使用应用程序默认凭据对服务帐户进行用户模拟 [英] User Impersonation with Service Account using Application Default Credentials

问题描述

我正在尝试在具有Go的App Engine部署中使用具有域范围委托(DwD)的服务帐户.

I'm trying to use a service account with domain-wide delegation (DwD) on an App Engine deployment with Go.

我已按照以下步骤使用 Google Application Default Credentials (Google应用默认凭据)即可在App Engine中使用服务帐户.

I've followed the steps for using Google Application Default Credentials to use a service account with App Engine.

我的代码在我的开发机器上本地运行，但是我一直坚持从域中检索实际数据.

I got the code running locally on my dev machine but I'm stuck at retrieving the actual data from my domain.

我正在使用管理SDK .在将整个域的权限委派给您的服务帐户，它表示我的服务帐户需要模拟其中一个用户才能访问Admin SDK Directory API".

I'm using the Admin SDK. Under the section Delegate domain-wide authority to your service account, it says that my "service account needs to impersonate one of those users to access the Admin SDK Directory API".

我已经阅读了有关使用服务帐户和用户模拟进行Go的文档，并且还仔细阅读了源代码.它无处表明我可以在哪里输入要模拟的用户电子邮件地址/身份.

I've looked through the documentation for Go on using service account and user impersonation, AND I've also pored through the source code. Nowhere does it indicate where I can enter the user's email address/identity to impersonate.

这是我得到的错误:

googleapi: Error 404: Domain not found., notFound

源代码确实显示了一些线索，但是当尝试使用应用程序默认凭据"以外的其他功能时，我遇到了其他障碍.

The source code does show some clue but I faced other obstacles when trying to use something other than the Application Default Credentials.

有人有什么主意吗?预先感谢.

Does anyone have any idea? Thanks in advance.

推荐答案

似乎对于Admin SDK，我需要请求用户(管理员)访问目录API的权限.这与其他API完全不同，在其他API中，我仅设置用户电子邮件地址即可访问指定用户的数据.

It seems that for the Admin SDK I need to ask for the user (the administrator) permissions to access the Directory API. This is quite different from the other APIs where I simply just set the user email address to access the specified user's data.

我想这是可以理解的，因为Admin SDK是一个功能更强大的API，不仅会影响域，而且会影响域用户.

It's understandable I guess since the Admin SDK is a far more powerful API affecting the domain and not just the individual user.

这篇关于使用应用程序默认凭据对服务帐户进行用户模拟的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！