service account impersonating admin user gets unauthorized_client

I’m attempting to use the Admin SDK via a service account in the context of a firebase cloud function. Per these docs I am impersonating an admin user, and have enabled directory-wide delegation (proof). The proper scope (admin.directory.user) has been granted to the API by the admin user.

const google = require('googleapis');

const KEY = require('./mykey.json');

function connect() {
  return new Promise((yep, nope) => {
    const jwtClient = new google.auth.JWT(
      KEY.client_email,
      null,
      KEY.private_key,
      ['https://www.googleapis.com/auth/admin.directory.user'],
      '[e-mail]'
    );

    jwtClient.authorize((err) => {
      if(err) {
        nope(err);
      } else {
        yep(jwtClient);
      }
    });
  });
}

function listUsers(client) {
  return new Promise((yep, nope) => {
    google.admin('directory_v1').users.list({
      auth: client,
      domain: 'mydomain.com',
    }, (err, response) => {
      if (err) {
        return nope(err);
      }
      return yep(response);
    });
  });
}

function getAllUsers() {
  return connect().then((client) => (listUsers(client)));
}

calling getAllUsers() fails at the authorization step with unauthorized_client: Client is unauthorized to retrieve access tokens using this method. This seems to contradict everything I’ve read about DwD and service accounts. Are you able to shed some light on how this should work?

[jlippold]

I got a service account working with the gmail api

I followed this tutorial for the google console and google admin portion: https://medium.com/lyfepedia/sending-emails-with-gmail-api-and-python-49474e32c81f

And here’s my working code that let’s me send emails on behalf of any email in my google apps domain without refreshTokens or OAuth2

var fs = require("fs-extra");
const { google } = require('googleapis');

//this is the json credentials you get from google service setip
var config = fs.readJsonSync("/Users/jed/config.json");

var sendFrom = "[e-mail]";

var authClient = new google.auth.JWT(
    config.client_email, 
    null,
    config.private_key,
    ['https://www.googleapis.com/auth/gmail.send'],
    sendFrom
);

const gmail = google.gmail({
    version: 'v1',
    auth: authClient,
});

const messageParts = [
    'From: ' + sendFrom,
    'To: [e-mail]',
    'Content-Type: text/html; charset=utf-8',
    'MIME-Version: 1.0',
    `Subject: Poop`,
    '',
    'This is a message just to say hello.',
    'So... <b>Hello!</b>',
];
const message = messageParts.join('\n');

// The body needs to be base64url encoded.
const encodedMessage = Buffer.from(message)
    .toString('base64')
    .replace(/\+/g, '-')
    .replace(/\//g, '_')
    .replace(/=+$/, '');

gmail.users.messages.send({
    userId: sendFrom,
    requestBody: {
        raw: encodedMessage,
    },
}, function (err, res) {
    if (err) {
        console.log(err);
    } else {
        console.log(res);
    }
});

[mryerse]

ghost, how can that work without telling the drive service which google account to run under the context of? When authorizing with a service account file from GCP, the service would have no idea which user (i.e. [e-mail], or something) to make the API calls for. And yet, I cannot find a single working example on this internet doing this in Node.js.