Use Admin API without admin user

Hello,

I’m using google-api-nodejs-client v12.2.0 for a studies project to create a small ERP. In this project, I create an oAuth 2.0 authentification. This authentification work fine with the admin user, but when a standard user try to login, an error is thrown:

Error: Not Authorized to access this resource/api

This error is returned by my get user method:

const ADMIN_API = googleapis.admin('directory_v1');

return new Promise((resolve, reject) => {

  if( typeof userKey !== 'string' && typeof userKey !== 'number' ) {
    reject('User key must be a string or a number !');
    return false;
  }

  ADMIN_API.users.get({
    auth: auth,
    userKey: userKey,
    projection: 'full',
  },
  (err, response) => {
    if (err) {
      console.log('ADMIN_API returned an error: ' + err);
      reject(err);
      return false;
    }
    else {
      console.log(response);
      resolve(response);
    }
  });
});`

I need this method to check if the user is an admin or not and get some informations.

My first question is: It’s the best solution to return user’s informations ?

If yes, I think I must use a delegate user (as explained here: https://developers.google.com/identity/protocols/OAuth2ServiceAccount), but I have not find any documentation about how to use a delegate user with google-api-nodejs-client.

Any idea ?

[3thanZ]

@wellczech I read the code at https://github.com/google/google-api-nodejs-client and found the solution. Basically getApplicationDefault has an override like that you can use to pass in the subject to impersonate:

google.auth.getApplicationDefault({
    subject: '[e-mail]'
}, function (err, authClient, projectId) {
    ...
});

Hope you find this interesting.

[JustinBeckwith]

Greetings! It looks like this issue has been resolved. If you’re still running into issues - let us know!