googleapis / googleapis/google-cloud-java

[google-auth-library-java] ImpersonatedCredentials can't negotiate proper access token with delegated access to user account

Aperta
#12,607 12 commenti 1 reazione 0 assegnatari Vedi su GitHub
priority: p3 type: feature request
Lingua principale
Java
Stelle
2.1k
Fork
1.2k
Merge medio
1g 23h
PR unite (30g)
154

Descrizione

Hello,

For my use case, I have to impersonate a service account B (own by our customer) that has domain wide delegation enabled using another source service account A (own by us). The goal is to access all user emails that service account B has access to using service account A.

```
String emailAddress = "customer_email@gmail.com"
ServiceAccountCredentials sourceCredentials = (ServiceAccountCredentials) ServiceAccountCredentials.fromStream(new FileInputStream("service_account_A.json")).createScoped(Arrays.asList("https://www.googleapis.com/auth/iam"));
GoogleCredentials impersonatedCredentials = ImpersonatedCredentials.create(
sourceCredentials,
"service_account_B@projectB.iam.gserviceaccount.com",
null,
Arrays.asList("https://mail.google.com/", "https://www.googleapis.com/auth/calendar"),
300)
.createDelegated(emailAddress);

try {
impersonatedCredentials.refreshAccessToken();
} catch (IOException e) {
System.out.println(e);
return;
}
HttpRequestInitializer requestInitializer = new HttpCredentialsAdapter(impersonatedCredentials);
Gmail service = new Gmail.Builder(httpTransport, jacksonFactory, requestInitializer).setApplicationName("Foundation POC").build();
ListMessagesResponse response = service.users().messages().list(emailAddress).execute();
for (Message message : response.getMessages()) {
System.out.println(message.toPrettyString());
}
```
However, the access token retrieved doesn't have access to fetching user email, I got the error below:
```
Exception in thread "main" com.google.api.client.googleapis.json.GoogleJsonResponseException: 400 Bad Request
{
"code": 400,
"errors": [
{
"domain": "global",
"message": "Precondition check failed.",
"reason": "failedPrecondition"
}
],
"message": "Precondition check failed.",
"status": "FAILED_PRECONDITION"
}
```
By further examining the implementation of `createDelegated(String user)` of `ImpersonatedCredentials`, it actually does not respect the input user, which is not what I was expecting:

Screen Shot 2021-10-08 at 3 15 44 AM

I'm using
```

com.google.auth
google-auth-library-oauth2-http
1.2.0

```

I don't really know what could solve this issue for my unique use case, thoughts on this?
Thank you!

Guida per i contributori

Apri la guida per i contributori

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.