Support for workload identity federation

We run on GCP and have several other parties that do not run on GCP and need to interact with our GCP infrastructure. We tend to use the Workload Identity Federation feature of GCP (see https://cloud.google.com/iam/docs/using-workload-identity-federation) to allow them access based on their AWS, Azure, or OIDC credentials. We love that feature as it removes the need to manage secrets.

However, it seems this identity federation is supported by most google client libraries, but not the dotnet one. Is it just a matter of me being unable to find this in the documentation? Otherwise, please consider this a feature request to add support for federated credentials.

See https://github.com/googleapis/google-auth-library-nodejs#workload-identity-federation for how Identity Federation is supported by the nodejs GCP clients. They use the new gcloud iam workload-identity-pools create-cred-config cli tool to create a json that can be used in the GOOGLE_APPLICATION_CREDENTIALS environment variable to have the client libraries automatically use identity federation. Perhaps this can be an inspiration on how to offer this in the dotnet eco system.

[amanda-tarafa]

Just as an update, I’ve made some advances, but it’s still going to be a couple of weeks before I’ve got a PR ready for review.

[amanda-tarafa]

@cudders I’m hoping that by the end of September we are in a good place for releasing, but that’s a soft commitment. I’m sorry it has taken so long, but as always, it’s a matter of some other priorities getting on the way.