feat(idtoken): add support for external_account (#1897)

* Also fix a bug for impersonated_service_account
    * When creds are passed with WithCredentialsFile(), it doesn't work.
    * Pass the option when creating the token source.
* Fixes PR #1879

idtoken/idtoken.go

@@ -34,6 +34,7 @@ const (
 	unknownCredType credentialsType = iota
 	serviceAccount
 	impersonatedServiceAccount
+	externalAccount
 )
 
 // NewClient creates a HTTP Client that automatically adds an ID token to each
@@ -139,7 +140,7 @@ func tokenSourceFromBytes(ctx context.Context, data []byte, audience string, ds
 			return nil, err
 		}
 		return oauth2.ReuseTokenSource(tok, ts), nil
-	case impersonatedServiceAccount:
+	case impersonatedServiceAccount, externalAccount:
 		type url struct {
 			ServiceAccountImpersonationURL string `json:"service_account_impersonation_url"`
 		}
@@ -155,7 +156,7 @@ func tokenSourceFromBytes(ctx context.Context, data []byte, audience string, ds
 			TargetPrincipal: account,
 			IncludeEmail:    true,
 		}
-		ts, err := impersonate.IDTokenSource(ctx, config)
+		ts, err := impersonate.IDTokenSource(ctx, config, option.WithCredentialsJSON(data))
 		if err != nil {
 			return nil, err
 		}
@@ -188,6 +189,8 @@ func parseCredType(typeString string) credentialsType {
 		return serviceAccount
 	case "impersonated_service_account":
 		return impersonatedServiceAccount
+	case "external_account":
+		return externalAccount
 	default:
 		return unknownCredType
 	}