Repository: googleapis/google-cloud-python

Issue:
[Spanner] credentials object not passed into InstanceAdminAPI
Hi Folks,

I don't see that the credentials I pass into the Spanner Client are being used for the [InstanceAdminClient](https://github.com/GoogleCloudPlatform/google-cloud-python/blob/f4cb0eeea38606e90c86391e559526d9bffbd4b0/spanner/google/cloud/spanner/client.py#L156) or [DatabaseAdminClient](https://github.com/GoogleCloudPlatform/google-cloud-python/blob/f4cb0eeea38606e90c86391e559526d9bffbd4b0/spanner/google/cloud/spanner/client.py#L166) instantiations.  I'm chasing a downstream bug and will fill in details soon, but from what I see, defaultcredentials are assumed to be used when using those APIs, whereas it should use the provided credentials object.

1. OS type and version
CentOS
2. Python version and virtual environment information `python --version`
Python 2.7.9
3. google-cloud-python version `pip show google-cloud`, `pip show google-<service>` or `pip freeze`

```
gapic-google-cloud-spanner-admin-database-v1==0.15.0
gapic-google-cloud-spanner-admin-instance-v1==0.15.0
gapic-google-cloud-spanner-v1==0.15.0
google-auth==0.8.0
google-auth-httplib2==0.0.2
google-cloud-core==0.23.1
google-cloud-spanner==0.23.1
google-compute-engine==2.3.2
google-gax==0.15.6
googleapis-common-protos==1.5.2
grpc-google-iam-v1==0.11.1
grpcio==1.1.3
```
4. Stacktrace if available
5. Steps to reproduce
* Create credentials with a service account.  Make sure default credentials will fail.
* Try to interact with an instance.

6. Code example
```
import google.auth.credentials
from google.cloud import spanner
from google.oauth2 import service_account
SPANNER_ADMIN_SCOPE = 'https://www.googleapis.com/auth/spanner.admin'
JSON_KEY='/home/me/keys/mykey.json'

credentials = service_account.Credentials.from_service_account_file(
                JSON_KEY)
scopes = [ SPANNER_ADMIN_SCOPE ]
credentials = credentials.with_scopes(scopes)
# credentials = google.auth.credentials.with_scopes_if_required(credentials, scopes)
sc = spanner.Client(project='my-project, credentials=credentials)

i = sc.instance('my-instance', configuration_name='regionally-us-central1')
i.exists()
```

I checked these sites before filing:
- https://github.com/GoogleCloudPlatform/google-cloud-python/issues
- http://stackoverflow.com/questions/tagged/google-cloud-python



Discussion:
Thanks for raising this issue. It looks like a bug; we will look into it soon.
On this now.

Resolving patch:
diff --git a/spanner/google/cloud/spanner/client.py b/spanner/google/cloud/spanner/client.py
--- a/spanner/google/cloud/spanner/client.py
+++ b/spanner/google/cloud/spanner/client.py
@@ -154,6 +154,7 @@ def instance_admin_api(self):
         """Helper for session-related API calls."""
         if self._instance_admin_api is None:
             self._instance_admin_api = InstanceAdminClient(
+                credentials=self.credentials,
                 lib_name='gccl',
                 lib_version=__version__,
             )
@@ -164,6 +165,7 @@ def database_admin_api(self):
         """Helper for session-related API calls."""
         if self._database_admin_api is None:
             self._database_admin_api = DatabaseAdminClient(
+                credentials=self.credentials,
                 lib_name='gccl',
                 lib_version=__version__,
             )


Test patch:
diff --git a/spanner/tests/unit/test_client.py b/spanner/tests/unit/test_client.py
--- a/spanner/tests/unit/test_client.py
+++ b/spanner/tests/unit/test_client.py
@@ -164,6 +164,7 @@ def __init__(self, *args, **kwargs):
         again = client.instance_admin_api
         self.assertTrue(again is api)
         self.assertEqual(api.kwargs['lib_name'], 'gccl')
+        self.assertIs(api.kwargs['credentials'], client.credentials)
 
     def test_database_admin_api(self):
         from google.cloud._testing import _Monkey
@@ -184,6 +185,7 @@ def __init__(self, *args, **kwargs):
         again = client.database_admin_api
         self.assertTrue(again is api)
         self.assertEqual(api.kwargs['lib_name'], 'gccl')
+        self.assertIs(api.kwargs['credentials'], client.credentials)
 
     def test_copy(self):
         credentials = _Credentials('value')