Open
Description
This is described internally at go/adc-impersonation
Basically it requires extending the parsing of the ADC configuration file (if it exists) to support a new type: impersonated_service_account. This new type supports the following JSON format:
"service_account_impersonation_url":string, the URL to use for the impersonation workflow.- Example:
"https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/sa3@developer.gserviceaccount.com:generateAccessToken"
- Example:
"delegates":arrayofstring. The list of delegates to use in the impersonation workflow.- Example:
["sa1@developer.gserviceaccount.com", "sa2@developer.gserviceaccount.com" ]
- Example:
"source_credentials":objectthe base credentials to authenticate with."type":stringthe value"impersonated_service_account"
Recall that we already implement this form of impersonation for external accounts, so there is existing code to reuse.
For details on the impersonation workflow, see: