如何从OIDC认证服务器获取ID Token？ExternalAccountClient转GoogleAuth

你不需要从ExternalAccountClient转换到GoogleAuth，两种直接的方式就能满足你的需求：

方式一：直接用ExternalAccountClient生成ID Token调用Cloud Run #

ExternalAccountClient本身支持生成ID Token，无需依赖GoogleAuth的方法：

// 初始化你已配置好的ExternalAccountClient
const authClient = ExternalAccountClient.fromJSON({
  type: "external_account",
  audience: `//iam.googleapis.com/projects/${GCP_PROJECT_NUMBER}/locations/global/workloadIdentityPools/${GCP_WORKLOAD_IDENTITY_POOL_ID}/providers/${GCP_WORKLOAD_IDENTITY_POOL_PROVIDER_ID}`,
  subject_token_type: "urn:ietf:params:oauth:token-type:jwt",
  token_url: "https://sts.googleapis.com/v1/token",
  service_account_impersonation_url: `https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${GCP_SERVICE_ACCOUNT_EMAIL}:generateAccessToken`,
  subject_token_supplier: {
    getSubjectToken: getVercelOidcToken,
  },
});

// 生成目标Cloud Run服务的ID Token
const idToken = await authClient.getIdToken(backend_url);

// 发起请求到Cloud Run后端
const response = await fetch(backend_url, {
  headers: {
    Authorization: `Bearer ${idToken}`
  }
});

方式二：让GoogleAuth加载外部账户配置 #

如果一定要使用GoogleAuth的getIdTokenClient，可以直接将外部账户配置传入GoogleAuth构造参数，避免它尝试读取本地认证凭证：

const auth = new GoogleAuth({
  scopes: "https://www.googleapis.com/auth/cloud-platform",
  projectId: GCP_PROJECT_ID,
  // 直接传入外部账户配置
  credentials: {
    type: "external_account",
    audience: `//iam.googleapis.com/projects/${GCP_PROJECT_NUMBER}/locations/global/workloadIdentityPools/${GCP_WORKLOAD_IDENTITY_POOL_ID}/providers/${GCP_WORKLOAD_IDENTITY_POOL_PROVIDER_ID}`,
    subject_token_type: "urn:ietf:params:oauth:token-type:jwt",
    token_url: "https://sts.googleapis.com/v1/token",
    service_account_impersonation_url: `https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${GCP_SERVICE_ACCOUNT_EMAIL}:generateAccessToken`,
    subject_token_supplier: {
      getSubjectToken: getVercelOidcToken,
    },
  }
});

const idTokenClient = await auth.getIdTokenClient(backend_url);
const response = await idTokenClient.request({ url: backend_url });

注意事项 #

• 确保你配置的服务账户GCP_SERVICE_ACCOUNT_EMAIL拥有Cloud Run服务的roles/run.invoker权限
• 确认Vercel的OIDC Token能正确获取，且符合工作负载身份池的配置要求（如受众、签名验证规则等）

内容的提问来源于stack exchange，提问作者Ant