googleapis / googleapis/google-cloud-java

[google-auth-library-java] ImpersonatedCredentials can't negotiate proper access token with delegated access to user account

Đang mở
#12,607 12 bình luận 1 reaction 0 người được giao Xem trên GitHub
priority: p3 type: feature request
Ngôn ngữ chính
Java
Star
2.1k
Fork
1.2k
Merge trung bình
1 ngày 23 giờ
Pull request đã merge (30 ngày)
154

Mô tả

Hello,

For my use case, I have to impersonate a service account B (own by our customer) that has domain wide delegation enabled using another source service account A (own by us). The goal is to access all user emails that service account B has access to using service account A.

```
String emailAddress = "customer_email@gmail.com"
ServiceAccountCredentials sourceCredentials = (ServiceAccountCredentials) ServiceAccountCredentials.fromStream(new FileInputStream("service_account_A.json")).createScoped(Arrays.asList("https://www.googleapis.com/auth/iam"));
GoogleCredentials impersonatedCredentials = ImpersonatedCredentials.create(
sourceCredentials,
"service_account_B@projectB.iam.gserviceaccount.com",
null,
Arrays.asList("https://mail.google.com/", "https://www.googleapis.com/auth/calendar"),
300)
.createDelegated(emailAddress);

try {
impersonatedCredentials.refreshAccessToken();
} catch (IOException e) {
System.out.println(e);
return;
}
HttpRequestInitializer requestInitializer = new HttpCredentialsAdapter(impersonatedCredentials);
Gmail service = new Gmail.Builder(httpTransport, jacksonFactory, requestInitializer).setApplicationName("Foundation POC").build();
ListMessagesResponse response = service.users().messages().list(emailAddress).execute();
for (Message message : response.getMessages()) {
System.out.println(message.toPrettyString());
}
```
However, the access token retrieved doesn't have access to fetching user email, I got the error below:
```
Exception in thread "main" com.google.api.client.googleapis.json.GoogleJsonResponseException: 400 Bad Request
{
"code": 400,
"errors": [
{
"domain": "global",
"message": "Precondition check failed.",
"reason": "failedPrecondition"
}
],
"message": "Precondition check failed.",
"status": "FAILED_PRECONDITION"
}
```
By further examining the implementation of `createDelegated(String user)` of `ImpersonatedCredentials`, it actually does not respect the input user, which is not what I was expecting:

Screen Shot 2021-10-08 at 3 15 44 AM

I'm using
```

com.google.auth
google-auth-library-oauth2-http
1.2.0

```

I don't really know what could solve this issue for my unique use case, thoughts on this?
Thank you!

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.