subscriber able to receive message even though service account is disabled.

[zhumin8]

Filing an issue here for part of issuer reported in https://github.com/GoogleCloudPlatform/spring-cloud-gcp (referred as second issue in original comments) that's relevant here.
Application receives a message successfully from subscription, even though service account is disabled

@mayur-solace provided reproducer and steps here: GoogleCloudPlatform/spring-cloud-gcp#2158 (comment) (Note that dispite the class name suggests, this reproducer is with client library and did not use Spring Cloud GCP)

[michaelpri10]

From reading the original issue, it seems that the main issue is that messages are still being received even after the service account is disabled, which I have been able to reproduce from the your examples. What I've noticed is that these UnauthenticatedException are actually occurring on ack and modack calls on the messages but the streaming request that pulls that is actually pulling the messages is still alive.

I suspect that this is occurring because the streaming pull connection has already been created before the service account is disabled and therefore messages are still able to be delivered, but not acked, over this connection. I will do more research into the expected behavior here.