class ServiceAccountProvider extends AbstractProvider {

    @Override
    public AccessToken getAccessToken(String googleIdentity, List<String> scopes) {
        if (! googleIdentity.endsWith(".iam.gserviceaccount.com")) {
            throw new IllegalArgumentException("Google identity `" + googleIdentity + "` is not a service account");
        }
        try {
            GoogleCredentials credentials = GoogleCredentials.getApplicationDefault();
            ImpersonatedCredentials impersonatedCredentials = ImpersonatedCredentials.create(credentials, googleIdentity, null, scopes, 3600);
            com.google.auth.oauth2.AccessToken token = impersonatedCredentials.refreshAccessToken();
            return new AccessToken(token.getTokenValue(), token.getExpirationTime().getTime());
        } catch (IOException e) {
            throw Status.PERMISSION_DENIED.asRuntimeException();
        }
    }

}