googleapis / googleapis/google-cloud-java
[google-auth-library-java] ImpersonatedCredentials can't negotiate proper access token with delegated access to user account
- Langage dominant
- Java
- Étoiles
- 2.1k
- Forks
- 1.2k
- Merge moyen
- 1 j 23 h
- PR mergées (30 j)
- 154
Description
Hello,
For my use case, I have to impersonate a service account B (own by our customer) that has domain wide delegation enabled using another source service account A (own by us). The goal is to access all user emails that service account B has access to using service account A.
```
String emailAddress = "customer_email@gmail.com"
ServiceAccountCredentials sourceCredentials = (ServiceAccountCredentials) ServiceAccountCredentials.fromStream(new FileInputStream("service_account_A.json")).createScoped(Arrays.asList("https://www.googleapis.com/auth/iam"));
GoogleCredentials impersonatedCredentials = ImpersonatedCredentials.create(
sourceCredentials,
"service_account_B@projectB.iam.gserviceaccount.com",
null,
Arrays.asList("https://mail.google.com/", "https://www.googleapis.com/auth/calendar"),
300)
.createDelegated(emailAddress);
try {
impersonatedCredentials.refreshAccessToken();
} catch (IOException e) {
System.out.println(e);
return;
}
HttpRequestInitializer requestInitializer = new HttpCredentialsAdapter(impersonatedCredentials);
Gmail service = new Gmail.Builder(httpTransport, jacksonFactory, requestInitializer).setApplicationName("Foundation POC").build();
ListMessagesResponse response = service.users().messages().list(emailAddress).execute();
for (Message message : response.getMessages()) {
System.out.println(message.toPrettyString());
}
```
However, the access token retrieved doesn't have access to fetching user email, I got the error below:
```
Exception in thread "main" com.google.api.client.googleapis.json.GoogleJsonResponseException: 400 Bad Request
{
"code": 400,
"errors": [
{
"domain": "global",
"message": "Precondition check failed.",
"reason": "failedPrecondition"
}
],
"message": "Precondition check failed.",
"status": "FAILED_PRECONDITION"
}
```
By further examining the implementation of `createDelegated(String user)` of `ImpersonatedCredentials`, it actually does not respect the input user, which is not what I was expecting:

I'm using
```
com.google.auth
google-auth-library-oauth2-http
1.2.0
```
I don't really know what could solve this issue for my unique use case, thoughts on this?
Thank you!
Guide de contribution
Ouvrir le guide de contribution
Évaluation
Cette issue n'a pas encore été évaluée.