Skip to content
This repository has been archived by the owner on Apr 19, 2023. It is now read-only.

Possibility to connect as another user account #336

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

Du-St
Copy link

@Du-St Du-St commented Aug 13, 2017

You can use this option when connecting using --service-account. Filling
the Google account username into --service-account-subject you will be
connected as this Google account instead of the service account.

Required settings on the Google site:

  1. Service account must be domain-wide delegated (Google APIs > IAM & Admin > Service accounts > Edit service account > check "Enable GSuite
    Domain-wide Delegation". Also new OAuth 2.0 client will be created.
  2. There must be allowed SDK API in the GDrive settings (Admin Console >
    Apps > GSuite > Drive and Docs > Data access > check "Allow Drive SDK
    API"
  3. The newly created OAuth 2.0 client must be allowed in the GSuite security
    settings to use GDrive API (Admin Console > Security > Show more >
    Advanced settings > click Manage API client access > fill the form:

You can use this option when connecting using --service-account. Filling
the Google account username into --service-account-subject you will be
connected as this Google account instead of the service account.

Required settings on the Google site:
1. Service account must be domain-wide delegated (Google APIs > IAM & Admin
> Service accounts > Edit service account > check "Enable GSuite
Domain-wide Delegation". Also new OAuth 2.0 client will be created.
2. There must be allowed SDK API in the GDrive settings (Admin Console >
Apps > GSuite > Drive and Docs > Data access > check "Allow Drive SDK
API"
3. The newly created OAuth 2.0 client must be allowed in the GSuite security
settings to use GDrive API (Admin Console > Security > Show more >
Advanced settings > click Manage API client access > fill the form:
- Client ID is the client id found in Google APIs > APIs & Services >
Credentials
- One or more API Scopes is "https://www.googleapis.com/auth/drive"
@Du-St
Copy link
Author

Du-St commented Aug 13, 2017

Hi,

I have added the possibility to impersonate (connect as another user) when connecting using service account.

The key change is setting the Subject property of the jwt.Config type.

@Du-St Du-St changed the title Added --service-account-subject Possibility to connect as another user account Aug 14, 2017
@naxvog
Copy link

naxvog commented Mar 15, 2018

Just a little addendum to the Guide given:
If you followed all steps and you still can not impersonate due to missing permissions, creating a new google project and follow the steps again did the trick.
My project was quite old so I guess there was a migration or corruption issue within the google project.

Needless to say: Ty for the PR, saved my life

hulet added a commit to hulet/gdrive that referenced this pull request Feb 10, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants