feat: use IamCredentials endpoint for generating ID tokens outside GDU

[bshaffer]

Uses the iamcredentials service in order to generate an ID token when universe_domain is supplied and is not the default (googleapis.com).

• verify generating the ID token works
• verify generated ID token is valid
• write unit tests
• consider merging feat: add ID tokens for user refresh credentials #468 as part of this

[gjvanahee]

perhaps there could be a fourth parameter array $headers = []. This way the calling class (e.g. ImpersonatedServiceAccountCredentials) could add a token endpoint metrics header. (The bearer token could stay as-is as it is required for the id token to be returned.)

[bshaffer]

Thanks for this feedback! Could you provide me an example of what that would look like? I assume it would look like adding the following in the call to Iam::generateIdToken:

            $idToken = (new Iam($httpHandler, $this->getUniverseDomain()))->generateIdToken(
                $this->auth->getIssuer(),
                $this->auth->getAdditionalClaims()['target_audience'],
                $jwt,
                $this->applyTokenEndpointMetrics([], 'it') // this is the new line
            );

[gjvanahee]

Yes, that is exactly what I had in mind. All requests I encountered getting an acces or id token send metrics headers, so it makes sense to add them here too. The implementation would be something like this.

    /**
     * @param array $headers Optional headers to send to the api, defaults to an empty array
     */
    public function generateIdToken(
        string $clientEmail,
        string $targetAudience,
        string $bearerToken,
        array $headers = [] // -> added optional parameter
): string {
        // ....
       // updated header assignment
       $headers['Authorization'] = 'Bearer ' . $bearerToken; 
        // ....

[bshaffer]

This has been added in 475bc74