6

Per the recommendation in the defaultauth sample, I am trying to access the directory api for a domain which I have created a service account for. Here is the code I am attempting to connect with:

import { google } from 'googleapis'

const authClient = await google.auth.getClient({
    scopes: ['https://www.googleapis.com/auth/admin.directory.user.readonly']
})

const service = google.admin('directory_v1')

console.log(
    await service.users.list({
        auth: authClient,
        domain: <redacted>
    })
)

However, when I attempt to connect I recieve an error saying Error: Not Authorized to access this resource/api. If I remove the creds.json file in ~/.google, the error changes to saying that it cannot find the credentials file. Also, I am able to access a bucket using the same file, so I'm pretty sure my local environment is set up correctly, authentication wise. I have also worked for the past few days with someone on the support team G Suite API team, who assures me that things are set up correctly on my domain.

After looking around online, it seems the thing I am missing is impersonating an admin account when trying to connect with my service-account. I have found a few examples online of doing this with a JWT auth strategy, but I would like to continue to use the default auth client, in order to abstract away the implementation details. Is this possible? If so, what do I have to change? I have tried setting subject, and delegationEmail in both of the calls (getClient and list).

Any help would be greatly appreciated.

Alec Aivazis
  • 61
  • 4

2 Answers2

4

Just set subject of the client object:

authClient.subject = 'your email address'

Google's api documentations highly varies by language. No standart. Something documented in PHP client may be missing in nodejs client and it can take hours to find out how to do it.

muratgozel
  • 2,333
  • 27
  • 31
0

You can pass clientOptions.subject in the constructor.

import { google } = from 'googleapis';

const authClient = new google.auth.GoogleAuth({
  scopes: ['https://www.googleapis.com/auth/admin.directory.user.readonly'], 
  clientOptions: {
    subject: "your email address"
});
Nikolai R Kristiansen
  • 535
  • 5
  • 11