Getting OIDC token with service account email as sunject instead of numeric unique id

[amitronen1]

Hello,
i'm trying to get an OIDC token for a service account on .NET using this method GetOidcTokenAsync and i'm successful. Unfortunately i require that the "subject" property will be populated with the service account email, and not the unique numeric id.
i came across this example which allows that by signing the JWT manually, but unfortunately i do not have access to the SA private key as i authenticate to it using impersonation.

what can i do?

thanks!

[jskeet]

Assigned to Amanda who knows more about this than I do, but we're both on vacation until the new year at this point, so please be patient.

[amanda-tarafa]

I think you might find what you are looking for in #2011, you can use the IAM API to sign the JWT token with the impersonated service account.
Let me know if you need more details and I'll try to provide them later.

[amitronen1]

Thanks Amanda this was highly helpful