Add Impersonated Service Account as a trusted type in application_default_credentials.json

Description

Currently, the #C implementation of Google Application Credentials only supports (from application_default_credentials.json file) the following types:

• authorized_user
• service_acccount
• external_account

In order to be aligned with other language implementation (eg. python, golang, etc.) it would be nice to add support to impersonated_service_account type.

Why?

Currently, if a developper want to act as a service account locally (without updating the code base), he needs to use a service account key which is a critical resource (see more below).

.

If the DefaultCredentialsProvider.cs supported this feature, it would be a perfect balance between usability & security.

[amanda-tarafa]

Any workaround to authenticate using a service account key that doesn’t involve setting environment variables?

@eyadmba I’m not sure how that question relates to this issue. I’ll reply here for simplicity, but if you have related follow up questions, please create a new issue.

You can use Google.Apis.Auth.OAuth2.GoogleCredential to create service account credentials from the service account key.

• FromFileAsync where you pass the path to a JSON file containing the service account key generated by Cloud Console.
• FromJson where you pass a string containing the JSON representation of the service account key generated by Cloud Console.
• FromStreamAsync where you pass a stream containing the JSON representatoin of the service account key generated by Cloud Console.

None of these require environment variables to be set. Again, if you have follow up questions do create a new issue.

[amanda-tarafa]

Yes, thanks for the request. We know this is a missing feature on the .NET Auth library and have been looking at prioritizing for a while now. I’ll leave this issue open and I’ll post progress here.