[google-auth-library-java] Generating ID token with ImpersonatedCredentials does not support overriding quota project #12604

Activity

1. TimurSadykov

   assigned

   lsirac

   and

   TimurSadykov

   and unassigned

   lsirac

   on Aug 11, 2022
2. TimurSadykov

   added

   help wantedWe'd love to have community involvement on this issue.We'd love to have community involvement on this issue.

   type: bugError or flaw in code with unintended results or allowing sub-optimal usage patterns.Error or flaw in code with unintended results or allowing sub-optimal usage patterns.

   priority: p2Moderately-important priority. Fix may not be included in next release.Moderately-important priority. Fix may not be included in next release.

   on Aug 16, 2022
3. TimurSadykov commented on Aug 30, 2023

   

   TimurSadykov

   on Aug 30, 2023

   More actions

   @sai-sunder-s what do you think?
4. lqiu96

   added

   type: feature request‘Nice-to-have’ improvement, new feature or different behavior or design.‘Nice-to-have’ improvement, new feature or different behavior or design.

   priority: p3Desirable enhancement or fix. May not be included in next release.Desirable enhancement or fix. May not be included in next release.

   and removed

   type: bugError or flaw in code with unintended results or allowing sub-optimal usage patterns.Error or flaw in code with unintended results or allowing sub-optimal usage patterns.

   priority: p2Moderately-important priority. Fix may not be included in next release.Moderately-important priority. Fix may not be included in next release.

   on Jan 22, 2025
5. ABHISHEK0S1INGH commented on Nov 2, 2025

   

   ABHISHEK0S1INGH

   on Nov 2, 2025

   More actions

   Can You please assign this is me?
6. chingor13

   changed the title [-]Generating ID token with ImpersonatedCredentials does not support overriding quota project[/-] [+][google-auth-library-java] Generating ID token with ImpersonatedCredentials does not support overriding quota project[/+] on Apr 1, 2026
7. chingor13

   transferred this issue fromgoogleapis/google-auth-library-javaon Apr 1, 2026
8. lqiu96 commented on Oct 7, 2026

   

   lqiu96

   on Oct 7, 2026

   Member

   More actions

   Apologies, this slipped from our backlog. I took a quick look at this.

   The generateIdToken endpoint itself doesn't take in a quotaProjectId field in the request body (and IIUC, passing it via additionalFields would not work): https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/generateIdToken

   Quota Project Id is set via the x-goog-user-project header. generateIdToken is called using sourceCredentials, to use a different quota project ID for the generateIdToken RPC and I believe you would need to set the quota project ID on sourceCredentials (e.g. sourceCredentials.createWithQuotaProject(...)), not on ImpersonatedCredentials itself. The quotaProjectId on ImpersonatedCredential is used for downstream API requests made as the impersonated principal.

   As I understand, the flow for idTokenWithAudience is:

   1. IamUtils.getIdToken is called with sourceCredentials
   2. Builds a request with sourceCredentials: HttpCredentialsAdapter adapter = new HttpCredentialsAdapter(credentials);
   3. The x-goog-user-project header for the quotaProjectId on sourceCredentials will be populated if it exists

   This looks to be working as intended, but it may not be super clear (please let me know if you observed anything otherwise). I will update the javadocs to make this clearer.
9. lqiu96

   closed this as completedin #14597on Oct 9, 2026
10. lqiu96

    added a commit that references this issue on Oct 9, 2026

    docs(auth): clarify quota project behavior on ImpersonatedCredentials (…

    ...

    4e5a0d0