Implement ImpersonatedCredentials

[salrashid123]

Allows one user or service account to impersonate another using iamcredentials api

its already implemented or pending for several other languages:

• python: https://github.com/googleapis/google-auth-library-python/blob/master/google/auth/impersonated_credentials.py#L17

• java: https://github.com/googleapis/google-auth-library-java/blob/master/oauth2_http/java/com/google/auth/oauth2/ImpersonatedCredentials.java

• golang: https://go-review.googlesource.com/c/oauth2/+/143957

--

here's what i've done so far:

• impersonatedclient.ts
• usage

[salrashid123]

imersonatedclient.ts from comment#1 does work directly through an authorizedClient.requestAsync() but it looks like there isnt' an easy way to pass in a generic credential or authorizedClient into something like a Storage client.

That is, the following works:

function getComputeClient() {
  let client = new Compute({
    serviceAccountEmail: '1071284184436-compute@developer.gserviceaccount.com'
  });
  return client;  
}

function  getServiceAccountClient() {

  const credFile = './mineral-minutia-820-83b3ce7dcddb.json';
  const keys = require(credFile);

  let client = new JWT(
    keys.client_email,
    null,
    keys.private_key,
    ['https://www.googleapis.com/auth/cloud-platform', 'https://www.googleapis.com/auth/iam'],
  );
  return client;
}

      let {Impersonated} = require('./build/src/auth/impersonatedclient.js');    
      let targetClient = new Impersonated({
        sourceClient: getServiceAccountClient(),
        targetPrincipal: "impersonated-account@fabled-ray-104117.iam.gserviceaccount.com",
        lifetime: 30,
        delegates: [],
        targetScopes: ["https://www.googleapis.com/auth/devstorage.read_only"]
      });

      targetClient.getAccessToken().then(res => {
          let project_id = 'fabled-ray-104117';  
          let url = 'https://www.googleapis.com/storage/v1/b?project=' + project_id
          targetClient.requestAsync({url}).then(resp => {
            console.log(resp.data.items[0]);
          }).catch(function (error) {
            console.error('Unable to list buckets: ' + error);
          }); 
  

---

what doesn't work is if i try to pass in the impersonatedClient or its credential into Storage:

          const {Storage} = require('@google-cloud/storage');          
          let storage = new Storage({
              projectId: project_id,
              //authClient: targetClient.authClient      << I dind't see this as a valid argument anyway.
              //credentials: targetClient.credentials    << assumes the credentials is `JWT`
          });
          const [buckets] =  storage.getBuckets(function(err, buckets) {
              if (err) {
                console.log(err);
              }
              if (!err) {
                buckets.forEach(function(value){
                    console.log(value.id);
                });
              }
          });