googleapis / googleapis/google-api-nodejs-client
Domain-wide Delegation only works when providing credentials via `keyFile`
- Dominant language
- TypeScript
- Stars
- 12.2k
- Forks
- 2k
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 24
Description
It seems that making API calls (e.g., to the Google Drive API) impersonating another user via Domain-Wide Delegation only works when creating a client using the `keyFile` option (and _not_ when relying on automatically provided auth credentials).
Specifically, I am trying to call the Google Drive API from a Google Cloud Function. I rely on the "Default App Engine Service Account" for authorizing my client:
```javascript
// here, credentials are automatically obtained by getClient:
const auth = await google.auth.getClient({
clientOptions: {
subject: 'email@to.impersonate',
},
scopes: [ /* list of required scopes */ ],
});
const driveAPI = google.drive({ version: 'v3', auth });
// make some requests - however, they are NOT made by 'email@to.impersonate',
// but by the Default App Engine Service Account :(
```
The above code works, but requests are _not_ made as `email@to.impersonate`, but instead as the Default App Engine Service Account. To be clear, I have configured Domain-Wide Delegation for the Default App Engine Service Account in the Google Workspaces Admin UI (https://admin.google.com).
Now, the above code _does work_ once I slightly extend it by providing the Default App Engine Service Account's credentials via the `keyFile` option:
```javascript
// here, credentials are explicitly provided via keyFile:
const auth = await google.auth.getClient({
clientOptions: {
subject: 'email@to.impersonate',
},
keyFile: './path/to/keyFile.json',
scopes: [ /* list of required scopes */ ],
});
const driveAPI = google.drive({ version: 'v3', auth });
// make some requests - they are now made as 'email@to.impersonate' :)
```
Ideally, I'd like to avoid having to manually provide the Default App Engine Service Account credentials using a file.
It seems this issue was mentioned as part of discussions around https://github.com/googleapis/google-cloud-node/issues/7801, specifically in this comment https://github.com/googleapis/google-cloud-node/issues/7801.
---
#### Environment details
- OS: Google Cloud functions
- Node.js version: 16
- npm version: 7 (?)
- `googleapis` version: 105.0.0
Contributor guide
Assessment
This issue has not been assessed yet.