tree b7c94cd62c0d46cde14b4d8f1018e0e196e03b6e
parent d95127a2651d8a9cf46d28416cacbf1ce66ee8a4
author Michael Pratt <mpratt@google.com> 1744959386 -0400
committer Michael Pratt <mpratt@google.com> 1745257820 -0700

internal/access: use JWT for identity

Per
https://cloud.google.com/iap/docs/signed-headers-howto#retrieving_the_user_identity,
we should use the identity from the authenticated JWT, not the header.

Note that the email here does not have the "accounts.google.com:"
prefix.

Change-Id: I6a6a636c99243284be2f3d094e299d5e6ff09291
Reviewed-on: https://go-review.googlesource.com/c/build/+/666496
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Carlos Amedee <carlos@golang.org>