GoogleAuth.sign does not work with ExternalCredentials

[clhuang]

Environment details

• OS: Mac OS 11.4
• Node.js version: 14.16.1
• npm version: 6.14.12
• google-auth-library version: 7.3.0

Steps to reproduce

const { GoogleAuth } = require('google-auth-library');

const auth = new GoogleAuth({ keyFilename: './clientLibraryConfig.json' });
auth.sign('abc').then(console.log); // fails

output:

(node:76183) UnhandledPromiseRejectionWarning: Error: Cannot sign data without `client_email`.
    at GoogleAuth.sign (/Users/calvinhuang/scale/gcptest/node_modules/google-auth-library/build/src/auth/googleauth.js:638:19)

Attempting to use workload identity federation with cloud storage signing does not work because of this, where clientLibraryConfig.json is the config retrieved from the workload identity pools page.

it is possible to work around with a bit of a hack:

const { GoogleAuth } = require('google-auth-library');

const auth = new GoogleAuth({ keyFilename: './clientLibraryConfig.json' });
(async () => {
  await auth.getClient();
  auth.jsonContent = { client_email: 'service-account-email' };
  await auth.sign('abc').then(console.log);
})()

[bojeil-google]

Hey @clhuang, external account creds currently do not support signing blobs. The implementation currently depends on service account keys or need the service account email in order to call signBlob which is why you are seeing this error.
I think we can update the implementation to get the service account email from the service account impersonation URL if available or otherwise error.