2 files changed, 23 insertions, 1 deletions
diff --git a/src/python/grpcio_test/grpc_interop/client.py b/src/python/grpcio_test/grpc_interop/client.py
index 2dd2103cbe..36afe6c096 100644
--- a/src/python/grpcio_test/grpc_interop/client.py
+++ b/src/python/grpcio_test/grpc_interop/client.py
@@ -70,7 +70,13 @@ def _oauth_access_token(args):
 
 def _stub(args):
   if args.oauth_scope:
-    metadata_transformer = lambda x: [('Authorization', 'Bearer %s' % _oauth_access_token(args))]
+    if args.test_case == 'oauth2_auth_token':
+      access_token = _oauth_access_token(args)
+      metadata_transformer = lambda x: [
+          ('Authorization', 'Bearer %s' % access_token)]
+    else:
+      metadata_transformer = lambda x: [
+          ('Authorization', 'Bearer %s' % _oauth_access_token(args))]
   else:
     metadata_transformer = lambda x: []
   if args.use_tls:
diff --git a/src/python/grpcio_test/grpc_interop/methods.py b/src/python/grpcio_test/grpc_interop/methods.py
index 7a831f3cbd..642458e892 100644
--- a/src/python/grpcio_test/grpc_interop/methods.py
+++ b/src/python/grpcio_test/grpc_interop/methods.py
@@ -360,6 +360,19 @@ def _service_account_creds(stub, args):
             (response.oauth_scope, args.oauth_scope))
 
 
+def _oauth2_auth_token(stub, args):
+  json_key_filename = os.environ[
+      oauth2client_client.GOOGLE_APPLICATION_CREDENTIALS]
+  wanted_email = json.load(open(json_key_filename, 'rb'))['client_email']
+  response = _large_unary_common_behavior(stub, True, True)
+  if wanted_email != response.username:
+    raise ValueError(
+        'expected username %s, got %s' % (wanted_email, response.username))
+  if args.oauth_scope.find(response.oauth_scope) == -1:
+    raise ValueError(
+        'expected to find oauth scope "%s" in received "%s"' %
+            (response.oauth_scope, args.oauth_scope))
+
 @enum.unique
 class TestCase(enum.Enum):
   EMPTY_UNARY = 'empty_unary'
@@ -371,6 +384,7 @@ class TestCase(enum.Enum):
   CANCEL_AFTER_FIRST_RESPONSE = 'cancel_after_first_response'
   COMPUTE_ENGINE_CREDS = 'compute_engine_creds'
   SERVICE_ACCOUNT_CREDS = 'service_account_creds'
+  OAUTH2_AUTH_TOKEN = 'oauth2_auth_token'
   TIMEOUT_ON_SLEEPING_SERVER = 'timeout_on_sleeping_server'
 
   def test_interoperability(self, stub, args):
@@ -394,5 +408,7 @@ class TestCase(enum.Enum):
       _compute_engine_creds(stub, args)
     elif self is TestCase.SERVICE_ACCOUNT_CREDS:
       _service_account_creds(stub, args)
+    elif self is TestCase.OAUTH2_AUTH_TOKEN:
+      _oauth2_auth_token(stub, args)
     else:
       raise NotImplementedError('Test case "%s" not implemented!' % self.name)