Domain-wide Delegation only works when providing credentials via `keyFile`

It seems that making API calls (e.g., to the Google Drive API) impersonating another user via Domain-Wide Delegation only works when creating a client using the keyFile option (and not when relying on automatically provided auth credentials).

Specifically, I am trying to call the Google Drive API from a Google Cloud Function. I rely on the "Default App Engine Service Account" for authorizing my client:

// here, credentials are automatically obtained by getClient:
const auth = await google.auth.getClient({
  clientOptions: {
    subject: 'email@to.impersonate',
  },
  scopes: [ /* list of required scopes */ ],
});
const driveAPI = google.drive({ version: 'v3', auth });

// make some requests - however, they are NOT made by  'email@to.impersonate',
// but by the Default App Engine Service Account :(

The above code works, but requests are not made as email@to.impersonate, but instead as the Default App Engine Service Account. To be clear, I have configured Domain-Wide Delegation for the Default App Engine Service Account in the Google Workspaces Admin UI (https://admin.google.com).

Now, the above code does work once I slightly extend it by providing the Default App Engine Service Account's credentials via the keyFile option:

// here, credentials are explicitly provided via keyFile:
const auth = await google.auth.getClient({
  clientOptions: {
    subject: 'email@to.impersonate',
  },
  keyFile: './path/to/keyFile.json',
  scopes: [ /* list of required scopes */ ],
});
const driveAPI = google.drive({ version: 'v3', auth });

// make some requests - they are now made as 'email@to.impersonate' :)

Ideally, I'd like to avoid having to manually provide the Default App Engine Service Account credentials using a file.

It seems this issue was mentioned as part of discussions around https://github.com/googleapis/google-cloud-node/issues/7801, specifically in this comment https://github.com/googleapis/google-cloud-node/issues/7801.

Environment details

• OS: Google Cloud functions
• Node.js version: 16
• npm version: 7 (?)
• googleapis version: 105.0.0

Beginne beim automatischen Anmeldedatenpfad, den google.auth.getClient in einer Google Cloud Function verwendet, und vergleiche ihn anschließend mit dem in den Beispielen gezeigten keyFile-Pfad. Führe die Google-Drive-Anfrage mit clientOptions.subject erneut aus und überprüfe, dass der impersonierte Benutzer und nicht das standardmäßige Dienstkonto ohne eine Anmeldedatendatei verwendet wird.