Audience seems to be ignored

[ludoo]

TL;DR

I am trying to use this extension for a different universe than GCP, and to do so I need:

• to set the correct universe for APIs
• to pass a custom audience as that still needs to refer to googleapis.com

While the universe setting is correctly managed, the audience seems to be ignored.

Expected behavior

The expected behaviour is that the initial token is validated against the universe-aware WIF provider id, but contains the audience using googleapis.com.

Observed behavior

Provider audience (set to default): https://iam.googleapis.com/projects/1234567890/locations/global/workloadIdentityPools/cicd-0/providers/github-default

Just setting the universe produces this error (wrong audience used):

Error: google-github-actions/auth failed with: failed to generate Google Cloud federated token for //iam.apis-berlin-build0.goog/projects/1234567890/locations/global/workloadIdentityPools/cicd-0/providers/github-default: {"error":"invalid_request","error_description":"Invalid value for \"audience\". This value should be the full resource name of the Identity Provider. See https://cloud.google.com/iam/docs/reference/sts/rest/v1/TopLevel/token for the list of possible formats."}

Setting the universe and forcing the audience to googleapis produces the same error:

Error: google-github-actions/auth failed with: failed to generate Google Cloud federated token for //iam.apis-berlin-build0.goog/projects/1234567890/locations/global/workloadIdentityPools/cicd-0/providers/github-default: {"error":"invalid_request","error_description":"Invalid value for \"audience\". This value should be the full resource name of the Identity Provider. See https://cloud.google.com/iam/docs/reference/sts/rest/v1/TopLevel/token for the list of possible formats."}

Debug log for second scenario (universe+audience) is at the bottom.

Action YAML

First case (only universe set):

      - id: gcp-auth
        name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v3
        with:
          workload_identity_provider: ${{env.FAST_WIF_PROVIDER}}
          service_account: ${{env.service_account}}
          universe: apis-berlin-build0.goog
          access_token_lifetime: 900s

Second case (audience set):

      - id: gcp-auth
        name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v3
        with:
          workload_identity_provider: ${{env.FAST_WIF_PROVIDER}}
          service_account: ${{env.service_account}}
          universe: apis-berlin-build0.goog
          access_token_lifetime: 900s
          audience: https://iam.googleapis.com/projects/1234567890/locations/global/workloadIdentityPools/cicd-0/providers/github-default

Log output

Debug log for second (correct, but failing) case.

##[debug]WorkloadIdentityFederationClient.getToken: Built request, {
##[debug]  "method": "POST",
##[debug]  "path": "https://sts.apis-berlin-build0.goog/v1/token",
##[debug]  "headers": {},
##[debug]  "body": {
##[debug]    "audience": "//iam.apis-berlin-build0.goog/projects/1234567890/locations/global/workloadIdentityPools/cicd-0/providers/github-default",
##[debug]    "grantType": "urn:ietf:params:oauth:grant-type:token-exchange",
##[debug]    "requestedTokenType": "urn:ietf:params:oauth:token-type:access_token",
##[debug]    "scope": "https://www.apis-berlin-build0.goog/auth/cloud-platform",
##[debug]    "subjectTokenType": "urn:ietf:params:oauth:token-type:jwt",
##[debug]    "subjectToken": "***"
##[debug]  }
##[debug]}

Additional information

Feel free to reach out internally if you need more details or an environment to test this.

[github-actions]

Hi there @ludoo 👋!

Thank you for opening an issue. Our team will triage this as soon as we can. Please take a moment to review the troubleshooting steps which lists common error messages and their resolution steps.

[ludoo]

Directly deriving the token via the github-script action works:

#   FAST_WIF_PROVIDER: projects/1234567890/locations/global/workloadIdentityPools/cicd-0/providers/github-default

      - id: gcp-auth
        name: Authenticate to Google Cloud
        uses: actions/github-script@v7
        with:
          script: |
            const fs = require('fs');
            const audience = `//iam.googleapis.com/${process.env.FAST_WIF_PROVIDER}`;
            const token = await core.getIDToken(audience);
            const tokenPath = '/tmp/oidc_token';
            fs.writeFileSync(tokenPath, token);

      - id: gcloud-auth
        name: Auth gcloud
        run: |
          gcloud config set universe_domain apis-berlin-build0.goog
          gcloud iam workload-identity-pools create-cred-config \
            ${{env.FAST_WIF_PROVIDER}} \
            --service-account=${{env.service_account}} \
            --service-account-token-lifetime-seconds=900 \
            --output-file=credentials.json \
            --credential-source-file=/tmp/oidc_token
          gcloud config set auth/credential_file_override credentials.json

[ludoo]

Untested fix (not opening a PR as I can't deal with a follow up atm, sorry).

diff --git a/src/client/workload_identity_federation.ts b/src/client/workload_identity_federation.ts
index ad99757..dacf978 100644
--- a/src/client/workload_identity_federation.ts
+++ b/src/client/workload_identity_federation.ts
@@ -56,8 +56,12 @@ export class WorkloadIdentityFederationClient extends Client implements AuthClie
     this.#workloadIdentityProviderName = opts.workloadIdentityProviderName;
     this.#serviceAccount = opts.serviceAccount;
 
-    const iamHost = new URL(this._endpoints.iam).host;
-    this.#audience = `//${iamHost}/${this.#workloadIdentityProviderName}`;
+    if (opts.audience) {
+      this.#audience = opts.audience;
+    } else {
+      const iamHost = new URL(this._endpoints.iam).host;
+      this.#audience = `//${iamHost}/${this.#workloadIdentityProviderName}`;
+    }
     this._logger.debug(`Computed audience`, this.#audience);
   }
 
diff --git a/src/main.ts b/src/main.ts
index 8e0217f..23f8517 100644
--- a/src/main.ts
+++ b/src/main.ts
@@ -128,6 +128,7 @@ export async function run(logger: Logger) {
         githubOIDCTokenAudience: oidcTokenAudience,
         workloadIdentityProviderName: workloadIdentityProvider,
         serviceAccount: serviceAccount,
+        audience: getInput('audience'),
       });
     } else {
       logger.debug(`Using credentials JSON`);

[juliocc]

The diff seems to work with one small addition: the scopes domain must always be googleapis.com

Opened #522 with the changes applied.