fix: makes default token url universe aware

oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java

@@ -73,7 +73,7 @@ public abstract class ExternalAccountCredentials extends GoogleCredentials {
   static final String EXTERNAL_ACCOUNT_FILE_TYPE = "external_account";
   static final String EXECUTABLE_SOURCE_KEY = "executable";
 
-  static final String DEFAULT_TOKEN_URL = "https://sts.googleapis.com/v1/token";
+  static final String DEFAULT_TOKEN_URL = "https://sts.{UNIVERSE_DOMAIN}/v1/token";
   static final String PROGRAMMATIC_METRICS_HEADER_VALUE = "programmatic";
 
   private final String transportFactoryClassName;
@@ -235,7 +235,19 @@ protected ExternalAccountCredentials(ExternalAccountCredentials.Builder builder)
     this.serviceAccountImpersonationUrl = builder.serviceAccountImpersonationUrl;
     this.clientId = builder.clientId;
     this.clientSecret = builder.clientSecret;
-    this.tokenUrl = builder.tokenUrl == null ? DEFAULT_TOKEN_URL : builder.tokenUrl;
+
+    if (builder.tokenUrl == null) {
+      try {
+        this.tokenUrl = DEFAULT_TOKEN_URL.replace("{UNIVERSE_DOMAIN}", this.getUniverseDomain());
+      } catch (IOException e) {
+        // Throwing an IOException would be a breaking change, so wrap it here.
+        throw new IllegalStateException(
+            "Error occurred when attempting to retrieve universe domain.", e);
+      }
+    } else {
+      this.tokenUrl = builder.tokenUrl;
+    }
+
     this.scopes =
         (builder.scopes == null || builder.scopes.isEmpty())
             ? Arrays.asList(CLOUD_PLATFORM_SCOPE)

oauth2_http/javatests/com/google/auth/oauth2/ExternalAccountCredentialsTest.java

@@ -565,6 +565,44 @@ public void constructor_builder_defaultTokenUrl() {
     assertEquals(STS_URL, credentials.getTokenUrl());
   }
 
+  @Test
+  public void constructor_builder_defaultTokenUrlwithUniverseDomain() {
+    HashMap<String, Object> credentialSource = new HashMap<>();
+    credentialSource.put("file", "file");
+
+    ExternalAccountCredentials credentials =
+        IdentityPoolCredentials.newBuilder()
+            .setHttpTransportFactory(transportFactory)
+            .setAudience(
+                "//iam.googleapis.com/locations/global/workforcePools/pool/providers/provider")
+            .setSubjectTokenType("subjectTokenType")
+            .setCredentialSource(new TestCredentialSource(credentialSource))
+            .setUniverseDomain("testdomain.org")
+            .build();
+
+    assertEquals("https://sts.testdomain.org/v1/token", credentials.getTokenUrl());
+  }
+
+  @Test
+  public void constructor_builder_getUniverseDomainFails() {
+    HashMap<String, Object> credentialSource = new HashMap<>();
+    credentialSource.put("file", "file");
+
+    try {
+      UniverseDomainErrorTestCredentials.newBuilder()
+          .setHttpTransportFactory(transportFactory)
+          .setAudience(
+              "//iam.googleapis.com/locations/global/workforcePools/pool/providers/provider")
+          .setSubjectTokenType("subjectTokenType")
+          .setUniverseDomain("testdomain.org")
+          .build();
+      fail("Should not be able to continue without exception.");
+    } catch (IllegalStateException exception) {
+      assertEquals(
+          "Error occurred when attempting to retrieve universe domain.", exception.getMessage());
+    }
+  }
+
   @Test
   public void constructor_builder_subjectTokenTypeEnum() {
     HashMap<String, Object> credentialSource = new HashMap<>();
@@ -1350,4 +1388,28 @@ public String retrieveSubjectToken() {
       return "subjectToken";
     }
   }
+
+  static class UniverseDomainErrorTestCredentials extends TestExternalAccountCredentials {
+    protected UniverseDomainErrorTestCredentials(TestExternalAccountCredentials.Builder builder) {
+      super(builder);
+    }
+
+    public static UniverseDomainErrorTestCredentials.Builder newBuilder() {
+      return new UniverseDomainErrorTestCredentials.Builder();
+    }
+
+    static class Builder extends TestExternalAccountCredentials.Builder {
+      Builder() {}
+
+      @Override
+      public UniverseDomainErrorTestCredentials build() {
+        return new UniverseDomainErrorTestCredentials(this);
+      }
+    }
+
+    @Override
+    public String getUniverseDomain() throws IOException {
+      throw new IOException("Test error");
+    }
+  }
 }