Service account: Cannot set user to impersonate using GoogleCredential fromStream

[WilsonGiese]

I'm trying to use a service account to automatically manage/create groups using the Directory API. When I try to use a service account with the credentials in the form of JSON and try to use the GoogleCredential.fromStream(...) call, there does not seem to be a way to set the user, and at least for the Admin API I cannot get calls to work without impersonating a user as I always get Forbidden (403) responses.

Using the GoogleCredential Builder seems to work fine with the PKCS12 formatted key as long as I set the user, but your docs and console seem to recommend to use the JSON formatted credential file.

Have I missed something, or is this functionality not available without using the builder?

[ejona86]

as long as I set the user

How are you going about setting the user in the PKCS12 case?

[WilsonGiese]

The builder itself has a set method

See https://developers.google.com/api-client-library/java/google-api-java-client/reference/1.19.1/com/google/api/client/googleapis/auth/oauth2/GoogleCredential.Builder#setServiceAccountUser(java.lang.String)

[abhishek-choudhury]

Hey Wilson,

Did you get a response on this issue?
Am facing the exact same thing. I wonder how one can set a service account ID whilst building GoogleCredential fromStream.

[WilsonGiese]

@abhishek-choudhury No, I never heard anything. I resorted to using the builder with a PKCS12 file.

[abhishek-choudhury]

@WilsonGiese Thanks for your response Wilson!
I'll go back to P12 too in that case.

[netp-dany]

Hi,

There is a work around, please have a look at the code below.
In case you really need to use json.

public GoogleCredential getCredentials(HttpTransport httpTransport, JsonFactory jsonFactory) throws GeneralSecurityException, IOException {
    List<String> scopes = new ArrayList<>();
    scopes.add(DirectoryScopes.ADMIN_DIRECTORY_USER);
    scopes.add(DirectoryScopes.ADMIN_DIRECTORY_USER_READONLY);

    InputStream credentialsJSON = ServiceAccountCredentials.class.getClassLoader()
            .getResourceAsStream("service_account.json");

    GoogleCredential gcFromJson = GoogleCredential.fromStream(credentialsJSON, httpTransport, jsonFactory).createScoped(scopes);

    return new GoogleCredential.Builder()
            .setTransport(gcFromJson.getTransport())
            .setJsonFactory(gcFromJson.getJsonFactory())
            .setServiceAccountId(gcFromJson.getServiceAccountId())
            .setServiceAccountUser("user@example.com")
            .setServiceAccountPrivateKey(gcFromJson.getServiceAccountPrivateKey())
            .setServiceAccountScopes(gcFromJson.getServiceAccountScopes())
            .build();
}

[sanbornick]

JSON all the things! The console will issue JSON by default and make you dig for P12's. Lets go future! Except here. Don't look here.

This issue has only been open for a year I guess...

[nddipiazza]

@netp-dany awesome! i've been looking for hours for an example. aka you're a f*king genius

[nbali]

Will one of the PRs aimed at solving this will be merged? #1036 and/or #1079?