fix: ADC with impersonated workforce pools (#877)
While service account impersonation is uncommonly used with workforce
pool external credentials, there is a bug where the following commands
raise exceptions when impersonated workforce pools are used:
- `google.auth.default()`
- `google.auth.load_credentials_from_file()`
The issue is due to `google.auth.aws.Credentials` not supporting the
`workforce_pool_user_project` argument in the constructor, unlike
`google.auth.identity_pool.Credentials`.
This was indirectly passed here:
https://github.com/googleapis/google-auth-library-python/blob/a37ff00d7afd6c7aac2d0fab29e05708bbc068be/google/auth/external_account.py#L395
Causing a TypeError to be raised (we only catch ValueError).
Updated the credential determination logic to explicitly check the
subject token type. This is a more reliable indicator instead of a
try/catch.
Increased unit test coverage in tests/test__default.py to cover these
credentials.
2 files changed
