Support service account user impersonation

gogol/src/Network/Google/Auth.hs

@@ -25,6 +25,9 @@ module Network.Google.Auth
     , saveAuthorizedUserToWellKnownPath
     , saveAuthorizedUser
 
+    -- ** Service account user impersonation
+    , serviceAccountUser
+
     -- ** Installed Application Credentials
     , installedApplication
     , formURL
@@ -198,3 +201,13 @@ authorize rq s l m = bearer <$> getToken s l m
             , "Bearer " <> toHeader (_tokenAccess t)
             ) : Client.requestHeaders rq
         }
+
+-- | Set the user to be impersonated for a service account with domain
+-- wide delegation. See
+-- https://developers.google.com/identity/protocols/OAuth2ServiceAccount
+serviceAccountUser :: forall s. (AllowScopes s)
+                   => Maybe Text
+                   -> Credentials s
+                   -> Credentials s
+serviceAccountUser u (FromAccount s) = FromAccount $ s { _serviceAccountUser = u }
+serviceAccountUser _ c               = c

gogol/src/Network/Google/Auth/ServiceAccount.hs

@@ -125,10 +125,10 @@ encodeBearerJWT s p = liftIO $ do
             , "kid" .= _serviceKeyId s
             ]
 
-        payload = base64Encode
+        payload = base64Encode $
             [ "aud"   .= tokenURL
             , "scope" .= concatScopes (allowScopes p)
             , "iat"   .= n
             , "exp"   .= (n + seconds maxTokenLifetime)
             , "iss"   .= _serviceEmail s
-            ]
+            ] <> maybe [] (\sub -> ["sub" .= sub]) (_serviceAccountUser s)

gogol/src/Network/Google/Internal/Auth.hs

@@ -91,10 +91,11 @@ specifying which 'Scope's the resulting 'OAuthToken' is authorized to access.
 /See:/ <https://developers.google.com/identity/protocols/OAuth2ServiceAccount#delegatingauthority Delegating authority to your service account>.
 -}
 data ServiceAccount = ServiceAccount
-    { _serviceId         :: !ClientId
-    , _serviceEmail      :: !Text
-    , _serviceKeyId      :: !Text
-    , _servicePrivateKey :: !PrivateKey
+    { _serviceId          :: !ClientId
+    , _serviceEmail       :: !Text
+    , _serviceKeyId       :: !Text
+    , _servicePrivateKey  :: !PrivateKey
+    , _serviceAccountUser :: !(Maybe Text)
     } deriving (Eq, Show)
 
 instance FromJSON ServiceAccount where
@@ -109,6 +110,7 @@ instance FromJSON ServiceAccount where
             <*> o .: "client_email"
             <*> o .: "private_key_id"
             <*> pure k
+            <*> pure Nothing
 
 {-| Authorized User credentials which are typically generated by the Cloud SDK
 Tools such as @gcloud init@, of the following form: