diff --git a/src/Credentials/ServiceAccountCredentials.php b/src/Credentials/ServiceAccountCredentials.php index 96ea4fa69..da972497e 100644 --- a/src/Credentials/ServiceAccountCredentials.php +++ b/src/Credentials/ServiceAccountCredentials.php @@ -186,7 +186,7 @@ public function useJwtAccessWithScope() */ public function fetchAuthToken(callable $httpHandler = null) { - if ($this->useJwtAccessWithScope) { + if ($this->useSelfSignedJwt()) { $jwtCreds = $this->createJwtAccessCredentials(); $accessToken = $jwtCreds->fetchAuthToken($httpHandler); @@ -324,7 +324,12 @@ public function getQuotaProject() private function useSelfSignedJwt() { - // When true, ServiceAccountCredentials will always use JwtAccess + // If claims are set, this call is for "id_tokens" + if ($this->auth->getAdditionalClaims()) { + return false; + } + + // When true, ServiceAccountCredentials will always use JwtAccess for access tokens if ($this->useJwtAccessWithScope) { return true; } diff --git a/tests/FetchAuthTokenTest.php b/tests/FetchAuthTokenTest.php index 244452a26..c7e72b2fa 100644 --- a/tests/FetchAuthTokenTest.php +++ b/tests/FetchAuthTokenTest.php @@ -152,6 +152,8 @@ public function testServiceAccountCredentialsGetLastReceivedToken() $oauth2Mock = $this->getOAuth2Mock(); $oauth2Mock->getScope() ->willReturn($this->scopes); + $oauth2Mock->getAdditionalClaims() + ->willReturn([]); $credentials = new ServiceAccountCredentials($this->scopes, $jsonPath); $property->setValue($credentials, $oauth2Mock->reveal());