[2.42.0] Bug with impersonated account token refresh

[mfriedy]

After updating from 2.41.1 to 2.42.0 I get this issue:

  File "C:\...\.venv\Lib\site-packages\google\auth\transport\requests.py", line 535, in request
    self.credentials.before_request(auth_request, method, url, request_headers)
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\...\.venv\Lib\site-packages\google\auth\credentials.py", line 228, in before_request
    self._blocking_refresh(request)
    ~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^
  File "C:\...\.venv\Lib\site-packages\google\auth\credentials.py", line 191, in _blocking_refresh
    self.refresh(request)
    ~~~~~~~~~~~~^^^^^^^^^
  File "C:\...\.venv\Lib\site-packages\google\auth\credentials.py", line 365, in refresh
    self._refresh_token(request)
    ~~~~~~~~~~~~~~~~~~~^^^^^^^^^
  File "C:\...\.venv\Lib\site-packages\google\auth\impersonated_credentials.py", line 289, in _refresh_token
    self._source_credentials._refresh_token(request)
TypeError: 'str' object is not callable

It seems this commit changed the refresh logic of impersonated account credentials at exactly this line: 36ecb1d#diff-9fb6744f480c88b7964f845792d2d930c9a7048caee2ba4931dc2c899c623cb6L289

Reverting back to 2.41.1 fixes it.

Python: 3.13.9

[jmesterh]

Also seeing this please fix ASAP

[capitantoto]

Yes! It took me forever to debug this issue because we updated google-auth as part of a much large upgrade, but in the end it came down to the move from 2.41.1 to 2.42.0, and it's still broken with 2.42.1 from earlier today.

Minimum reproducible environment (in development) for me has:

• a single config like this:

% gcloud config list
[auth]
impersonate_service_account = service-account@myproject.iam.gserviceaccount.com
[core]
account = gonzalo@company.com
disable_usage_reporting = False
project = myproject

which is authenticated via

gcloud auth application-default login

And a pyproject.toml with a single unpinned dependency, google-cloud-bigquery managed by uv. With that environment uv solves to 3.38.0 for bigquery and 2.42.1 for google-auth. In that scenario, this test command:

uv run python -c "from google.cloud import bigquery; list(ds.dataset_id for ds in bigquery.Client().list_datasets())"

returns the str not callable error:

  File "/Users/gonzalo/Git/goog6/.venv/lib/python3.11/site-packages/google/auth/impersonated_credentials.py", line 289, in _refresh_token
    self._source_credentials._refresh_token(request)
TypeError: 'str' object is not callable

If I add a constraint on google_auth <2.42, it gets solved to 2.41.1 and the same test command runs and exits without errors.

For completeness'sake, here's the pyproject.toml from the example that returns the str not callable error:

[project]
name = "goog6"
version = "0.1.0"
description = "Add your description here"
readme = "README.md"
requires-python = ">=3.11"
dependencies = [
    "google-auth>=2.42",
    "google-cloud-bigquery==3.38.0",
]

I ran it with Python 3.11.13

[GeeekyBoy]

We're facing a similar problem too!

[Sylver11]

problem is is with either of these two PRs:

https://github.com/googleapis/google-auth-library-python/pull/1820/files
https://github.com/googleapis/google-auth-library-python/pull/1809/files

[drewgillson]

This is a blocker for us

[neurowelt]

Confirming that pinning google-auth==2.41.1 resolved the issue for me (needed it for google-cloud-texttospeech==2.31.0 service). Checked on Python 3.13.5.

[agentbrain]

also confirming this has been broken for us since the 2.42.0 release and pinning to 2.41.1 resolves the issue

[camilleAmaury]

+1, quite blocking with any services which needs to refresh the credentials.

[wwangsa]

+1

[kranthibandaru]

We have the same issue as well. Please fix it at the earliest.

[mikeedjones]

problem is is with either of these two PRs:
https://github.com/googleapis/google-auth-library-python/pull/1809/files

Yes, It looks like in #1809 the Credentials subclasses in google.auth where updated to change _refresh_token -> _refresh_token_val and change refresh_token from an attribute to a method. The corresponding change in google.oath2 were not implemented and the test has that attribute mocked so i guess was missed in testing.

[spkgyk]

Can confirm that it's an issue in python 3.12.11 as well as 3.13.x. Similarly, downgrading to 2.41.1 resolves the issue