

This would satisfy the Identity-aware Proxy use case as well as a few other niche cases that have come up.

Context:
https://gist.github.com/jonparrott/cffca2fa7881e03fbe6ff7c25773c9cf
https://github.com/GoogleCloudPlatform/python-docs-samples/blob/master/iap/make_iap_request.py#L121

/cc @matthewg

[theacodes]

I have no idea what to name this thing:

• google.oauth2.oidc.Credentials could work, but since this are specific to service accounts that seems weird.
• google.oauth2.service_account.IDTokenCredentials
• google.oauth2.service_account.OIDCCredentials makes me hurt.
• google.oauth2.openid_connect.ServiceAccountCredentials ew.
• google.oauth2.oidc.service_acccount.Credentials?

IDK. Thoughts @dhermes @lukesneeringer @matthewg?

[dhermes]

google.oauth2.service_account.IDTokenCredentials 👍

[theacodes]

/cc @tswast

[ensonic]

+1. This is right now not straightforward at all and is required for
https://cloud.google.com/endpoints/docs/openapi/service-to-service-auth#enabling_a_calling_service_to_make_authenticated_calls

[FranOis]

@jonparrott I'm not sure I understand all the consequences but I was playing around thinking open id would work and it seems like the only thing that needs to change is change from access_token to id_token in https://github.com/GoogleCloudPlatform/google-auth-library-python/blob/master/google/oauth2/_client.py#L147

Like I said, no idea what is the other uses of that class, but I did something very simple to get there. The credentials.json is for a service account in my project that is roles/servicemanagement.serviceConsumer

from google.oauth2 import service_account
from google.auth.transport.requests import AuthorizedSession

credentials = service_account.Credentials.from_service_account_file(
    'credentials.json')

scoped_credentials = credentials.with_scopes(
    ['http://URL_FOR_MY_CLOUD_ENDPOINTS'])

authed_session = AuthorizedSession(scoped_credentials)

response = authed_session.get('http://URL_FOR_MY_CLOUD_ENDPOINTS/hello')

print(response.json())

[theacodes]

@FranOis that's basically the gist of it. We'd just want a new credentials class to avoid messing with any of the existing ones.

[theacodes]

Closed by #234