googleapis / googleapis/google-cloud-java

[google-auth-library-java] ImpersonatedCredentials can't negotiate proper access token with delegated access to user account

Ouverte
#12,607 12 commentaires 1 réaction 0 personnes assignées Voir sur GitHub
priority: p3 type: feature request
Langage dominant
Java
Étoiles
2.1k
Forks
1.2k
Merge moyen
1 j 23 h
PR mergées (30 j)
154

Description

Hello,

For my use case, I have to impersonate a service account B (own by our customer) that has domain wide delegation enabled using another source service account A (own by us). The goal is to access all user emails that service account B has access to using service account A.

```
String emailAddress = "customer_email@gmail.com"
ServiceAccountCredentials sourceCredentials = (ServiceAccountCredentials) ServiceAccountCredentials.fromStream(new FileInputStream("service_account_A.json")).createScoped(Arrays.asList("https://www.googleapis.com/auth/iam"));
GoogleCredentials impersonatedCredentials = ImpersonatedCredentials.create(
sourceCredentials,
"service_account_B@projectB.iam.gserviceaccount.com",
null,
Arrays.asList("https://mail.google.com/", "https://www.googleapis.com/auth/calendar"),
300)
.createDelegated(emailAddress);

try {
impersonatedCredentials.refreshAccessToken();
} catch (IOException e) {
System.out.println(e);
return;
}
HttpRequestInitializer requestInitializer = new HttpCredentialsAdapter(impersonatedCredentials);
Gmail service = new Gmail.Builder(httpTransport, jacksonFactory, requestInitializer).setApplicationName("Foundation POC").build();
ListMessagesResponse response = service.users().messages().list(emailAddress).execute();
for (Message message : response.getMessages()) {
System.out.println(message.toPrettyString());
}
```
However, the access token retrieved doesn't have access to fetching user email, I got the error below:
```
Exception in thread "main" com.google.api.client.googleapis.json.GoogleJsonResponseException: 400 Bad Request
{
"code": 400,
"errors": [
{
"domain": "global",
"message": "Precondition check failed.",
"reason": "failedPrecondition"
}
],
"message": "Precondition check failed.",
"status": "FAILED_PRECONDITION"
}
```
By further examining the implementation of `createDelegated(String user)` of `ImpersonatedCredentials`, it actually does not respect the input user, which is not what I was expecting:

Screen Shot 2021-10-08 at 3 15 44 AM

I'm using
```

com.google.auth
google-auth-library-oauth2-http
1.2.0

```

I don't really know what could solve this issue for my unique use case, thoughts on this?
Thank you!

Guide de contribution

Ouvrir le guide de contribution

Évaluation

Cette issue n'a pas encore été évaluée.

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.