class Google::Auth::ExternalAccount::PluggableAuthCredentials

def parse_subject_token response
  validate_response_schema response
  unless response[:success]
    if response[:code].nil? || response[:message].nil?
      raise "Error code and message fields are required in the response."
    end
    raise "Executable returned unsuccessful response: code: #{response[:code]}, message: #{response[:message]}."
  end
  if response[:expiration_time] && response[:expiration_time] < Time.now.to_i
    raise "The token returned by the executable is expired."
  end
  raise "The executable response is missing the token_type field." if response[:token_type].nil?
  return response[:id_token] if ID_TOKEN_TYPE.include? response[:token_type]
  return response[:saml_response] if response[:token_type] == "urn:ietf:params:oauth:token-type:saml2"
  raise "Executable returned unsupported token type."
end