googleapis / googleapis/google-cloud-java

[google-auth-library-java] ImpersonatedCredentials can't negotiate proper access token with delegated access to user account

Abierto
#12,607 12 comentarios 1 reacción 0 asignados Ver en GitHub
priority: p3 type: feature request
Lenguaje dominante
Java
Estrellas
2.1k
Forks
1.2k
Merge medio
1 d 23 h
PR fusionados (30 d)
154

Descripción

Hello,

For my use case, I have to impersonate a service account B (own by our customer) that has domain wide delegation enabled using another source service account A (own by us). The goal is to access all user emails that service account B has access to using service account A.

```
String emailAddress = "customer_email@gmail.com"
ServiceAccountCredentials sourceCredentials = (ServiceAccountCredentials) ServiceAccountCredentials.fromStream(new FileInputStream("service_account_A.json")).createScoped(Arrays.asList("https://www.googleapis.com/auth/iam"));
GoogleCredentials impersonatedCredentials = ImpersonatedCredentials.create(
sourceCredentials,
"service_account_B@projectB.iam.gserviceaccount.com",
null,
Arrays.asList("https://mail.google.com/", "https://www.googleapis.com/auth/calendar"),
300)
.createDelegated(emailAddress);

try {
impersonatedCredentials.refreshAccessToken();
} catch (IOException e) {
System.out.println(e);
return;
}
HttpRequestInitializer requestInitializer = new HttpCredentialsAdapter(impersonatedCredentials);
Gmail service = new Gmail.Builder(httpTransport, jacksonFactory, requestInitializer).setApplicationName("Foundation POC").build();
ListMessagesResponse response = service.users().messages().list(emailAddress).execute();
for (Message message : response.getMessages()) {
System.out.println(message.toPrettyString());
}
```
However, the access token retrieved doesn't have access to fetching user email, I got the error below:
```
Exception in thread "main" com.google.api.client.googleapis.json.GoogleJsonResponseException: 400 Bad Request
{
"code": 400,
"errors": [
{
"domain": "global",
"message": "Precondition check failed.",
"reason": "failedPrecondition"
}
],
"message": "Precondition check failed.",
"status": "FAILED_PRECONDITION"
}
```
By further examining the implementation of `createDelegated(String user)` of `ImpersonatedCredentials`, it actually does not respect the input user, which is not what I was expecting:

Screen Shot 2021-10-08 at 3 15 44 AM

I'm using
```

com.google.auth
google-auth-library-oauth2-http
1.2.0

```

I don't really know what could solve this issue for my unique use case, thoughts on this?
Thank you!

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.