feat: allow scopes for self signed jwt (#776)
* feat: allow scopes for self signed jwt
* Update service_account.py
* add http changes
* Update google/auth/jwt.py
diff --git a/google/auth/jwt.py b/google/auth/jwt.py
index 892f3a8..e9f4f69 100644
--- a/google/auth/jwt.py
+++ b/google/auth/jwt.py
@@ -525,8 +525,9 @@
"sub": self._subject,
"iat": _helpers.datetime_to_secs(now),
"exp": _helpers.datetime_to_secs(expiry),
- "aud": self._audience,
}
+ if self._audience:
+ payload["aud"] = self._audience
payload.update(self._additional_claims)
diff --git a/google/auth/transport/grpc.py b/google/auth/transport/grpc.py
index 04c0f4f..c47cb3d 100644
--- a/google/auth/transport/grpc.py
+++ b/google/auth/transport/grpc.py
@@ -79,12 +79,9 @@
# Attempt to use self-signed JWTs when a service account is used.
# A default host must be explicitly provided since it cannot always
# be determined from the context.service_url.
- if (
- isinstance(self._credentials, service_account.Credentials)
- and self._default_host
- ):
+ if isinstance(self._credentials, service_account.Credentials):
self._credentials._create_self_signed_jwt(
- "https://{}/".format(self._default_host)
+ "https://{}/".format(self._default_host) if self._default_host else None
)
self._credentials.before_request(
diff --git a/google/auth/transport/requests.py b/google/auth/transport/requests.py
index d317544..a4784b3 100644
--- a/google/auth/transport/requests.py
+++ b/google/auth/transport/requests.py
@@ -358,13 +358,9 @@
# https://google.aip.dev/auth/4111
# Attempt to use self-signed JWTs when a service account is used.
- # A default host must be explicitly provided.
- if (
- isinstance(self.credentials, service_account.Credentials)
- and self._default_host
- ):
+ if isinstance(self.credentials, service_account.Credentials):
self.credentials._create_self_signed_jwt(
- "https://{}/".format(self._default_host)
+ "https://{}/".format(self._default_host) if self._default_host else None
)
def configure_mtls_channel(self, client_cert_callback=None):
diff --git a/google/auth/transport/urllib3.py b/google/auth/transport/urllib3.py
index aadd116..6a2504d 100644
--- a/google/auth/transport/urllib3.py
+++ b/google/auth/transport/urllib3.py
@@ -293,13 +293,9 @@
# https://google.aip.dev/auth/4111
# Attempt to use self-signed JWTs when a service account is used.
- # A default host must be explicitly provided.
- if (
- isinstance(self.credentials, service_account.Credentials)
- and self._default_host
- ):
+ if isinstance(self.credentials, service_account.Credentials):
self.credentials._create_self_signed_jwt(
- "https://{}/".format(self._default_host)
+ "https://{}/".format(self._default_host) if self._default_host else None
)
super(AuthorizedHttp, self).__init__()