fix: add back python 2.7 for gcloud usage only (#892)

* fix: add back python 2.7 for gcloud

* fix: fix setup and tests

* fix: add enum34 for python 2.7

* fix: add app engine app and fix noxfile

* fix: move test_app_engine.py

* fix: fix downscoped

* fix: fix downscoped

* fix: remove py2 from classifiers
diff --git a/tests/compute_engine/test__metadata.py b/tests/compute_engine/test__metadata.py
index 0bb07b0..852822d 100644
--- a/tests/compute_engine/test__metadata.py
+++ b/tests/compute_engine/test__metadata.py
@@ -13,13 +13,13 @@
 # limitations under the License.
 
 import datetime
-import http.client
-import importlib
 import json
 import os
 
 import mock
 import pytest
+from six.moves import http_client
+from six.moves import reload_module
 
 from google.auth import _helpers
 from google.auth import environment_vars
@@ -30,7 +30,7 @@
 PATH = "instance/service-accounts/default"
 
 
-def make_request(data, status=http.client.OK, headers=None, retry=False):
+def make_request(data, status=http_client.OK, headers=None, retry=False):
     response = mock.create_autospec(transport.Response, instance=True)
     response.status = status
     response.data = _helpers.to_bytes(data)
@@ -90,13 +90,13 @@
 
     fake_ip = "1.2.3.4"
     os.environ[environment_vars.GCE_METADATA_IP] = fake_ip
-    importlib.reload(_metadata)
+    reload_module(_metadata)
 
     try:
         assert _metadata.ping(request)
     finally:
         del os.environ[environment_vars.GCE_METADATA_IP]
-        importlib.reload(_metadata)
+        reload_module(_metadata)
 
     request.assert_called_once_with(
         method="GET",
@@ -203,13 +203,13 @@
 
     fake_root = "another.metadata.service"
     os.environ[environment_vars.GCE_METADATA_HOST] = fake_root
-    importlib.reload(_metadata)
+    reload_module(_metadata)
 
     try:
         _metadata.get(request, PATH)
     finally:
         del os.environ[environment_vars.GCE_METADATA_HOST]
-        importlib.reload(_metadata)
+        reload_module(_metadata)
 
     request.assert_called_once_with(
         method="GET",
@@ -223,13 +223,13 @@
 
     fake_root = "another.metadata.service"
     os.environ[environment_vars.GCE_METADATA_ROOT] = fake_root
-    importlib.reload(_metadata)
+    reload_module(_metadata)
 
     try:
         _metadata.get(request, PATH)
     finally:
         del os.environ[environment_vars.GCE_METADATA_ROOT]
-        importlib.reload(_metadata)
+        reload_module(_metadata)
 
     request.assert_called_once_with(
         method="GET",
@@ -239,7 +239,7 @@
 
 
 def test_get_failure():
-    request = make_request("Metadata error", status=http.client.NOT_FOUND)
+    request = make_request("Metadata error", status=http_client.NOT_FOUND)
 
     with pytest.raises(exceptions.TransportError) as excinfo:
         _metadata.get(request, PATH)
diff --git a/tests/crypt/test__cryptography_rsa.py b/tests/crypt/test__cryptography_rsa.py
index 41dfc36..dbf07c7 100644
--- a/tests/crypt/test__cryptography_rsa.py
+++ b/tests/crypt/test__cryptography_rsa.py
@@ -60,7 +60,7 @@
 
 
 class TestRSAVerifier(object):
-    def test_verify_bytes_success(self):
+    def test_verify_success(self):
         to_sign = b"foo"
         signer = _cryptography_rsa.RSASigner.from_string(PRIVATE_KEY_BYTES)
         actual_signature = signer.sign(to_sign)
@@ -68,8 +68,8 @@
         verifier = _cryptography_rsa.RSAVerifier.from_string(PUBLIC_KEY_BYTES)
         assert verifier.verify(to_sign, actual_signature)
 
-    def test_verify_text_success(self):
-        to_sign = "foo"
+    def test_verify_unicode_success(self):
+        to_sign = u"foo"
         signer = _cryptography_rsa.RSASigner.from_string(PRIVATE_KEY_BYTES)
         actual_signature = signer.sign(to_sign)
 
diff --git a/tests/crypt/test__python_rsa.py b/tests/crypt/test__python_rsa.py
index 9ef29ee..886ee55 100644
--- a/tests/crypt/test__python_rsa.py
+++ b/tests/crypt/test__python_rsa.py
@@ -12,7 +12,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-import io
 import json
 import os
 
@@ -20,6 +19,7 @@
 from pyasn1_modules import pem
 import pytest
 import rsa
+import six
 
 from google.auth import _helpers
 from google.auth.crypt import _python_rsa
@@ -63,7 +63,7 @@
 
 
 class TestRSAVerifier(object):
-    def test_verify_bytes_success(self):
+    def test_verify_success(self):
         to_sign = b"foo"
         signer = _python_rsa.RSASigner.from_string(PRIVATE_KEY_BYTES)
         actual_signature = signer.sign(to_sign)
@@ -71,8 +71,8 @@
         verifier = _python_rsa.RSAVerifier.from_string(PUBLIC_KEY_BYTES)
         assert verifier.verify(to_sign, actual_signature)
 
-    def test_verify_text_success(self):
-        to_sign = "foo"
+    def test_verify_unicode_success(self):
+        to_sign = u"foo"
         signer = _python_rsa.RSASigner.from_string(PRIVATE_KEY_BYTES)
         actual_signature = signer.sign(to_sign)
 
@@ -141,7 +141,7 @@
     def test_from_string_pkcs8_extra_bytes(self):
         key_bytes = PKCS8_KEY_BYTES
         _, pem_bytes = pem.readPemBlocksFromFile(
-            io.StringIO(_helpers.from_bytes(key_bytes)), _python_rsa._PKCS8_MARKER
+            six.StringIO(_helpers.from_bytes(key_bytes)), _python_rsa._PKCS8_MARKER
         )
 
         key_info, remaining = None, "extra"
diff --git a/tests/crypt/test_es256.py b/tests/crypt/test_es256.py
index 720f74c..5bb9050 100644
--- a/tests/crypt/test_es256.py
+++ b/tests/crypt/test_es256.py
@@ -50,7 +50,7 @@
 
 
 class TestES256Verifier(object):
-    def test_verify_bytes_success(self):
+    def test_verify_success(self):
         to_sign = b"foo"
         signer = es256.ES256Signer.from_string(PRIVATE_KEY_BYTES)
         actual_signature = signer.sign(to_sign)
@@ -58,8 +58,8 @@
         verifier = es256.ES256Verifier.from_string(PUBLIC_KEY_BYTES)
         assert verifier.verify(to_sign, actual_signature)
 
-    def test_verify_text_success(self):
-        to_sign = "foo"
+    def test_verify_unicode_success(self):
+        to_sign = u"foo"
         signer = es256.ES256Signer.from_string(PRIVATE_KEY_BYTES)
         actual_signature = signer.sign(to_sign)
 
diff --git a/tests/oauth2/test__client.py b/tests/oauth2/test__client.py
index 690a87b..54686df 100644
--- a/tests/oauth2/test__client.py
+++ b/tests/oauth2/test__client.py
@@ -13,13 +13,14 @@
 # limitations under the License.
 
 import datetime
-import http.client
 import json
 import os
-import urllib
 
 import mock
 import pytest
+import six
+from six.moves import http_client
+from six.moves import urllib
 
 from google.auth import _helpers
 from google.auth import crypt
@@ -74,7 +75,7 @@
     assert _client._parse_expiry({}) is None
 
 
-def make_request(response_data, status=http.client.OK):
+def make_request(response_data, status=http_client.OK):
     response = mock.create_autospec(transport.Response, instance=True)
     response.status = status
     response.data = json.dumps(response_data).encode("utf-8")
@@ -129,7 +130,7 @@
 
 
 def test__token_endpoint_request_error():
-    request = make_request({}, status=http.client.BAD_REQUEST)
+    request = make_request({}, status=http_client.BAD_REQUEST)
 
     with pytest.raises(exceptions.RefreshError):
         _client._token_endpoint_request(request, "http://example.com", {})
@@ -137,7 +138,7 @@
 
 def test__token_endpoint_request_internal_failure_error():
     request = make_request(
-        {"error_description": "internal_failure"}, status=http.client.BAD_REQUEST
+        {"error_description": "internal_failure"}, status=http_client.BAD_REQUEST
     )
 
     with pytest.raises(exceptions.RefreshError):
@@ -146,7 +147,7 @@
         )
 
     request = make_request(
-        {"error": "internal_failure"}, status=http.client.BAD_REQUEST
+        {"error": "internal_failure"}, status=http_client.BAD_REQUEST
     )
 
     with pytest.raises(exceptions.RefreshError):
@@ -159,7 +160,7 @@
     request_body = request.call_args[1]["body"].decode("utf-8")
     request_params = urllib.parse.parse_qs(request_body)
 
-    for key, value in params.items():
+    for key, value in six.iteritems(params):
         assert request_params[key][0] == value
 
 
diff --git a/tests/oauth2/test_sts.py b/tests/oauth2/test_sts.py
index b516c8a..e8e008d 100644
--- a/tests/oauth2/test_sts.py
+++ b/tests/oauth2/test_sts.py
@@ -12,12 +12,12 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-import http.client
 import json
-import urllib
 
 import mock
 import pytest
+from six.moves import http_client
+from six.moves import urllib
 
 from google.auth import exceptions
 from google.auth import transport
@@ -67,7 +67,7 @@
         return sts.Client(cls.TOKEN_EXCHANGE_ENDPOINT, client_auth)
 
     @classmethod
-    def make_mock_request(cls, data, status=http.client.OK):
+    def make_mock_request(cls, data, status=http_client.OK):
         response = mock.create_autospec(transport.Response, instance=True)
         response.status = status
         response.data = json.dumps(data).encode("utf-8")
@@ -110,7 +110,7 @@
             "options": urllib.parse.quote(json.dumps(self.ADDON_OPTIONS)),
         }
         request = self.make_mock_request(
-            status=http.client.OK, data=self.SUCCESS_RESPONSE
+            status=http_client.OK, data=self.SUCCESS_RESPONSE
         )
 
         response = client.exchange_token(
@@ -145,7 +145,7 @@
             "subject_token_type": self.SUBJECT_TOKEN_TYPE,
         }
         request = self.make_mock_request(
-            status=http.client.OK, data=self.SUCCESS_RESPONSE
+            status=http_client.OK, data=self.SUCCESS_RESPONSE
         )
 
         response = client.exchange_token(
@@ -165,7 +165,7 @@
         """
         client = self.make_client()
         request = self.make_mock_request(
-            status=http.client.BAD_REQUEST, data=self.ERROR_RESPONSE
+            status=http_client.BAD_REQUEST, data=self.ERROR_RESPONSE
         )
 
         with pytest.raises(exceptions.OAuthError) as excinfo:
@@ -209,7 +209,7 @@
             "options": urllib.parse.quote(json.dumps(self.ADDON_OPTIONS)),
         }
         request = self.make_mock_request(
-            status=http.client.OK, data=self.SUCCESS_RESPONSE
+            status=http_client.OK, data=self.SUCCESS_RESPONSE
         )
 
         response = client.exchange_token(
@@ -247,7 +247,7 @@
             "subject_token_type": self.SUBJECT_TOKEN_TYPE,
         }
         request = self.make_mock_request(
-            status=http.client.OK, data=self.SUCCESS_RESPONSE
+            status=http_client.OK, data=self.SUCCESS_RESPONSE
         )
 
         response = client.exchange_token(
@@ -268,7 +268,7 @@
         """
         client = self.make_client(self.CLIENT_AUTH_BASIC)
         request = self.make_mock_request(
-            status=http.client.BAD_REQUEST, data=self.ERROR_RESPONSE
+            status=http_client.BAD_REQUEST, data=self.ERROR_RESPONSE
         )
 
         with pytest.raises(exceptions.OAuthError) as excinfo:
@@ -313,7 +313,7 @@
             "client_secret": CLIENT_SECRET,
         }
         request = self.make_mock_request(
-            status=http.client.OK, data=self.SUCCESS_RESPONSE
+            status=http_client.OK, data=self.SUCCESS_RESPONSE
         )
 
         response = client.exchange_token(
@@ -350,7 +350,7 @@
             "client_secret": CLIENT_SECRET,
         }
         request = self.make_mock_request(
-            status=http.client.OK, data=self.SUCCESS_RESPONSE
+            status=http_client.OK, data=self.SUCCESS_RESPONSE
         )
 
         response = client.exchange_token(
@@ -371,7 +371,7 @@
         """
         client = self.make_client(self.CLIENT_AUTH_REQUEST_BODY)
         request = self.make_mock_request(
-            status=http.client.BAD_REQUEST, data=self.ERROR_RESPONSE
+            status=http_client.BAD_REQUEST, data=self.ERROR_RESPONSE
         )
 
         with pytest.raises(exceptions.OAuthError) as excinfo:
diff --git a/tests/test__helpers.py b/tests/test__helpers.py
index 906cf12..0c0bad2 100644
--- a/tests/test__helpers.py
+++ b/tests/test__helpers.py
@@ -13,9 +13,9 @@
 # limitations under the License.
 
 import datetime
-import urllib
 
 import pytest
+from six.moves import urllib
 
 from google.auth import _helpers
 
@@ -65,8 +65,8 @@
     assert _helpers.to_bytes(value) == value
 
 
-def test_to_bytes_with_text():
-    value = "string-val"
+def test_to_bytes_with_unicode():
+    value = u"string-val"
     encoded_value = b"string-val"
     assert _helpers.to_bytes(value) == encoded_value
 
@@ -76,14 +76,14 @@
         _helpers.to_bytes(object())
 
 
-def test_from_bytes_with_text():
-    value = "bytes-val"
+def test_from_bytes_with_unicode():
+    value = u"bytes-val"
     assert _helpers.from_bytes(value) == value
 
 
 def test_from_bytes_with_bytes():
     value = b"string-val"
-    decoded_value = "string-val"
+    decoded_value = u"string-val"
     assert _helpers.from_bytes(value) == decoded_value
 
 
diff --git a/tests/test__oauth2client.py b/tests/test__oauth2client.py
index aa06ece..6b1112b 100644
--- a/tests/test__oauth2client.py
+++ b/tests/test__oauth2client.py
@@ -13,7 +13,6 @@
 # limitations under the License.
 
 import datetime
-import importlib
 import os
 import sys
 
@@ -22,6 +21,7 @@
 import oauth2client.contrib.gce
 import oauth2client.service_account
 import pytest
+from six.moves import reload_module
 
 from google.auth import _oauth2client
 
@@ -152,19 +152,19 @@
 @pytest.fixture
 def reset__oauth2client_module():
     """Reloads the _oauth2client module after a test."""
-    importlib.reload(_oauth2client)
+    reload_module(_oauth2client)
 
 
 def test_import_has_app_engine(
     mock_oauth2client_gae_imports, reset__oauth2client_module
 ):
-    importlib.reload(_oauth2client)
+    reload_module(_oauth2client)
     assert _oauth2client._HAS_APPENGINE
 
 
 def test_import_without_oauth2client(monkeypatch, reset__oauth2client_module):
     monkeypatch.setitem(sys.modules, "oauth2client", None)
     with pytest.raises(ImportError) as excinfo:
-        importlib.reload(_oauth2client)
+        reload_module(_oauth2client)
 
     assert excinfo.match("oauth2client")
diff --git a/tests/test__service_account_info.py b/tests/test__service_account_info.py
index fd2d8c8..13b2f85 100644
--- a/tests/test__service_account_info.py
+++ b/tests/test__service_account_info.py
@@ -16,6 +16,7 @@
 import os
 
 import pytest
+import six
 
 from google.auth import _service_account_info
 from google.auth import crypt
@@ -54,7 +55,7 @@
 def test_from_filename():
     info, signer = _service_account_info.from_filename(SERVICE_ACCOUNT_JSON_FILE)
 
-    for key, value in SERVICE_ACCOUNT_INFO.items():
+    for key, value in six.iteritems(SERVICE_ACCOUNT_INFO):
         assert info[key] == value
 
     assert isinstance(signer, crypt.RSASigner)
diff --git a/tests/test_aws.py b/tests/test_aws.py
index 8659437..9ca08d5 100644
--- a/tests/test_aws.py
+++ b/tests/test_aws.py
@@ -13,12 +13,12 @@
 # limitations under the License.
 
 import datetime
-import http.client
 import json
-import urllib
 
 import mock
 import pytest
+from six.moves import http_client
+from six.moves import urllib
 
 from google.auth import _helpers
 from google.auth import aws
@@ -952,11 +952,11 @@
             self.AWS_SIGNATURE_TIME, "%Y-%m-%dT%H:%M:%SZ"
         )
         request = self.make_mock_request(
-            region_status=http.client.OK,
+            region_status=http_client.OK,
             region_name=self.AWS_REGION,
-            role_status=http.client.OK,
+            role_status=http_client.OK,
             role_name=self.AWS_ROLE,
-            security_credentials_status=http.client.OK,
+            security_credentials_status=http_client.OK,
             security_credentials_data=self.AWS_SECURITY_CREDENTIALS_RESPONSE,
         )
         credentials = self.make_credentials(credential_source=self.CREDENTIAL_SOURCE)
@@ -987,9 +987,9 @@
 
         # Retrieve subject_token again. Region should not be queried again.
         new_request = self.make_mock_request(
-            role_status=http.client.OK,
+            role_status=http_client.OK,
             role_name=self.AWS_ROLE,
-            security_credentials_status=http.client.OK,
+            security_credentials_status=http_client.OK,
             security_credentials_data=self.AWS_SECURITY_CREDENTIALS_RESPONSE,
         )
 
@@ -1020,11 +1020,11 @@
             self.AWS_SIGNATURE_TIME, "%Y-%m-%dT%H:%M:%SZ"
         )
         request = self.make_mock_request(
-            region_status=http.client.OK,
+            region_status=http_client.OK,
             region_name=self.AWS_REGION,
-            role_status=http.client.OK,
+            role_status=http_client.OK,
             role_name=self.AWS_ROLE,
-            security_credentials_status=http.client.OK,
+            security_credentials_status=http_client.OK,
             security_credentials_data=security_creds_response,
         )
         credentials = self.make_credentials(credential_source=self.CREDENTIAL_SOURCE)
@@ -1136,7 +1136,7 @@
         )
         # Region will be queried since it is not found in envvars.
         request = self.make_mock_request(
-            region_status=http.client.OK, region_name=self.AWS_REGION
+            region_status=http_client.OK, region_name=self.AWS_REGION
         )
         credentials = self.make_credentials(credential_source=self.CREDENTIAL_SOURCE)
 
@@ -1152,7 +1152,7 @@
 
     def test_retrieve_subject_token_error_determining_aws_region(self):
         # Simulate error in retrieving the AWS region.
-        request = self.make_mock_request(region_status=http.client.BAD_REQUEST)
+        request = self.make_mock_request(region_status=http_client.BAD_REQUEST)
         credentials = self.make_credentials(credential_source=self.CREDENTIAL_SOURCE)
 
         with pytest.raises(exceptions.RefreshError) as excinfo:
@@ -1163,9 +1163,9 @@
     def test_retrieve_subject_token_error_determining_aws_role(self):
         # Simulate error in retrieving the AWS role name.
         request = self.make_mock_request(
-            region_status=http.client.OK,
+            region_status=http_client.OK,
             region_name=self.AWS_REGION,
-            role_status=http.client.BAD_REQUEST,
+            role_status=http_client.BAD_REQUEST,
         )
         credentials = self.make_credentials(credential_source=self.CREDENTIAL_SOURCE)
 
@@ -1180,7 +1180,7 @@
         credential_source = self.CREDENTIAL_SOURCE.copy()
         credential_source.pop("url")
         request = self.make_mock_request(
-            region_status=http.client.OK, region_name=self.AWS_REGION
+            region_status=http_client.OK, region_name=self.AWS_REGION
         )
         credentials = self.make_credentials(credential_source=credential_source)
 
@@ -1194,11 +1194,11 @@
     def test_retrieve_subject_token_error_determining_aws_security_creds(self):
         # Simulate error in retrieving the AWS security credentials.
         request = self.make_mock_request(
-            region_status=http.client.OK,
+            region_status=http_client.OK,
             region_name=self.AWS_REGION,
-            role_status=http.client.OK,
+            role_status=http_client.OK,
             role_name=self.AWS_ROLE,
-            security_credentials_status=http.client.BAD_REQUEST,
+            security_credentials_status=http_client.BAD_REQUEST,
         )
         credentials = self.make_credentials(credential_source=self.CREDENTIAL_SOURCE)
 
@@ -1232,13 +1232,13 @@
             "subject_token_type": SUBJECT_TOKEN_TYPE,
         }
         request = self.make_mock_request(
-            region_status=http.client.OK,
+            region_status=http_client.OK,
             region_name=self.AWS_REGION,
-            role_status=http.client.OK,
+            role_status=http_client.OK,
             role_name=self.AWS_ROLE,
-            security_credentials_status=http.client.OK,
+            security_credentials_status=http_client.OK,
             security_credentials_data=self.AWS_SECURITY_CREDENTIALS_RESPONSE,
-            token_status=http.client.OK,
+            token_status=http_client.OK,
             token_data=self.SUCCESS_RESPONSE,
         )
         credentials = self.make_credentials(
@@ -1288,13 +1288,13 @@
             "subject_token_type": SUBJECT_TOKEN_TYPE,
         }
         request = self.make_mock_request(
-            region_status=http.client.OK,
+            region_status=http_client.OK,
             region_name=self.AWS_REGION,
-            role_status=http.client.OK,
+            role_status=http_client.OK,
             role_name=self.AWS_ROLE,
-            security_credentials_status=http.client.OK,
+            security_credentials_status=http_client.OK,
             security_credentials_data=self.AWS_SECURITY_CREDENTIALS_RESPONSE,
-            token_status=http.client.OK,
+            token_status=http_client.OK,
             token_data=self.SUCCESS_RESPONSE,
         )
         credentials = self.make_credentials(
@@ -1362,15 +1362,15 @@
             "lifetime": "3600s",
         }
         request = self.make_mock_request(
-            region_status=http.client.OK,
+            region_status=http_client.OK,
             region_name=self.AWS_REGION,
-            role_status=http.client.OK,
+            role_status=http_client.OK,
             role_name=self.AWS_ROLE,
-            security_credentials_status=http.client.OK,
+            security_credentials_status=http_client.OK,
             security_credentials_data=self.AWS_SECURITY_CREDENTIALS_RESPONSE,
-            token_status=http.client.OK,
+            token_status=http_client.OK,
             token_data=self.SUCCESS_RESPONSE,
-            impersonation_status=http.client.OK,
+            impersonation_status=http_client.OK,
             impersonation_data=impersonation_response,
         )
         credentials = self.make_credentials(
@@ -1446,15 +1446,15 @@
             "lifetime": "3600s",
         }
         request = self.make_mock_request(
-            region_status=http.client.OK,
+            region_status=http_client.OK,
             region_name=self.AWS_REGION,
-            role_status=http.client.OK,
+            role_status=http_client.OK,
             role_name=self.AWS_ROLE,
-            security_credentials_status=http.client.OK,
+            security_credentials_status=http_client.OK,
             security_credentials_data=self.AWS_SECURITY_CREDENTIALS_RESPONSE,
-            token_status=http.client.OK,
+            token_status=http_client.OK,
             token_data=self.SUCCESS_RESPONSE,
-            impersonation_status=http.client.OK,
+            impersonation_status=http_client.OK,
             impersonation_data=impersonation_response,
         )
         credentials = self.make_credentials(
@@ -1488,7 +1488,7 @@
         assert credentials.default_scopes == SCOPES
 
     def test_refresh_with_retrieve_subject_token_error(self):
-        request = self.make_mock_request(region_status=http.client.BAD_REQUEST)
+        request = self.make_mock_request(region_status=http_client.BAD_REQUEST)
         credentials = self.make_credentials(credential_source=self.CREDENTIAL_SOURCE)
 
         with pytest.raises(exceptions.RefreshError) as excinfo:
diff --git a/tests/test_downscoped.py b/tests/test_downscoped.py
index a686391..9ca95f5 100644
--- a/tests/test_downscoped.py
+++ b/tests/test_downscoped.py
@@ -13,12 +13,12 @@
 # limitations under the License.
 
 import datetime
-import http.client
 import json
-import urllib
 
 import mock
 import pytest
+from six.moves import http_client
+from six.moves import urllib
 
 from google.auth import _helpers
 from google.auth import credentials
@@ -461,7 +461,7 @@
         )
 
     @staticmethod
-    def make_mock_request(data, status=http.client.OK):
+    def make_mock_request(data, status=http_client.OK):
         response = mock.create_autospec(transport.Response, instance=True)
         response.status = status
         response.data = json.dumps(data).encode("utf-8")
@@ -521,7 +521,7 @@
             "requested_token_type": REQUESTED_TOKEN_TYPE,
             "options": urllib.parse.quote(json.dumps(CREDENTIAL_ACCESS_BOUNDARY_JSON)),
         }
-        request = self.make_mock_request(status=http.client.OK, data=response)
+        request = self.make_mock_request(status=http_client.OK, data=response)
         source_credentials = SourceCredentials()
         credentials = self.make_credentials(source_credentials=source_credentials)
 
@@ -563,7 +563,7 @@
             "requested_token_type": REQUESTED_TOKEN_TYPE,
             "options": urllib.parse.quote(json.dumps(CREDENTIAL_ACCESS_BOUNDARY_JSON)),
         }
-        request = self.make_mock_request(status=http.client.OK, data=response)
+        request = self.make_mock_request(status=http_client.OK, data=response)
         credentials = self.make_credentials(source_credentials=source_credentials)
 
         # Spy on calls to source credentials refresh to confirm the expected request
@@ -583,7 +583,7 @@
 
     def test_refresh_token_exchange_error(self):
         request = self.make_mock_request(
-            status=http.client.BAD_REQUEST, data=ERROR_RESPONSE
+            status=http_client.BAD_REQUEST, data=ERROR_RESPONSE
         )
         credentials = self.make_credentials()
 
@@ -612,7 +612,7 @@
 
     def test_apply_without_quota_project_id(self):
         headers = {}
-        request = self.make_mock_request(status=http.client.OK, data=SUCCESS_RESPONSE)
+        request = self.make_mock_request(status=http_client.OK, data=SUCCESS_RESPONSE)
         credentials = self.make_credentials()
 
         credentials.refresh(request)
@@ -624,7 +624,7 @@
 
     def test_apply_with_quota_project_id(self):
         headers = {"other": "header-value"}
-        request = self.make_mock_request(status=http.client.OK, data=SUCCESS_RESPONSE)
+        request = self.make_mock_request(status=http_client.OK, data=SUCCESS_RESPONSE)
         credentials = self.make_credentials(quota_project_id=QUOTA_PROJECT_ID)
 
         credentials.refresh(request)
@@ -638,7 +638,7 @@
 
     def test_before_request(self):
         headers = {"other": "header-value"}
-        request = self.make_mock_request(status=http.client.OK, data=SUCCESS_RESPONSE)
+        request = self.make_mock_request(status=http_client.OK, data=SUCCESS_RESPONSE)
         credentials = self.make_credentials()
 
         # First call should call refresh, setting the token.
@@ -662,7 +662,7 @@
     @mock.patch("google.auth._helpers.utcnow")
     def test_before_request_expired(self, utcnow):
         headers = {}
-        request = self.make_mock_request(status=http.client.OK, data=SUCCESS_RESPONSE)
+        request = self.make_mock_request(status=http_client.OK, data=SUCCESS_RESPONSE)
         credentials = self.make_credentials()
         credentials.token = "token"
         utcnow.return_value = datetime.datetime.min
diff --git a/tests/test_external_account.py b/tests/test_external_account.py
index 97f1564..3c34f99 100644
--- a/tests/test_external_account.py
+++ b/tests/test_external_account.py
@@ -13,12 +13,12 @@
 # limitations under the License.
 
 import datetime
-import http.client
 import json
-import urllib
 
 import mock
 import pytest
+from six.moves import http_client
+from six.moves import urllib
 
 from google.auth import _helpers
 from google.auth import exceptions
@@ -208,7 +208,7 @@
     @classmethod
     def make_mock_request(
         cls,
-        status=http.client.OK,
+        status=http_client.OK,
         data=None,
         impersonation_status=None,
         impersonation_data=None,
@@ -605,7 +605,7 @@
             "subject_token": "subject_token_0",
             "subject_token_type": self.SUBJECT_TOKEN_TYPE,
         }
-        request = self.make_mock_request(status=http.client.OK, data=response)
+        request = self.make_mock_request(status=http_client.OK, data=response)
         credentials = self.make_credentials()
 
         credentials.refresh(request)
@@ -635,7 +635,7 @@
                 json.dumps({"userProject": self.WORKFORCE_POOL_USER_PROJECT})
             ),
         }
-        request = self.make_mock_request(status=http.client.OK, data=response)
+        request = self.make_mock_request(status=http_client.OK, data=response)
         credentials = self.make_workforce_pool_credentials(
             workforce_pool_user_project=self.WORKFORCE_POOL_USER_PROJECT
         )
@@ -667,7 +667,7 @@
             "subject_token": "subject_token_0",
             "subject_token_type": self.WORKFORCE_SUBJECT_TOKEN_TYPE,
         }
-        request = self.make_mock_request(status=http.client.OK, data=response)
+        request = self.make_mock_request(status=http_client.OK, data=response)
         # Client Auth will have higher priority over workforce_pool_user_project.
         credentials = self.make_workforce_pool_credentials(
             client_id=CLIENT_ID,
@@ -704,7 +704,7 @@
             "subject_token": "subject_token_0",
             "subject_token_type": self.WORKFORCE_SUBJECT_TOKEN_TYPE,
         }
-        request = self.make_mock_request(status=http.client.OK, data=response)
+        request = self.make_mock_request(status=http_client.OK, data=response)
         # Client Auth will be sufficient for user project determination.
         credentials = self.make_workforce_pool_credentials(
             client_id=CLIENT_ID,
@@ -754,9 +754,9 @@
         # Initialize mock request to handle token exchange and service account
         # impersonation request.
         request = self.make_mock_request(
-            status=http.client.OK,
+            status=http_client.OK,
             data=token_response,
-            impersonation_status=http.client.OK,
+            impersonation_status=http_client.OK,
             impersonation_data=impersonation_response,
         )
         # Initialize credentials with service account impersonation.
@@ -821,9 +821,9 @@
         # Initialize mock request to handle token exchange and service account
         # impersonation request.
         request = self.make_mock_request(
-            status=http.client.OK,
+            status=http_client.OK,
             data=token_response,
-            impersonation_status=http.client.OK,
+            impersonation_status=http_client.OK,
             impersonation_data=impersonation_response,
         )
         # Initialize credentials with service account impersonation.
@@ -865,7 +865,7 @@
             "subject_token_type": self.SUBJECT_TOKEN_TYPE,
         }
         request = self.make_mock_request(
-            status=http.client.OK, data=self.SUCCESS_RESPONSE
+            status=http_client.OK, data=self.SUCCESS_RESPONSE
         )
         credentials = self.make_credentials(
             scopes=["scope1", "scope2"],
@@ -893,7 +893,7 @@
             "subject_token_type": self.SUBJECT_TOKEN_TYPE,
         }
         request = self.make_mock_request(
-            status=http.client.OK, data=self.SUCCESS_RESPONSE
+            status=http_client.OK, data=self.SUCCESS_RESPONSE
         )
         credentials = self.make_credentials(
             scopes=None,
@@ -911,7 +911,7 @@
 
     def test_refresh_without_client_auth_error(self):
         request = self.make_mock_request(
-            status=http.client.BAD_REQUEST, data=self.ERROR_RESPONSE
+            status=http_client.BAD_REQUEST, data=self.ERROR_RESPONSE
         )
         credentials = self.make_credentials()
 
@@ -926,9 +926,9 @@
 
     def test_refresh_impersonation_without_client_auth_error(self):
         request = self.make_mock_request(
-            status=http.client.OK,
+            status=http_client.OK,
             data=self.SUCCESS_RESPONSE,
-            impersonation_status=http.client.BAD_REQUEST,
+            impersonation_status=http_client.BAD_REQUEST,
             impersonation_data=self.IMPERSONATION_ERROR_RESPONSE,
         )
         credentials = self.make_credentials(
@@ -956,7 +956,7 @@
             "subject_token_type": self.SUBJECT_TOKEN_TYPE,
         }
         request = self.make_mock_request(
-            status=http.client.OK, data=self.SUCCESS_RESPONSE
+            status=http_client.OK, data=self.SUCCESS_RESPONSE
         )
         credentials = self.make_credentials(
             client_id=CLIENT_ID, client_secret=CLIENT_SECRET
@@ -1006,9 +1006,9 @@
         # Initialize mock request to handle token exchange and service account
         # impersonation request.
         request = self.make_mock_request(
-            status=http.client.OK,
+            status=http_client.OK,
             data=token_response,
-            impersonation_status=http.client.OK,
+            impersonation_status=http_client.OK,
             impersonation_data=impersonation_response,
         )
         # Initialize credentials with service account impersonation and basic auth.
@@ -1077,9 +1077,9 @@
         # Initialize mock request to handle token exchange and service account
         # impersonation request.
         request = self.make_mock_request(
-            status=http.client.OK,
+            status=http_client.OK,
             data=token_response,
-            impersonation_status=http.client.OK,
+            impersonation_status=http_client.OK,
             impersonation_data=impersonation_response,
         )
         # Initialize credentials with service account impersonation and basic auth.
@@ -1114,7 +1114,7 @@
     def test_apply_without_quota_project_id(self):
         headers = {}
         request = self.make_mock_request(
-            status=http.client.OK, data=self.SUCCESS_RESPONSE
+            status=http_client.OK, data=self.SUCCESS_RESPONSE
         )
         credentials = self.make_credentials()
 
@@ -1128,7 +1128,7 @@
     def test_apply_workforce_without_quota_project_id(self):
         headers = {}
         request = self.make_mock_request(
-            status=http.client.OK, data=self.SUCCESS_RESPONSE
+            status=http_client.OK, data=self.SUCCESS_RESPONSE
         )
         credentials = self.make_workforce_pool_credentials(
             workforce_pool_user_project=self.WORKFORCE_POOL_USER_PROJECT
@@ -1153,9 +1153,9 @@
         # Initialize mock request to handle token exchange and service account
         # impersonation request.
         request = self.make_mock_request(
-            status=http.client.OK,
+            status=http_client.OK,
             data=self.SUCCESS_RESPONSE.copy(),
-            impersonation_status=http.client.OK,
+            impersonation_status=http_client.OK,
             impersonation_data=impersonation_response,
         )
         # Initialize credentials with service account impersonation.
@@ -1175,7 +1175,7 @@
     def test_apply_with_quota_project_id(self):
         headers = {"other": "header-value"}
         request = self.make_mock_request(
-            status=http.client.OK, data=self.SUCCESS_RESPONSE
+            status=http_client.OK, data=self.SUCCESS_RESPONSE
         )
         credentials = self.make_credentials(quota_project_id=self.QUOTA_PROJECT_ID)
 
@@ -1200,9 +1200,9 @@
         # Initialize mock request to handle token exchange and service account
         # impersonation request.
         request = self.make_mock_request(
-            status=http.client.OK,
+            status=http_client.OK,
             data=self.SUCCESS_RESPONSE.copy(),
-            impersonation_status=http.client.OK,
+            impersonation_status=http_client.OK,
             impersonation_data=impersonation_response,
         )
         # Initialize credentials with service account impersonation.
@@ -1225,7 +1225,7 @@
     def test_before_request(self):
         headers = {"other": "header-value"}
         request = self.make_mock_request(
-            status=http.client.OK, data=self.SUCCESS_RESPONSE
+            status=http_client.OK, data=self.SUCCESS_RESPONSE
         )
         credentials = self.make_credentials()
 
@@ -1248,7 +1248,7 @@
     def test_before_request_workforce(self):
         headers = {"other": "header-value"}
         request = self.make_mock_request(
-            status=http.client.OK, data=self.SUCCESS_RESPONSE
+            status=http_client.OK, data=self.SUCCESS_RESPONSE
         )
         credentials = self.make_workforce_pool_credentials(
             workforce_pool_user_project=self.WORKFORCE_POOL_USER_PROJECT
@@ -1282,9 +1282,9 @@
         # Initialize mock request to handle token exchange and service account
         # impersonation request.
         request = self.make_mock_request(
-            status=http.client.OK,
+            status=http_client.OK,
             data=self.SUCCESS_RESPONSE.copy(),
-            impersonation_status=http.client.OK,
+            impersonation_status=http_client.OK,
             impersonation_data=impersonation_response,
         )
         headers = {"other": "header-value"}
@@ -1312,7 +1312,7 @@
     def test_before_request_expired(self, utcnow):
         headers = {}
         request = self.make_mock_request(
-            status=http.client.OK, data=self.SUCCESS_RESPONSE
+            status=http_client.OK, data=self.SUCCESS_RESPONSE
         )
         credentials = self.make_credentials()
         credentials.token = "token"
@@ -1360,9 +1360,9 @@
         # Initialize mock request to handle token exchange and service account
         # impersonation request.
         request = self.make_mock_request(
-            status=http.client.OK,
+            status=http_client.OK,
             data=self.SUCCESS_RESPONSE.copy(),
-            impersonation_status=http.client.OK,
+            impersonation_status=http_client.OK,
             impersonation_data=impersonation_response,
         )
         credentials = self.make_credentials(
@@ -1491,11 +1491,11 @@
         # Initialize mock request to handle token exchange, service account
         # impersonation and cloud resource manager request.
         request = self.make_mock_request(
-            status=http.client.OK,
+            status=http_client.OK,
             data=self.SUCCESS_RESPONSE.copy(),
-            impersonation_status=http.client.OK,
+            impersonation_status=http_client.OK,
             impersonation_data=impersonation_response,
-            cloud_resource_manager_status=http.client.OK,
+            cloud_resource_manager_status=http_client.OK,
             cloud_resource_manager_data=self.CLOUD_RESOURCE_MANAGER_SUCCESS_RESPONSE,
         )
         credentials = self.make_credentials(
@@ -1562,9 +1562,9 @@
         # Initialize mock request to handle token exchange and cloud resource
         # manager request.
         request = self.make_mock_request(
-            status=http.client.OK,
+            status=http_client.OK,
             data=self.SUCCESS_RESPONSE.copy(),
-            cloud_resource_manager_status=http.client.OK,
+            cloud_resource_manager_status=http_client.OK,
             cloud_resource_manager_data=self.CLOUD_RESOURCE_MANAGER_SUCCESS_RESPONSE,
         )
         credentials = self.make_workforce_pool_credentials(
@@ -1611,9 +1611,9 @@
         # Simulate resource doesn't have sufficient permissions to access
         # cloud resource manager.
         request = self.make_mock_request(
-            status=http.client.OK,
+            status=http_client.OK,
             data=self.SUCCESS_RESPONSE.copy(),
-            cloud_resource_manager_status=http.client.UNAUTHORIZED,
+            cloud_resource_manager_status=http_client.UNAUTHORIZED,
         )
         credentials = self.make_credentials(scopes=self.SCOPES)
 
diff --git a/tests/test_iam.py b/tests/test_iam.py
index e9eca58..bc71225 100644
--- a/tests/test_iam.py
+++ b/tests/test_iam.py
@@ -14,11 +14,11 @@
 
 import base64
 import datetime
-import http.client
 import json
 
 import mock
 import pytest
+from six.moves import http_client
 
 from google.auth import _helpers
 from google.auth import exceptions
@@ -81,7 +81,7 @@
     def test_sign_bytes(self):
         signature = b"DEADBEEF"
         encoded_signature = base64.b64encode(signature).decode("utf-8")
-        request = make_request(http.client.OK, data={"signedBlob": encoded_signature})
+        request = make_request(http_client.OK, data={"signedBlob": encoded_signature})
         credentials = make_credentials()
 
         signer = iam.Signer(request, credentials, mock.sentinel.service_account_email)
@@ -93,7 +93,7 @@
         assert kwargs["headers"]["Content-Type"] == "application/json"
 
     def test_sign_bytes_failure(self):
-        request = make_request(http.client.UNAUTHORIZED)
+        request = make_request(http_client.UNAUTHORIZED)
         credentials = make_credentials()
 
         signer = iam.Signer(request, credentials, mock.sentinel.service_account_email)
diff --git a/tests/test_identity_pool.py b/tests/test_identity_pool.py
index e90e288..87e343b 100644
--- a/tests/test_identity_pool.py
+++ b/tests/test_identity_pool.py
@@ -13,13 +13,13 @@
 # limitations under the License.
 
 import datetime
-import http.client
 import json
 import os
-import urllib
 
 import mock
 import pytest
+from six.moves import http_client
+from six.moves import urllib
 
 from google.auth import _helpers
 from google.auth import exceptions
@@ -92,7 +92,7 @@
 
     @classmethod
     def make_mock_request(
-        cls, token_status=http.client.OK, token_data=None, *extra_requests
+        cls, token_status=http_client.OK, token_data=None, *extra_requests
     ):
         responses = []
         responses.append(cls.make_mock_response(token_status, token_data))
@@ -218,14 +218,14 @@
         # service account impersonation request.
         requests = []
         if credential_data:
-            requests.append((http.client.OK, credential_data))
+            requests.append((http_client.OK, credential_data))
 
         token_request_index = len(requests)
-        requests.append((http.client.OK, token_response))
+        requests.append((http_client.OK, token_response))
 
         if service_account_impersonation_url:
             impersonation_request_index = len(requests)
-            requests.append((http.client.OK, impersonation_response))
+            requests.append((http_client.OK, impersonation_response))
 
         request = cls.make_mock_request(*[el for req in requests for el in req])
 
diff --git a/tests/test_impersonated_credentials.py b/tests/test_impersonated_credentials.py
index 3dbb6ca..bceaeba 100644
--- a/tests/test_impersonated_credentials.py
+++ b/tests/test_impersonated_credentials.py
@@ -13,12 +13,12 @@
 # limitations under the License.
 
 import datetime
-import http.client
 import json
 import os
 
 import mock
 import pytest
+from six.moves import http_client
 
 from google.auth import _helpers
 from google.auth import crypt
@@ -79,7 +79,7 @@
         "google.auth.transport.requests.AuthorizedSession.request", autospec=True
     ) as auth_session:
         data = {"keyId": "1", "signedBlob": "c2lnbmF0dXJl"}
-        auth_session.return_value = MockResponse(data, http.client.OK)
+        auth_session.return_value = MockResponse(data, http_client.OK)
         yield auth_session
 
 
@@ -89,7 +89,7 @@
         "google.auth.transport.requests.AuthorizedSession.request", autospec=True
     ) as auth_session:
         data = {"token": ID_TOKEN_DATA}
-        auth_session.return_value = MockResponse(data, http.client.OK)
+        auth_session.return_value = MockResponse(data, http_client.OK)
         yield auth_session
 
 
@@ -141,7 +141,7 @@
     def make_request(
         self,
         data,
-        status=http.client.OK,
+        status=http_client.OK,
         headers=None,
         side_effect=None,
         use_data_bytes=True,
@@ -169,7 +169,7 @@
 
         request = self.make_request(
             data=json.dumps(response_body),
-            status=http.client.OK,
+            status=http_client.OK,
             use_data_bytes=use_data_bytes,
         )
 
@@ -194,7 +194,7 @@
 
         request = self.make_request(
             data=json.dumps(response_body),
-            status=http.client.OK,
+            status=http_client.OK,
             use_data_bytes=use_data_bytes,
         )
 
@@ -229,7 +229,7 @@
             ).isoformat("T") + "Z"
             response_body = {"accessToken": "token", "expireTime": expire_time}
             request = self.make_request(
-                data=json.dumps(response_body), status=http.client.OK
+                data=json.dumps(response_body), status=http_client.OK
             )
 
             credentials.refresh(request)
@@ -254,7 +254,7 @@
         response_body = {"accessToken": token, "expireTime": expire_time}
 
         request = self.make_request(
-            data=json.dumps(response_body), status=http.client.OK
+            data=json.dumps(response_body), status=http_client.OK
         )
 
         with pytest.raises(exceptions.RefreshError) as excinfo:
@@ -277,7 +277,7 @@
         }
 
         request = self.make_request(
-            data=json.dumps(response_body), status=http.client.UNAUTHORIZED
+            data=json.dumps(response_body), status=http_client.UNAUTHORIZED
         )
 
         with pytest.raises(exceptions.RefreshError) as excinfo:
@@ -294,7 +294,7 @@
         response_body = {}
 
         request = self.make_request(
-            data=json.dumps(response_body), status=http.client.HTTPException
+            data=json.dumps(response_body), status=http_client.HTTPException
         )
 
         with pytest.raises(exceptions.RefreshError) as excinfo:
@@ -331,7 +331,7 @@
         token_response_body = {"accessToken": token, "expireTime": expire_time}
 
         response = mock.create_autospec(transport.Response, instance=False)
-        response.status = http.client.OK
+        response.status = http_client.OK
         response.data = _helpers.to_bytes(json.dumps(token_response_body))
 
         request = mock.create_autospec(transport.Request, instance=False)
@@ -369,7 +369,7 @@
 
         request = self.make_request(
             data=json.dumps(response_body),
-            status=http.client.OK,
+            status=http_client.OK,
             use_data_bytes=use_data_bytes,
         )
 
@@ -394,7 +394,7 @@
         response_body = {"accessToken": token, "expireTime": expire_time}
 
         request = self.make_request(
-            data=json.dumps(response_body), status=http.client.OK
+            data=json.dumps(response_body), status=http_client.OK
         )
 
         credentials.refresh(request)
@@ -423,7 +423,7 @@
         response_body = {"accessToken": token, "expireTime": expire_time}
 
         request = self.make_request(
-            data=json.dumps(response_body), status=http.client.OK
+            data=json.dumps(response_body), status=http_client.OK
         )
 
         credentials.refresh(request)
@@ -453,7 +453,7 @@
         response_body = {"accessToken": token, "expireTime": expire_time}
 
         request = self.make_request(
-            data=json.dumps(response_body), status=http.client.OK
+            data=json.dumps(response_body), status=http_client.OK
         )
 
         credentials.refresh(request)
@@ -494,7 +494,7 @@
         response_body = {"accessToken": token, "expireTime": expire_time}
 
         request = self.make_request(
-            data=json.dumps(response_body), status=http.client.OK
+            data=json.dumps(response_body), status=http_client.OK
         )
 
         credentials.refresh(request)
@@ -523,7 +523,7 @@
         response_body = {"accessToken": token, "expireTime": expire_time}
 
         request = self.make_request(
-            data=json.dumps(response_body), status=http.client.OK
+            data=json.dumps(response_body), status=http_client.OK
         )
 
         credentials.refresh(request)
diff --git a/tests/test_jwt.py b/tests/test_jwt.py
index ba7277c..c0e1184 100644
--- a/tests/test_jwt.py
+++ b/tests/test_jwt.py
@@ -288,9 +288,9 @@
 
 
 def test_decode_unknown_alg():
-    headers = json.dumps({"kid": "1", "alg": "fakealg"})
+    headers = json.dumps({u"kid": u"1", u"alg": u"fakealg"})
     token = b".".join(
-        map(lambda seg: base64.b64encode(seg.encode("utf-8")), [headers, "{}", "sig"])
+        map(lambda seg: base64.b64encode(seg.encode("utf-8")), [headers, u"{}", u"sig"])
     )
 
     with pytest.raises(ValueError) as excinfo:
@@ -300,9 +300,9 @@
 
 def test_decode_missing_crytography_alg(monkeypatch):
     monkeypatch.delitem(jwt._ALGORITHM_TO_VERIFIER_CLASS, "ES256")
-    headers = json.dumps({"kid": "1", "alg": "ES256"})
+    headers = json.dumps({u"kid": u"1", u"alg": u"ES256"})
     token = b".".join(
-        map(lambda seg: base64.b64encode(seg.encode("utf-8")), [headers, "{}", "sig"])
+        map(lambda seg: base64.b64encode(seg.encode("utf-8")), [headers, u"{}", u"sig"])
     )
 
     with pytest.raises(ValueError) as excinfo:
diff --git a/tests/transport/compliance.py b/tests/transport/compliance.py
index a5cb678..e093d76 100644
--- a/tests/transport/compliance.py
+++ b/tests/transport/compliance.py
@@ -12,12 +12,12 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-import http.client
 import time
 
 import flask
 import pytest
 from pytest_localserver.http import WSGIServer
+from six.moves import http_client
 
 from google.auth import exceptions
 
@@ -43,11 +43,11 @@
         def index():
             header_value = flask.request.headers.get("x-test-header", "value")
             headers = {"X-Test-Header": header_value}
-            return "Basic Content", http.client.OK, headers
+            return "Basic Content", http_client.OK, headers
 
         @app.route("/server_error")
         def server_error():
-            return "Error", http.client.INTERNAL_SERVER_ERROR
+            return "Error", http_client.INTERNAL_SERVER_ERROR
 
         @app.route("/wait")
         def wait():
@@ -65,7 +65,7 @@
         request = self.make_request()
         response = request(url=server.url + "/basic", method="GET")
 
-        assert response.status == http.client.OK
+        assert response.status == http_client.OK
         assert response.headers["x-test-header"] == "value"
         assert response.data == b"Basic Content"
 
@@ -73,7 +73,7 @@
         request = self.make_request()
         response = request(url=server.url + "/basic", method="GET", timeout=2)
 
-        assert response.status == http.client.OK
+        assert response.status == http_client.OK
         assert response.headers["x-test-header"] == "value"
         assert response.data == b"Basic Content"
 
@@ -91,7 +91,7 @@
             headers={"x-test-header": "hello world"},
         )
 
-        assert response.status == http.client.OK
+        assert response.status == http_client.OK
         assert response.headers["x-test-header"] == "hello world"
         assert response.data == b"Basic Content"
 
@@ -99,7 +99,7 @@
         request = self.make_request()
         response = request(url=server.url + "/server_error", method="GET")
 
-        assert response.status == http.client.INTERNAL_SERVER_ERROR
+        assert response.status == http_client.INTERNAL_SERVER_ERROR
         assert response.data == b"Error"
 
     def test_connection_error(self):
diff --git a/tests/transport/test_requests.py b/tests/transport/test_requests.py
index 8b57e0b..ed9300d 100644
--- a/tests/transport/test_requests.py
+++ b/tests/transport/test_requests.py
@@ -14,7 +14,6 @@
 
 import datetime
 import functools
-import http.client
 import os
 import sys
 
@@ -24,6 +23,7 @@
 import pytest
 import requests
 import requests.adapters
+from six.moves import http_client
 
 from google.auth import environment_vars
 from google.auth import exceptions
@@ -188,7 +188,7 @@
             )
 
 
-def make_response(status=http.client.OK, data=None):
+def make_response(status=http_client.OK, data=None):
     response = requests.Response()
     response.status_code = status
     response._content = data
@@ -249,10 +249,10 @@
 
     def test_request_refresh(self):
         credentials = mock.Mock(wraps=CredentialsStub())
-        final_response = make_response(status=http.client.OK)
+        final_response = make_response(status=http_client.OK)
         # First request will 401, second request will succeed.
         adapter = AdapterStub(
-            [make_response(status=http.client.UNAUTHORIZED), final_response]
+            [make_response(status=http_client.UNAUTHORIZED), final_response]
         )
 
         authed_session = google.auth.transport.requests.AuthorizedSession(
@@ -282,7 +282,7 @@
             wraps=TimeTickCredentialsStub(time_tick=tick_one_second)
         )
         adapter = TimeTickAdapterStub(
-            time_tick=tick_one_second, responses=[make_response(status=http.client.OK)]
+            time_tick=tick_one_second, responses=[make_response(status=http_client.OK)]
         )
 
         authed_session = google.auth.transport.requests.AuthorizedSession(credentials)
@@ -304,8 +304,8 @@
         adapter = TimeTickAdapterStub(
             time_tick=tick_one_second,
             responses=[
-                make_response(status=http.client.UNAUTHORIZED),
-                make_response(status=http.client.OK),
+                make_response(status=http_client.UNAUTHORIZED),
+                make_response(status=http_client.OK),
             ],
         )
 
@@ -328,8 +328,8 @@
         adapter = TimeTickAdapterStub(
             time_tick=tick_one_second,
             responses=[
-                make_response(status=http.client.UNAUTHORIZED),
-                make_response(status=http.client.OK),
+                make_response(status=http_client.UNAUTHORIZED),
+                make_response(status=http_client.OK),
             ],
         )
 
@@ -355,8 +355,8 @@
         adapter = TimeTickAdapterStub(
             time_tick=tick_one_second,
             responses=[
-                make_response(status=http.client.UNAUTHORIZED),
-                make_response(status=http.client.OK),
+                make_response(status=http_client.UNAUTHORIZED),
+                make_response(status=http_client.OK),
             ],
         )
 
diff --git a/tests/transport/test_urllib3.py b/tests/transport/test_urllib3.py
index 995d3dc..e3848c1 100644
--- a/tests/transport/test_urllib3.py
+++ b/tests/transport/test_urllib3.py
@@ -12,13 +12,13 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-import http.client
 import os
 import sys
 
 import mock
 import OpenSSL
 import pytest
+from six.moves import http_client
 import urllib3
 
 from google.auth import environment_vars
@@ -84,7 +84,7 @@
 
 
 class ResponseStub(object):
-    def __init__(self, status=http.client.OK, data=None):
+    def __init__(self, status=http_client.OK, data=None):
         self.status = status
         self.data = data
 
@@ -141,12 +141,12 @@
 
     def test_urlopen_refresh(self):
         credentials = mock.Mock(wraps=CredentialsStub())
-        final_response = ResponseStub(status=http.client.OK)
+        final_response = ResponseStub(status=http_client.OK)
         # First request will 401, second request will succeed.
-        stub = HttpStub([ResponseStub(status=http.client.UNAUTHORIZED), final_response])
+        http = HttpStub([ResponseStub(status=http_client.UNAUTHORIZED), final_response])
 
         authed_http = google.auth.transport.urllib3.AuthorizedHttp(
-            credentials, http=stub
+            credentials, http=http
         )
 
         authed_http = authed_http.urlopen("GET", "http://example.com")
@@ -154,7 +154,7 @@
         assert authed_http == final_response
         assert credentials.before_request.call_count == 2
         assert credentials.refresh.called
-        assert stub.requests == [
+        assert http.requests == [
             ("GET", self.TEST_URL, None, {"authorization": "token"}, {}),
             ("GET", self.TEST_URL, None, {"authorization": "token1"}, {}),
         ]