User Impersonation with Google Service Account

[hsw48]

Hi. I'm trying to implement user impersonation with a google service account and have been having problems for a while. After adding the user to be impersonated as the subject, a token gets created but when calling an API like Google Calendar I get a 401 Invalid Credentials error as if the token that was just created has expired or is invalid.

Do you have any samples of user impersonation? I don't see any in the samples or using Node in Google's documentation. Here is their documentation on the subject: https://developers.google.com/identity/protocols/oauth2/service-account#delegate-domain-wide-authority

Thanks a lot.

[shierro]

i am unable to impersonate successfully as well.

Error, code 401

unauthorized_client: Client is unauthorized to retrieve access tokens using this method, or client not authorized for any of the scopes requested.

const googleService = {};

const authClient = google.auth.fromJSON(serviceJson);
authClient.scopes = [
  'https://www.googleapis.com/auth/calendar',
  'https://www.googleapis.com/auth/calendar.events',
];
authClient.subject = 'email@domain.com.au';
googleService.authClient = authClient;

async function addGuestAndSendEmail(eventId, calendarId, newGuest) {
  const {
    data: { attendees = [] },
  } = await googleService.event.get(eventId, calendarId);
  attendees.push({ email: newGuest });
  return calendar.events.patch({
    calendarId,
    eventId,
    auth: googleService.authClient,
    requestBody: {
      sendUpdates: 'all',
      attendees,
    },
  });
}

service account where I got serviceJson
Enable G Suite Domain-wide Delegation - check

service account granted access on google admin
Calendar (Read-Write) https://www.googleapis.com/auth/calendar
https://www.googleapis.com/auth/calendar.events

Badly need help :((

[shierro]

without authClient.subject, i get error code 403

Service accounts cannot invite attendees without Domain-Wide Delegation of Authority.

[shierro]

also tried

    const authClient = new google.auth.JWT({
      email: serviceJson.client_email,
      key: serviceJson.private_key,
      scopes: [
        'https://www.googleapis.com/auth/calendar',
        'https://www.googleapis.com/auth/calendar.events',
        'https://www.googleapis.com/auth/cloud-platform',
      ],
      subject: 'email@domain.com.au',
    });
    googleService.authClient = authClient;

with error

unauthorized_client: Client is unauthorized to retrieve access tokens using this method, or client not authorized for any of the scopes requested

[shierro]

I was able to do impersonation with official python client library, so I suspect there's something wrong with this NodeJS client

[bcoe]

There's an outstanding PR, #779, to add support for impersonation. Perhaps try this as a starting point, and see if the approach would work for you?

[charlesjacobsonrarebirds]

Hey @bcoe thanks for pointing out the PR, I wish to have seen this a few days ago 😄 We've finished the feature in the python client so I think I'll be delayed in testing the PR

[shierro]

i tried to impersonate a user under the domain but it didn't work. I got error

Error: Error: Unable to refresh sourceCredential: Error: Error: Unable to impersonate: Error: Requested entity was not found.

sample code:

    const saclient = new JWT(
      serviceJson.client_email,
      null,
      serviceJson.private_key,
      scopes,
    );

    // Use that to impersonate the targetPrincipal
    const targetClient = new Impersonated({
      sourceClient: saclient,
      targetPrincipal: 'someuser@domain.com',
      lifetime: 30,
      delegates: [],
      targetScopes: scopes,
    });
    const authHeaders = await targetClient.getRequestHeaders();
    console.log('authHeaders', authHeaders);

I guess this impersonation applies only to a service account, not to domain users

[marksantoso]

There's an outstanding PR, #779, to add support for impersonation. Perhaps try this as a starting point, and see if the approach would work for you?

https://stackoverflow.com/a/61571003/3539640

any service accounts made after March 2, 2020 will no longer be able to invite guests to events without using impersonation.

@bcoe Has impersonation been implemented in this package?

[migo1]

https://stackoverflow.com/questions/61473708/creating-events-using-the-google-calendar-api-and-service-account

[VanathiMK]

Is this working fine

[dr-aiuta]

maybe this could help

const auth = new google.auth.GoogleAuth({
    keyFile: './service.json',
    scopes: [
      'https://www.googleapis.com/auth/contacts',...
    ],
    clientOptions: {
      subject: 'email@email.com'
    },
  });

[fabiomig]

@dr-aiuta you save my life!! After hours of searching... Not sure why Google don't put this on docs...