Migrate to use google-auth

[liyanhui1228]

oauth2client is deprecated: https://google-auth.readthedocs.io/en/latest/oauth2client-deprecation.html

Stay depending on the deprecated dependency will cause conflicts with other google cloud libraries.

[houglum]

This will be feasible once GoogleCloudPlatform/google-auth-library-python has feature parity with oauth2client (e.g. supporting 2FA via google/google-reauth-python). At that point, the amount of work is still significant, as we'll have to rewrite additional functionality we don't have for google-auth yet (and probably never will, given that part of the reason for writing google-auth was to get rid of the out-of-scope functionality and cruft that had accumulated in oauth2client). This includes, but probably isn't limited to:

• Writing our own credential caching logic (we're currently using oauth2client's), including file locking or some mechanism to provide cross-thread/cross-process synchronization
• Rewriting the plugins at GoogleCloudPlatform/gcs-oauth2-boto-plugin to use google-auth -- this is needed for authenticating requests to our XML API using oauth2 credentials. Note that credentials are cached differently with this library than for credentials when using the JSON API, so this might be a good opportunity to synchronize the two methods of credential caching.
• Having replacement plugins and credential classes for every credential type (we make use of the credential subclasses in oauth2client.contrib to support environment-specific credentials like devshell.py, gce.py, etc.)
• Making sure credential-specific error handling and logging, once migrated over to the new auth library, are correct and provide sufficient information for debugging

TL;DR: This isn't going to happen anytime soon :( There's quite a bit of work necessary to attain feature parity and transition all the libraries/code paths, and it will require lots of engineering time.

[liyanhui1228]

Thanks Matt for the comment! This is not urgent for now, but it's definitely something we should do at some point to ensure the dependency versions stay compatible with other libraries. Let's keep this issue open for tracking.