Expose id_token in OAuth 2.0 credentials

google/oauth2/credentials.py

@@ -67,6 +67,7 @@ def __init__(self, token, refresh_token=None, token_uri=None,
         self._token_uri = token_uri
         self._client_id = client_id
         self._client_secret = client_secret
+        self._refresh_grant_response = None
 
     @property
     def refresh_token(self):
@@ -89,6 +90,17 @@ def client_secret(self):
         """Optional[str]: The OAuth 2.0 client secret."""
         return self._client_secret
 
+    @property
+    def refresh_grant_response(self):
+        """Optional[str]: The last response from the OAuth 2.0 token server.
+
+        This is set when :meth:`refresh` is called and will not be populated
+        otherwise. This is provided because some authorization servers will
+        send along additional information other than the access and refresh
+        tokens in the refresh grant response.
+        """
+        return self._refresh_grant_response
+
     @property
     def requires_scopes(self):
         """False: OAuth 2.0 credentials have their scopes set when
@@ -106,10 +118,12 @@ def with_scopes(self, scopes):
 
     @_helpers.copy_docstring(credentials.Credentials)
     def refresh(self, request):
-        access_token, refresh_token, expiry, _ = _client.refresh_grant(
-            request, self._token_uri, self._refresh_token, self._client_id,
-            self._client_secret)
+        access_token, refresh_token, expiry, grant_response = (
+            _client.refresh_grant(
+                request, self._token_uri, self._refresh_token, self._client_id,
+                self._client_secret))
 
         self.token = access_token
         self.expiry = expiry
         self._refresh_token = refresh_token
+        self._refresh_grant_response = grant_response

google/oauth2/service_account.py

@@ -148,6 +148,8 @@ def __init__(self, signer, service_account_email, token_uri, scopes=None,
         else:
             self._additional_claims = {}
 
+        self._refresh_grant_response = None
+
     @classmethod
     def _from_signer_and_info(cls, signer, info, **kwargs):
         """Creates a Credentials instance from a signer and service account
@@ -205,6 +207,17 @@ def from_service_account_file(cls, filename, **kwargs):
             filename, require=['client_email', 'token_uri'])
         return cls._from_signer_and_info(signer, info, **kwargs)
 
+    @property
+    def refresh_grant_response(self):
+        """Optional[str]: The last response from the OAuth 2.0 token server.
+
+        This is set when :meth:`refresh` is called and will not be populated
+        otherwise. This is provided because some authorization servers will
+        send along additional information other than the access and refresh
+        tokens in the refresh grant response.
+        """
+        return self._refresh_grant_response
+
     @property
     def service_account_email(self):
         """The service account email."""
@@ -306,10 +319,11 @@ def _make_authorization_grant_assertion(self):
     @_helpers.copy_docstring(credentials.Credentials)
     def refresh(self, request):
         assertion = self._make_authorization_grant_assertion()
-        access_token, expiry, _ = _client.jwt_grant(
+        access_token, expiry, refresh_grant_response = _client.jwt_grant(
             request, self._token_uri, assertion)
         self.token = access_token
         self.expiry = expiry
+        self._refresh_grant_response = refresh_grant_response
 
     @_helpers.copy_docstring(credentials.Signing)
     def sign_bytes(self, message):

tests/oauth2/test_credentials.py

@@ -58,6 +58,7 @@ def test_create_scoped(self):
     def test_refresh_success(self, now_mock, refresh_grant_mock):
         token = 'token'
         expiry = _helpers.utcnow() + datetime.timedelta(seconds=500)
+        grant_response = {'meep': 'moop'}
         refresh_grant_mock.return_value = (
             # Access token
             token,
@@ -66,7 +67,7 @@ def test_refresh_success(self, now_mock, refresh_grant_mock):
             # Expiry,
             expiry,
             # Extra data
-            {})
+            grant_response)
         request_mock = mock.Mock()
 
         # Refresh credentials
@@ -80,6 +81,7 @@ def test_refresh_success(self, now_mock, refresh_grant_mock):
         # Check that the credentials have the token and expiry
         assert self.credentials.token == token
         assert self.credentials.expiry == expiry
+        assert self.credentials.refresh_grant_response == grant_response
 
         # Check that the credentials are valid (have a token and are not
         # expired)

tests/oauth2/test_service_account.py

@@ -161,8 +161,11 @@ def test__make_authorization_grant_assertion_subject(self):
     @mock.patch('google.oauth2._client.jwt_grant', autospec=True)
     def test_refresh_success(self, jwt_grant_mock):
         token = 'token'
+        grant_response = {'meep': 'moop'}
         jwt_grant_mock.return_value = (
-            token, _helpers.utcnow() + datetime.timedelta(seconds=500), None)
+            token,
+            _helpers.utcnow() + datetime.timedelta(seconds=500),
+            grant_response)
         request_mock = mock.Mock()
 
         # Refresh credentials
@@ -179,6 +182,7 @@ def test_refresh_success(self, jwt_grant_mock):
 
         # Check that the credentials have the token.
         assert self.credentials.token == token
+        assert self.credentials.refresh_grant_response == grant_response
 
         # Check that the credentials are valid (have a token and are not
         # expired)