googleapis / googleapis/google-api-nodejs-client

Domain-wide Delegation only works when providing credentials via `keyFile`

Open
#3,107 3 comments 2 reactions 0 assignees View on GitHub
priority: p2 type: bug
Dominant language
TypeScript
Stars
12.2k
Forks
2k
Avg merge
1d 9h
Merged PRs (30d)
24

Description

It seems that making API calls (e.g., to the Google Drive API) impersonating another user via Domain-Wide Delegation only works when creating a client using the `keyFile` option (and _not_ when relying on automatically provided auth credentials).

Specifically, I am trying to call the Google Drive API from a Google Cloud Function. I rely on the "Default App Engine Service Account" for authorizing my client:

```javascript
// here, credentials are automatically obtained by getClient:
const auth = await google.auth.getClient({
clientOptions: {
subject: 'email@to.impersonate',
},
scopes: [ /* list of required scopes */ ],
});
const driveAPI = google.drive({ version: 'v3', auth });

// make some requests - however, they are NOT made by 'email@to.impersonate',
// but by the Default App Engine Service Account :(
```

The above code works, but requests are _not_ made as `email@to.impersonate`, but instead as the Default App Engine Service Account. To be clear, I have configured Domain-Wide Delegation for the Default App Engine Service Account in the Google Workspaces Admin UI (https://admin.google.com).

Now, the above code _does work_ once I slightly extend it by providing the Default App Engine Service Account's credentials via the `keyFile` option:

```javascript
// here, credentials are explicitly provided via keyFile:
const auth = await google.auth.getClient({
clientOptions: {
subject: 'email@to.impersonate',
},
keyFile: './path/to/keyFile.json',
scopes: [ /* list of required scopes */ ],
});
const driveAPI = google.drive({ version: 'v3', auth });

// make some requests - they are now made as 'email@to.impersonate' :)
```

Ideally, I'd like to avoid having to manually provide the Default App Engine Service Account credentials using a file.

It seems this issue was mentioned as part of discussions around https://github.com/googleapis/google-cloud-node/issues/7801, specifically in this comment https://github.com/googleapis/google-cloud-node/issues/7801.

---

#### Environment details

- OS: Google Cloud functions
- Node.js version: 16
- npm version: 7 (?)
- `googleapis` version: 105.0.0

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.