service account authentication fails after 1.33.0 release

[syphar]

Environment details

• OS: Linux
• Python version: 3.9.6
• pip version: 21.1.3
• google-auth version: 1.33.0

Error description

With the update of google-auth to 1.33.0 we saw an error in our environments.

invalid_grant: Invalid JWT: Failed audience check. The right audience is [...]

In our case we use a service-account to access google calendars in our org.

In our service-account key we find "token_uri": "https://accounts.google.com/o/oauth2/token", while the library sets aud to be https://oauth2.googleapis.com/token via a constant. This was changed with the 1.33.0 release in 0e26409.

When I monkey-patch the constant to have the same value as the token-uri in our accounts, everything works again.

Is this a bug? Or a configuration issue on our side?

I'm happy to provide detailed steps to reproduce this if needed. Also I'm not sure about the relation to #464.

[busunkim96]

Thanks for the report! @arithmetic1728 Could you take a look?

I think https://oauth2.googleapis.com/token is the current token_endpoint (see https://developers.google.com/identity/protocols/oauth2/openid-connect#discovery). Do older keys use different endpoints?

[busunkim96]

Hi,

If you're experiencing this issue, please use the prior release google-auth==1.32.1. We are working at solutions in the backend.

[syphar]

Hi,

If you're experiencing this issue, please use the prior release google-auth==1.32.1. We are working at solutions in the backend.

Thank you for the update! We already had reverted the upgrade, will wait for the next release and the fix.

[Mogost]

We also investigated the issue on our side. In our case, changing the token_uri value in the .json file helped us.

[syphar]

We also investigated the issue on our side. In our case, changing the token_uri value in the .json file helped us.

thanks, that's good to know. I would have expected the token to be signed, so that it fails when these details are changed, that's why I didn't try to change it.

Since there is no rush upgrading the package, we'll just wait for the fix and release

[liuchaoren]

I can reproduce the error only when I set the "subject" filed for domain-wide delegation. Can anyone confirm if domain-wide delegation is used when you see the error?

[syphar]

I can reproduce the error only when I set the "subject" filed for domain-wide delegation. Can anyone confirm if domain-wide delegation is used when you see the error?

Yep, in our case the service account has domain wide delegation activated

[busunkim96]

Revert is under way in #808, we'll take the change again once b/194191737 is resolved.

[syphar]

just tested the revert with 1.33.1, and it works (which I assumed seeing the code, but still :) )

Thank you for the quick fix!