Repository navigation
Redundant trust boundary lookup for source credential during impersonation #15139
Description
When a service account is used to impersonate another service account, the library currently performs a trust boundary lookup for the source credential. This is no longer necessary due to a recent design change and adds extra overhead to the authentication process.
Background:
The impersonated_credentials.Credentials object refreshes its source credential by calling self._source_credentials.refresh(request). This triggers the full refresh process on the source credential, including the trust boundary lookup. This behavior was originally intended, as the x-allowed-locations header (derived from the trust boundary) was required for requests to the IAM Credentials API. However, the design has since changed, and this header is no longer needed for IAM requests. As a result, the trust boundary lookup for the source credential is now redundant. This issue was not a bug in the original implementation but has become one due to the evolution of the design.
Activity
parthea commentedon Jan 12, 2026
Transferring to google-cloud-python as the code for google-auth-library-python will be migrated there in 1-3 weeks.
nbayati commentedon Jul 2, 2026
Closing this issue as it has been resolved by PR #16084.
Previously, the background RAB lookup was triggered directly inside the refresh() method. Because impersonated_credentials.Credentials refreshes its source credential by calling self._source_credentials.refresh(), this unintentionally spawned a second, unnecessary RAB lookup for the source credential.
In PR #16084, the design was updated to decouple the RAB lookup from the token refresh logic. The trigger for the background lookup was moved out of refresh() and into the before_request() lifecycle.
Because AuthorizedSession only ever calls before_request() on the primary (impersonated) credential, only the target service account triggers the RAB lookup. The underlying source credential is simply asked to refresh() its token without ever having before_request() called on it, effectively bypassing the unnecessary network call and eliminating the extra latency.