google/internal/externalaccount: create executable credenitals

google/internal/externalaccount/executablecredsource_test.go

@@ -0,0 +1,926 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package externalaccount
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"testing"
+	"time"
+)
+
+func Bool(b bool) *bool {
+	return &b
+}
+
+func Int(i int) *int {
+	return &i
+}
+
+func Int64(i int64) *int64 {
+	return &i
+}
+
+func String(s string) *string {
+	return &s
+}
+
+var emptyEnv = func() []string {
+	return []string{}
+}
+
+func TestCreateExecutableCredential(t *testing.T) {
+	ec := ExecutableConfig{
+		Command:       "blarg",
+		TimeoutMillis: 50000,
+	}
+
+	ecs := CreateExecutableCredential(ec, nil, context.Background())
+	if ecs.Command != "blarg" {
+		t.Errorf("ecs.Command got %v but want %v", ecs.Command, "blarg")
+	}
+	if ecs.Timeout != 50000*time.Millisecond {
+		t.Errorf("ecs.Timeout got %v but want %v", ecs.Timeout, 50000*time.Millisecond)
+	}
+}
+
+func TestCreateExecutableCredential_WithoutTimeout(t *testing.T) {
+	ec := ExecutableConfig{
+		Command: "blarg",
+	}
+
+	ecs := CreateExecutableCredential(ec, nil, context.Background())
+	if ecs.Command != "blarg" {
+		t.Errorf("ecs.Command got %v but want %v", ecs.Command, "blarg")
+	}
+	if ecs.Timeout != 30000*time.Millisecond {
+		t.Errorf("ecs.Timeout got %v but want %v", ecs.Timeout, 30000*time.Millisecond)
+	}
+}
+
+func areSlicesEquivalent(a, b []string) bool {
+	if len(a) != len(b) {
+		return false
+	}
+
+OUTER:
+	for i, aa := range a {
+		for _, bb := range b {
+			if aa == bb {
+				continue OUTER
+			}
+		}
+		return false
+	}
+	return true
+}
+
+func TestMinimalExectuableCredentialGetEnvironment(t *testing.T) {
+	config := Config{
+		Audience:         "//iam.googleapis.com/projects/123/locations/global/workloadIdentityPools/pool/providers/oidc",
+		SubjectTokenType: "urn:ietf:params:oauth:token-type:jwt",
+		CredentialSource: CredentialSource{
+			Executable: ExecutableConfig{
+				Command: "blarg",
+			},
+		},
+	}
+
+	ecs := CreateExecutableCredential(config.CredentialSource.Executable, &config, context.Background())
+
+	oldBaseEnv := baseEnv
+	defer func() { baseEnv = oldBaseEnv }()
+	baseEnv = func() []string {
+		return []string{"A=B"}
+	}
+
+	expectedEnvironment := []string{
+		"A=B",
+		fmt.Sprintf("GOOGLE_EXTERNAL_ACCOUNT_AUDIENCE=%v", config.Audience),
+		fmt.Sprintf("GOOGLE_EXTERNAL_ACCOUNT_TOKEN_TYPE=%v", config.SubjectTokenType),
+		"GOOGLE_EXTERNAL_ACCOUNT_INTERACTIVE=0",
+	}
+
+	if got, want := ecs.getEnvironment(), expectedEnvironment; !areSlicesEquivalent(got, want) {
+		t.Errorf("Incorrect environment received.\nExpected: %s\nRecieved: %s", want, got)
+	}
+}
+
+func TestExectuableCredentialGetEnvironmentMalformedImpersonationUrl(t *testing.T) {
+	config := Config{
+		Audience:                       "//iam.googleapis.com/projects/123/locations/global/workloadIdentityPools/pool/providers/oidc",
+		ServiceAccountImpersonationURL: "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/test@project.iam.gserviceaccount.com:generateAccessToken",
+		SubjectTokenType:               "urn:ietf:params:oauth:token-type:jwt",
+		CredentialSource: CredentialSource{
+			Executable: ExecutableConfig{
+				Command:    "blarg",
+				OutputFile: "/path/to/generated/cached/credentials",
+			},
+		},
+	}
+
+	ecs := CreateExecutableCredential(config.CredentialSource.Executable, &config, context.Background())
+
+	oldBaseEnv := baseEnv
+	defer func() { baseEnv = oldBaseEnv }()
+	baseEnv = func() []string {
+		return []string{"A=B"}
+	}
+
+	expectedEnvironment := []string{
+		"A=B",
+		fmt.Sprintf("GOOGLE_EXTERNAL_ACCOUNT_AUDIENCE=%v", config.Audience),
+		fmt.Sprintf("GOOGLE_EXTERNAL_ACCOUNT_TOKEN_TYPE=%v", config.SubjectTokenType),
+		"GOOGLE_EXTERNAL_ACCOUNT_IMPERSONATED_EMAIL=test@project.iam.gserviceaccount.com",
+		"GOOGLE_EXTERNAL_ACCOUNT_INTERACTIVE=0",
+		fmt.Sprintf("GOOGLE_EXTERNAL_ACCOUNT_OUTPUT_FILE=%v", config.CredentialSource.Executable.OutputFile),
+	}
+
+	if got, want := ecs.getEnvironment(), expectedEnvironment; !areSlicesEquivalent(got, want) {
+		t.Errorf("Incorrect environment received.\nExpected: %s\nRecieved: %s", want, got)
+	}
+}
+func TestExectuableCredentialGetEnvironment(t *testing.T) {
+	config := Config{
+		Audience:                       "//iam.googleapis.com/projects/123/locations/global/workloadIdentityPools/pool/providers/oidc",
+		ServiceAccountImpersonationURL: "test@project.iam.gserviceaccount.com",
+		SubjectTokenType:               "urn:ietf:params:oauth:token-type:jwt",
+		CredentialSource: CredentialSource{
+			Executable: ExecutableConfig{
+				Command:    "blarg",
+				OutputFile: "/path/to/generated/cached/credentials",
+			},
+		},
+	}
+
+	ecs := CreateExecutableCredential(config.CredentialSource.Executable, &config, context.Background())
+
+	oldBaseEnv := baseEnv
+	defer func() { baseEnv = oldBaseEnv }()
+	baseEnv = func() []string {
+		return []string{"A=B"}
+	}
+
+	expectedEnvironment := []string{
+		"A=B",
+		fmt.Sprintf("GOOGLE_EXTERNAL_ACCOUNT_AUDIENCE=%v", config.Audience),
+		fmt.Sprintf("GOOGLE_EXTERNAL_ACCOUNT_TOKEN_TYPE=%v", config.SubjectTokenType),
+		"GOOGLE_EXTERNAL_ACCOUNT_INTERACTIVE=0",
+		fmt.Sprintf("GOOGLE_EXTERNAL_ACCOUNT_OUTPUT_FILE=%v", config.CredentialSource.Executable.OutputFile),
+	}
+
+	if got, want := ecs.getEnvironment(), expectedEnvironment; !areSlicesEquivalent(got, want) {
+		t.Errorf("Incorrect environment received.\nExpected: %s\nRecieved: %s", want, got)
+	}
+}
+
+func TestRetrieveExecutableSubjectTokenWithoutEnvironmentVariablesSet(t *testing.T) {
+	cs := CredentialSource{
+		Executable: ExecutableConfig{
+			Command:       "blarg",
+			TimeoutMillis: 5000,
+		},
+	}
+
+	tfc := testFileConfig
+	tfc.CredentialSource = cs
+
+	oldGetenv := getenv
+	defer func() { getenv = oldGetenv }()
+	getenv = setEnvironment(map[string]string{})
+
+	base, err := tfc.parse(context.Background())
+	if err != nil {
+		t.Fatalf("parse() failed %v", err)
+	}
+
+	_, err = base.subjectToken()
+	if err == nil {
+		t.Fatalf("Expected error but found none")
+	}
+	if got, want := err.Error(), "Executables need to be explicitly allowed (set GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES to '1') to run."; got != want {
+		t.Errorf("Incorrect error received.\nExpected: %s\nRecieved: %s", want, got)
+	}
+}
+
+func TestRetrieveExecutableSubjectTokenTimeoutOccurs(t *testing.T) {
+	cs := CredentialSource{
+		Executable: ExecutableConfig{
+			Command:       "blarg",
+			TimeoutMillis: 5000,
+		},
+	}
+
+	tfc := testFileConfig
+	tfc.CredentialSource = cs
+
+	oldGetenv, oldNow, oldRunCommand := getenv, now, runCommand
+	defer func() {
+		getenv, now, runCommand = oldGetenv, oldNow, oldRunCommand
+	}()
+
+	getenv = setEnvironment(map[string]string{"GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES": "1"})
+	now = setTime(defaultTime)
+	deadline, deadlineSet := now(), false
+	runCommand = func(ctx context.Context, command string, env []string) ([]byte, error) {
+		deadline, deadlineSet = ctx.Deadline()
+		return nil, context.DeadlineExceeded
+	}
+
+	base, err := tfc.parse(context.Background())
+	if err != nil {
+		t.Fatalf("parse() failed %v", err)
+	}
+
+	_, err = base.subjectToken()
+	if err == nil {
+		t.Fatalf("Expected error but found none")
+	}
+	if got, want := err.Error(), "oauth2/google: executable command timed out."; got != want {
+		t.Errorf("Incorrect error received.\nExpected: %s\nRecieved: %s", want, got)
+	}
+
+	if !deadlineSet {
+		t.Errorf("Command run without a deadline")
+	} else if deadline != now().Add(5*time.Second) {
+		t.Errorf("Command run with incorrect deadline")
+	}
+}
+
+func TestRetrieveExecutableSubjectTokenInvalidFormat(t *testing.T) {
+	cs := CredentialSource{
+		Executable: ExecutableConfig{
+			Command:       "blarg",
+			TimeoutMillis: 5000,
+		},
+	}
+
+	tfc := testFileConfig
+	tfc.CredentialSource = cs
+
+	oldGetenv, oldNow, oldRunCommand := getenv, now, runCommand
+	defer func() {
+		getenv, now, runCommand = oldGetenv, oldNow, oldRunCommand
+	}()
+
+	getenv = setEnvironment(map[string]string{"GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES": "1"})
+	now = setTime(defaultTime)
+	deadline, deadlineSet := now(), false
+	runCommand = func(ctx context.Context, command string, env []string) ([]byte, error) {
+		deadline, deadlineSet = ctx.Deadline()
+		return []byte("tokentokentoken"), nil
+	}
+
+	base, err := tfc.parse(context.Background())
+	if err != nil {
+		t.Fatalf("parse() failed %v", err)
+	}
+
+	_, err = base.subjectToken()
+	if err == nil {
+		t.Fatalf("Expected error but found none")
+	}
+	if got, want := err.Error(), "oauth2/google: Unable to parse response JSON."; got != want {
+		t.Errorf("Incorrect error received.\nExpected: %s\nRecieved: %s", want, got)
+	}
+
+	if !deadlineSet {
+		t.Errorf("Command run without a deadline")
+	} else if deadline != now().Add(5*time.Second) {
+		t.Errorf("Command run with incorrect deadline")
+	}
+}
+
+func TestRetrieveExecutableSubjectTokenMissingVersion(t *testing.T) {
+	cs := CredentialSource{
+		Executable: ExecutableConfig{
+			Command:       "blarg",
+			TimeoutMillis: 5000,
+		},
+	}
+
+	tfc := testFileConfig
+	tfc.CredentialSource = cs
+
+	oldGetenv, oldNow, oldRunCommand := getenv, now, runCommand
+	defer func() {
+		getenv, now, runCommand = oldGetenv, oldNow, oldRunCommand
+	}()
+
+	getenv = setEnvironment(map[string]string{"GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES": "1"})
+	now = setTime(defaultTime)
+	deadline, deadlineSet := now(), false
+	runCommand = func(ctx context.Context, command string, env []string) ([]byte, error) {
+		deadline, deadlineSet = ctx.Deadline()
+		return json.Marshal(subjectTokenResponse{
+			Success: Bool(true),
+		})
+	}
+
+	base, err := tfc.parse(context.Background())
+	if err != nil {
+		t.Fatalf("parse() failed %v", err)
+	}
+
+	_, err = base.subjectToken()
+	if err == nil {
+		t.Fatalf("Expected error but found none")
+	}
+	if got, want := err.Error(), "oauth2/google: Response missing version field."; got != want {
+		t.Errorf("Incorrect error received.\nExpected: %s\nRecieved: %s", want, got)
+	}
+
+	if !deadlineSet {
+		t.Errorf("Command run without a deadline")
+	} else if deadline != now().Add(5*time.Second) {
+		t.Errorf("Command run with incorrect deadline")
+	}
+}
+
+func TestRetrieveExecutableSubjectTokenMissingSuccess(t *testing.T) {
+	cs := CredentialSource{
+		Executable: ExecutableConfig{
+			Command:       "blarg",
+			TimeoutMillis: 5000,
+		},
+	}
+
+	tfc := testFileConfig
+	tfc.CredentialSource = cs
+
+	oldGetenv, oldNow, oldRunCommand := getenv, now, runCommand
+	defer func() {
+		getenv, now, runCommand = oldGetenv, oldNow, oldRunCommand
+	}()
+
+	getenv = setEnvironment(map[string]string{"GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES": "1"})
+	now = setTime(defaultTime)
+	deadline, deadlineSet := now(), false
+	runCommand = func(ctx context.Context, command string, env []string) ([]byte, error) {
+		deadline, deadlineSet = ctx.Deadline()
+		return json.Marshal(subjectTokenResponse{
+			Version: Int(1),
+		})
+	}
+
+	base, err := tfc.parse(context.Background())
+	if err != nil {
+		t.Fatalf("parse() failed %v", err)
+	}
+
+	_, err = base.subjectToken()
+	if err == nil {
+		t.Fatalf("Expected error but found none")
+	}
+	if got, want := err.Error(), "oauth2/google: Response missing success field."; got != want {
+		t.Errorf("Incorrect error received.\nExpected: %s\nRecieved: %s", want, got)
+	}
+
+	if !deadlineSet {
+		t.Errorf("Command run without a deadline")
+	} else if deadline != now().Add(5*time.Second) {
+		t.Errorf("Command run with incorrect deadline")
+	}
+}
+
+func TestRetrieveExecutableSubjectTokenUnsuccessfulResponseWithFields(t *testing.T) {
+	cs := CredentialSource{
+		Executable: ExecutableConfig{
+			Command:       "blarg",
+			TimeoutMillis: 5000,
+		},
+	}
+
+	tfc := testFileConfig
+	tfc.CredentialSource = cs
+
+	oldGetenv, oldNow, oldRunCommand := getenv, now, runCommand
+	defer func() {
+		getenv, now, runCommand = oldGetenv, oldNow, oldRunCommand
+	}()
+
+	getenv = setEnvironment(map[string]string{"GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES": "1"})
+	now = setTime(defaultTime)
+	deadline, deadlineSet := now(), false
+	runCommand = func(ctx context.Context, command string, env []string) ([]byte, error) {
+		deadline, deadlineSet = ctx.Deadline()
+		return json.Marshal(subjectTokenResponse{
+			Success: Bool(false),
+			Version: Int(1),
+			Code:    String("404"),
+			Message: String("Token Not Found"),
+		})
+	}
+
+	base, err := tfc.parse(context.Background())
+	if err != nil {
+		t.Fatalf("parse() failed %v", err)
+	}
+
+	_, err = base.subjectToken()
+	if err == nil {
+		t.Fatalf("Expected error but found none")
+	}
+	if got, want := err.Error(), "oauth2/google: Executable returned unsuccessful response: (404) Token Not Found."; got != want {
+		t.Errorf("Incorrect error received.\nExpected: %s\nRecieved: %s", want, got)
+	}
+
+	if !deadlineSet {
+		t.Errorf("Command run without a deadline")
+	} else if deadline != now().Add(5*time.Second) {
+		t.Errorf("Command run with incorrect deadline")
+	}
+}
+
+func TestRetrieveExecutableSubjectTokenUnsuccessfulResponseWithCode(t *testing.T) {
+	cs := CredentialSource{
+		Executable: ExecutableConfig{
+			Command:       "blarg",
+			TimeoutMillis: 5000,
+		},
+	}
+
+	tfc := testFileConfig
+	tfc.CredentialSource = cs
+
+	oldGetenv, oldNow, oldRunCommand := getenv, now, runCommand
+	defer func() {
+		getenv, now, runCommand = oldGetenv, oldNow, oldRunCommand
+	}()
+
+	getenv = setEnvironment(map[string]string{"GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES": "1"})
+	now = setTime(defaultTime)
+	deadline, deadlineSet := now(), false
+	runCommand = func(ctx context.Context, command string, env []string) ([]byte, error) {
+		deadline, deadlineSet = ctx.Deadline()
+		return json.Marshal(subjectTokenResponse{
+			Success: Bool(false),
+			Version: Int(1),
+			Code:    String("404"),
+		})
+	}
+
+	base, err := tfc.parse(context.Background())
+	if err != nil {
+		t.Fatalf("parse() failed %v", err)
+	}
+
+	_, err = base.subjectToken()
+	if err == nil {
+		t.Fatalf("Expected error but found none")
+	}
+	if got, want := err.Error(), "oauth2/google: Executable returned unsuccessful response: (404)."; got != want {
+		t.Errorf("Incorrect error received.\nExpected: %s\nRecieved: %s", want, got)
+	}
+
+	if !deadlineSet {
+		t.Errorf("Command run without a deadline")
+	} else if deadline != now().Add(5*time.Second) {
+		t.Errorf("Command run with incorrect deadline")
+	}
+}
+
+func TestRetrieveExecutableSubjectTokenUnsuccessfulResponseWithMessage(t *testing.T) {
+	cs := CredentialSource{
+		Executable: ExecutableConfig{
+			Command:       "blarg",
+			TimeoutMillis: 5000,
+		},
+	}
+
+	tfc := testFileConfig
+	tfc.CredentialSource = cs
+
+	oldGetenv, oldNow, oldRunCommand := getenv, now, runCommand
+	defer func() {
+		getenv, now, runCommand = oldGetenv, oldNow, oldRunCommand
+	}()
+
+	getenv = setEnvironment(map[string]string{"GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES": "1"})
+	now = setTime(defaultTime)
+	deadline, deadlineSet := now(), false
+	runCommand = func(ctx context.Context, command string, env []string) ([]byte, error) {
+		deadline, deadlineSet = ctx.Deadline()
+		return json.Marshal(subjectTokenResponse{
+			Success: Bool(false),
+			Version: Int(1),
+			Message: String("Token Not Found"),
+		})
+	}
+
+	base, err := tfc.parse(context.Background())
+	if err != nil {
+		t.Fatalf("parse() failed %v", err)
+	}
+
+	_, err = base.subjectToken()
+	if err == nil {
+		t.Fatalf("Expected error but found none")
+	}
+	if got, want := err.Error(), "oauth2/google: Executable returned unsuccessful response: Token Not Found."; got != want {
+		t.Errorf("Incorrect error received.\nExpected: %s\nRecieved: %s", want, got)
+	}
+
+	if !deadlineSet {
+		t.Errorf("Command run without a deadline")
+	} else if deadline != now().Add(5*time.Second) {
+		t.Errorf("Command run with incorrect deadline")
+	}
+}
+
+func TestRetrieveExecutableSubjectTokenUnsuccessfulResponseWithoutFields(t *testing.T) {
+	cs := CredentialSource{
+		Executable: ExecutableConfig{
+			Command:       "blarg",
+			TimeoutMillis: 5000,
+		},
+	}
+
+	tfc := testFileConfig
+	tfc.CredentialSource = cs
+
+	oldGetenv, oldNow, oldRunCommand := getenv, now, runCommand
+	defer func() {
+		getenv, now, runCommand = oldGetenv, oldNow, oldRunCommand
+	}()
+
+	getenv = setEnvironment(map[string]string{"GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES": "1"})
+	now = setTime(defaultTime)
+	deadline, deadlineSet := now(), false
+	runCommand = func(ctx context.Context, command string, env []string) ([]byte, error) {
+		deadline, deadlineSet = ctx.Deadline()
+		return json.Marshal(subjectTokenResponse{
+			Success: Bool(false),
+			Version: Int(1),
+		})
+	}
+
+	base, err := tfc.parse(context.Background())
+	if err != nil {
+		t.Fatalf("parse() failed %v", err)
+	}
+
+	_, err = base.subjectToken()
+	if err == nil {
+		t.Fatalf("Expected error but found none")
+	}
+	if got, want := err.Error(), "oauth2/google: Executable returned unsuccessful response: Unknown Error."; got != want {
+		t.Errorf("Incorrect error received.\nExpected: %s\nRecieved: %s", want, got)
+	}
+
+	if !deadlineSet {
+		t.Errorf("Command run without a deadline")
+	} else if deadline != now().Add(5*time.Second) {
+		t.Errorf("Command run with incorrect deadline")
+	}
+}
+
+func TestRetrieveExecutableSubjectTokenNewerVersion(t *testing.T) {
+	cs := CredentialSource{
+		Executable: ExecutableConfig{
+			Command:       "blarg",
+			TimeoutMillis: 5000,
+		},
+	}
+
+	tfc := testFileConfig
+	tfc.CredentialSource = cs
+
+	oldGetenv, oldNow, oldRunCommand := getenv, now, runCommand
+	defer func() {
+		getenv, now, runCommand = oldGetenv, oldNow, oldRunCommand
+	}()
+
+	getenv = setEnvironment(map[string]string{"GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES": "1"})
+	now = setTime(defaultTime)
+	deadline, deadlineSet := now(), false
+	runCommand = func(ctx context.Context, command string, env []string) ([]byte, error) {
+		deadline, deadlineSet = ctx.Deadline()
+		return json.Marshal(subjectTokenResponse{
+			Success: Bool(true),
+			Version: Int(2),
+		})
+	}
+
+	base, err := tfc.parse(context.Background())
+	if err != nil {
+		t.Fatalf("parse() failed %v", err)
+	}
+
+	_, err = base.subjectToken()
+	if err == nil {
+		t.Fatalf("Expected error but found none")
+	}
+	if got, want := err.Error(), "oauth2/google: Executable returned unsupported version: 2."; got != want {
+		t.Errorf("Incorrect error received.\nExpected: %s\nRecieved: %s", want, got)
+	}
+
+	if !deadlineSet {
+		t.Errorf("Command run without a deadline")
+	} else if deadline != now().Add(5*time.Second) {
+		t.Errorf("Command run with incorrect deadline")
+	}
+}
+
+func TestRetrieveExecutableSubjectTokenExpired(t *testing.T) {
+	cs := CredentialSource{
+		Executable: ExecutableConfig{
+			Command:       "blarg",
+			TimeoutMillis: 5000,
+		},
+	}
+
+	tfc := testFileConfig
+	tfc.CredentialSource = cs
+
+	oldGetenv, oldNow, oldRunCommand := getenv, now, runCommand
+	defer func() {
+		getenv, now, runCommand = oldGetenv, oldNow, oldRunCommand
+	}()
+
+	getenv = setEnvironment(map[string]string{"GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES": "1"})
+	now = setTime(defaultTime)
+	deadline, deadlineSet := now(), false
+	runCommand = func(ctx context.Context, command string, env []string) ([]byte, error) {
+		deadline, deadlineSet = ctx.Deadline()
+		return json.Marshal(subjectTokenResponse{
+			Success:        Bool(true),
+			Version:        Int(1),
+			ExpirationTime: Int64(now().Unix() - 1),
+			TokenType:      String("urn:ietf:params:oauth:token-type:jwt"),
+		})
+	}
+
+	base, err := tfc.parse(context.Background())
+	if err != nil {
+		t.Fatalf("parse() failed %v", err)
+	}
+
+	_, err = base.subjectToken()
+	if err == nil {
+		t.Fatalf("Expected error but found none")
+	}
+	if got, want := err.Error(), "oauth2/google: The token returned by the executable is expired."; got != want {
+		t.Errorf("Incorrect error received.\nExpected: %s\nRecieved: %s", want, got)
+	}
+
+	if !deadlineSet {
+		t.Errorf("Command run without a deadline")
+	} else if deadline != now().Add(5*time.Second) {
+		t.Errorf("Command run with incorrect deadline")
+	}
+}
+
+func TestRetrieveExecutableSubjectTokenJwt(t *testing.T) {
+	cs := CredentialSource{
+		Executable: ExecutableConfig{
+			Command:       "blarg",
+			TimeoutMillis: 5000,
+		},
+	}
+
+	tfc := testFileConfig
+	tfc.CredentialSource = cs
+
+	oldGetenv, oldNow, oldRunCommand := getenv, now, runCommand
+	defer func() {
+		getenv, now, runCommand = oldGetenv, oldNow, oldRunCommand
+	}()
+
+	getenv = setEnvironment(map[string]string{"GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES": "1"})
+	now = setTime(defaultTime)
+	deadline, deadlineSet := now(), false
+	runCommand = func(ctx context.Context, command string, env []string) ([]byte, error) {
+		deadline, deadlineSet = ctx.Deadline()
+		return json.Marshal(subjectTokenResponse{
+			Success:        Bool(true),
+			Version:        Int(1),
+			ExpirationTime: Int64(now().Unix() + 3600),
+			TokenType:      String("urn:ietf:params:oauth:token-type:jwt"),
+			IdToken:        String("tokentokentoken"),
+		})
+	}
+
+	base, err := tfc.parse(context.Background())
+	if err != nil {
+		t.Fatalf("parse() failed %v", err)
+	}
+
+	out, err := base.subjectToken()
+	if err != nil {
+		t.Fatalf("retrieveSubjectToken() failed: %v", err)
+	}
+
+	if !deadlineSet {
+		t.Errorf("Command run without a deadline")
+	} else if deadline != now().Add(5*time.Second) {
+		t.Errorf("Command run with incorrect deadline")
+	}
+
+	if got, want := out, "tokentokentoken"; got != want {
+		t.Errorf("Incorrect token received.\nExpected: %s\nRecieved: %s", want, got)
+	}
+}
+
+func TestRetrieveExecutableSubjectTokenJwtMissingIdToken(t *testing.T) {
+	cs := CredentialSource{
+		Executable: ExecutableConfig{
+			Command:       "blarg",
+			TimeoutMillis: 5000,
+		},
+	}
+
+	tfc := testFileConfig
+	tfc.CredentialSource = cs
+
+	oldGetenv, oldNow, oldRunCommand := getenv, now, runCommand
+	defer func() {
+		getenv, now, runCommand = oldGetenv, oldNow, oldRunCommand
+	}()
+
+	getenv = setEnvironment(map[string]string{"GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES": "1"})
+	now = setTime(defaultTime)
+	deadline, deadlineSet := now(), false
+	runCommand = func(ctx context.Context, command string, env []string) ([]byte, error) {
+		deadline, deadlineSet = ctx.Deadline()
+		return json.Marshal(subjectTokenResponse{
+			Success:        Bool(true),
+			Version:        Int(1),
+			ExpirationTime: Int64(now().Unix() + 3600),
+			TokenType:      String("urn:ietf:params:oauth:token-type:jwt"),
+		})
+	}
+
+	base, err := tfc.parse(context.Background())
+	if err != nil {
+		t.Fatalf("parse() failed %v", err)
+	}
+
+	_, err = base.subjectToken()
+	if err == nil {
+		t.Fatalf("Expected error but found none")
+	}
+	if got, want := err.Error(), "oauth2/google: Response missing id_token field."; got != want {
+		t.Errorf("Incorrect error received.\nExpected: %s\nRecieved: %s", want, got)
+	}
+
+	if !deadlineSet {
+		t.Errorf("Command run without a deadline")
+	} else if deadline != now().Add(5*time.Second) {
+		t.Errorf("Command run with incorrect deadline")
+	}
+}
+
+func TestRetrieveExecutableSubjectTokenIdToken(t *testing.T) {
+	cs := CredentialSource{
+		Executable: ExecutableConfig{
+			Command:       "blarg",
+			TimeoutMillis: 5000,
+		},
+	}
+
+	tfc := testFileConfig
+	tfc.CredentialSource = cs
+
+	oldGetenv, oldNow, oldRunCommand := getenv, now, runCommand
+	defer func() {
+		getenv, now, runCommand = oldGetenv, oldNow, oldRunCommand
+	}()
+
+	getenv = setEnvironment(map[string]string{"GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES": "1"})
+	now = setTime(defaultTime)
+	deadline, deadlineSet := now(), false
+	runCommand = func(ctx context.Context, command string, env []string) ([]byte, error) {
+		deadline, deadlineSet = ctx.Deadline()
+		return json.Marshal(subjectTokenResponse{
+			Success:        Bool(true),
+			Version:        Int(1),
+			ExpirationTime: Int64(now().Unix() + 3600),
+			TokenType:      String("urn:ietf:params:oauth:token-type:id_token"),
+			IdToken:        String("tokentokentoken"),
+		})
+	}
+
+	base, err := tfc.parse(context.Background())
+	if err != nil {
+		t.Fatalf("parse() failed %v", err)
+	}
+
+	out, err := base.subjectToken()
+	if err != nil {
+		t.Fatalf("retrieveSubjectToken() failed: %v", err)
+	}
+
+	if !deadlineSet {
+		t.Errorf("Command run without a deadline")
+	} else if deadline != now().Add(5*time.Second) {
+		t.Errorf("Command run with incorrect deadline")
+	}
+
+	if got, want := out, "tokentokentoken"; got != want {
+		t.Errorf("Incorrect token received.\nExpected: %s\nRecieved: %s", want, got)
+	}
+}
+
+func TestRetrieveExecutableSubjectTokenSaml(t *testing.T) {
+	cs := CredentialSource{
+		Executable: ExecutableConfig{
+			Command:       "blarg",
+			TimeoutMillis: 5000,
+		},
+	}
+
+	tfc := testFileConfig
+	tfc.CredentialSource = cs
+
+	oldGetenv, oldNow, oldRunCommand := getenv, now, runCommand
+	defer func() {
+		getenv, now, runCommand = oldGetenv, oldNow, oldRunCommand
+	}()
+
+	getenv = setEnvironment(map[string]string{"GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES": "1"})
+	now = setTime(defaultTime)
+	deadline, deadlineSet := now(), false
+	runCommand = func(ctx context.Context, command string, env []string) ([]byte, error) {
+		deadline, deadlineSet = ctx.Deadline()
+		return json.Marshal(subjectTokenResponse{
+			Success:        Bool(true),
+			Version:        Int(1),
+			ExpirationTime: Int64(now().Unix() + 3600),
+			TokenType:      String("urn:ietf:params:oauth:token-type:saml2"),
+			SamlResponse:   String("tokentokentoken"),
+		})
+	}
+
+	base, err := tfc.parse(context.Background())
+	if err != nil {
+		t.Fatalf("parse() failed %v", err)
+	}
+
+	out, err := base.subjectToken()
+	if err != nil {
+		t.Fatalf("retrieveSubjectToken() failed: %v", err)
+	}
+
+	if !deadlineSet {
+		t.Errorf("Command run without a deadline")
+	} else if deadline != now().Add(5*time.Second) {
+		t.Errorf("Command run with incorrect deadline")
+	}
+
+	if got, want := out, "tokentokentoken"; got != want {
+		t.Errorf("Incorrect token received.\nExpected: %s\nRecieved: %s", want, got)
+	}
+}
+
+func TestRetrieveExecutableSubjectTokenSamlMissingResponse(t *testing.T) {
+	cs := CredentialSource{
+		Executable: ExecutableConfig{
+			Command:       "blarg",
+			TimeoutMillis: 5000,
+		},
+	}
+
+	tfc := testFileConfig
+	tfc.CredentialSource = cs
+
+	oldGetenv, oldNow, oldRunCommand := getenv, now, runCommand
+	defer func() {
+		getenv, now, runCommand = oldGetenv, oldNow, oldRunCommand
+	}()
+
+	getenv = setEnvironment(map[string]string{"GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES": "1"})
+	now = setTime(defaultTime)
+	deadline, deadlineSet := now(), false
+	runCommand = func(ctx context.Context, command string, env []string) ([]byte, error) {
+		deadline, deadlineSet = ctx.Deadline()
+		return json.Marshal(subjectTokenResponse{
+			Success:        Bool(true),
+			Version:        Int(1),
+			ExpirationTime: Int64(now().Unix() + 3600),
+			TokenType:      String("urn:ietf:params:oauth:token-type:saml2"),
+		})
+	}
+
+	base, err := tfc.parse(context.Background())
+	if err != nil {
+		t.Fatalf("parse() failed %v", err)
+	}
+
+	_, err = base.subjectToken()
+	if err == nil {
+		t.Fatalf("Expected error but found none")
+	}
+	if got, want := err.Error(), "oauth2/google: Response missing saml_response field."; got != want {
+		t.Errorf("Incorrect error received.\nExpected: %s\nRecieved: %s", want, got)
+	}
+
+	if !deadlineSet {
+		t.Errorf("Command run without a deadline")
+	} else if deadline != now().Add(5*time.Second) {
+		t.Errorf("Command run with incorrect deadline")
+	}
+}