auth: `impersonated_credentials` loses `subject` on copy, so `with_scopes()` and `with_quota_project()` turn off domain wide delegation

[Om-singhaI]

• I determined this is the correct repository in which to report this bug.

Context

impersonated_credentials.Credentials takes a subject so it can act as a Workspace user through domain wide delegation. _make_copy rebuilds the credential without it, so with_scopes(), with_quota_project() and the deprecated with_trust_boundary() all hand back a copy whose subject is None. Deriving a narrower scoped credential from one base credential is the normal way to use this, and a quota project is common for Workspace APIs.

Nothing raises. The copy refreshes fine, it just authenticates as somebody else: it posts to :generateAccessToken instead of :signJwt plus the OAuth2 token endpoint, so the token belongs to the service account and not to the user. Whatever you call next runs as the service account instead of the user. The copy also starts building a Regional Access Boundary lookup URL again, which #17763 skips while a subject is set. google/oauth2/service_account.py carries the same subject field and its _make_copy does pass it on.

Expected Behavior: the copy keeps subject, the same way it keeps target_principal, target_scopes, delegates, lifetime, quota_project_id, iam_endpoint_override and trust_boundary.

Actual Behavior: subject is None on the copy, and the copy runs the plain service account impersonation flow.

API client name and version

google-auth 2.58.0, packages/google-auth on main at 47b2845.

Reproduction steps: code

file: main.py

import json

from google.auth import credentials as ga_credentials
from google.auth import impersonated_credentials


class FakeSource(ga_credentials.Credentials):
    """Stands in for the source credential so this runs without a key file."""

    def refresh(self, request):
        self.token = "source-token"


class FakeResponse:
    def __init__(self, data):
        self.status = 200
        self.data = json.dumps(data).encode("utf-8")


class FakeRequest:
    """Records the endpoints refresh() posts to."""

    def __init__(self):
        self.urls = []

    def __call__(self, url=None, method=None, headers=None, body=None, **kwargs):
        self.urls.append(url)
        if ":signJwt" in url:
            return FakeResponse({"signedJwt": "a.b.c"})
        if url.endswith("oauth2.googleapis.com/token"):
            return FakeResponse({"access_token": "user-token", "expires_in": 3600})
        return FakeResponse(
            {"accessToken": "sa-token", "expireTime": "2099-01-01T00:00:00Z"}
        )


base = impersonated_credentials.Credentials(
    source_credentials=FakeSource(),
    target_principal="dwd-sa@my-project.iam.gserviceaccount.com",
    target_scopes=["https://www.googleapis.com/auth/drive.readonly"],
    subject="alice@example.com",
)
scoped = base.with_scopes(["https://www.googleapis.com/auth/drive.metadata.readonly"])

for label, cred in [("base", base), ("scoped", scoped)]:
    request = FakeRequest()
    cred.refresh(request)
    print("{} subject={!r}".format(label, cred._subject))
    for url in request.urls:
        print("  POST", url)

Reproduction steps: actual results

base subject='alice@example.com'
  POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/dwd-sa@my-project.iam.gserviceaccount.com:signJwt
  POST https://oauth2.googleapis.com/token
scoped subject=None
  POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/dwd-sa@my-project.iam.gserviceaccount.com:generateAccessToken

Reproduction steps: expected results

scoped keeps the subject and makes the same two posts as base:

scoped subject='alice@example.com'
  POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/dwd-sa@my-project.iam.gserviceaccount.com:signJwt
  POST https://oauth2.googleapis.com/token

OS & version + platform

macOS 26.6.2 on arm64

Python environment

Python 3.13.15