CODEWITHSUNDEEP
google-docs-apigoogle-appsgoogle-drive-api
Ridgh
Ridgh

Reputation: 121

Can a Google Apps Admin manage users files with Drive SDK?

The new Drive SDK is very good for the authenticated user. Is it possible use Drive SDK using Google Apps administrative access to impersonate other domain users?

The doclist API can do it but it's not possible manage and copy files (pdf, jpg) with this tool.

I'm using Java with this code:

credential_origine = new GoogleCredential.Builder().setTransport(HTTP_TRANSPORT)
                    .setJsonFactory(JSON_FACTORY)
                    .setServiceAccountId("[email from console api]")
                    .setServiceAccountScopes(DriveScopes.DRIVE)
                    .setServiceAccountUser("[email protected]")
                    .setServiceAccountPrivateKeyFromP12File(new File("key.p12")).build();

But I get an error when I try to retrieve data for the [email protected]. If I comment .setServiceAccountUser("[email protected]") the code works great for the same account I used for creating the key.

In the old DOCList API we impersonated another user by the URL of the requests. Is it something similar?

Upvotes: 7

Views: 7429

Answers (3)

tomaszkubacki
tomaszkubacki

Reputation: 3262

OK here is complete code in Dartlang to list impersonated USER@YOUR_DOMAIN user files with JSON key

To run it you will need to generate JSON key (instead of P12) via Google Developer Console (in project's context: Apis & auth -> credentials) generate JSON key

Dart project's dependencies in pubspec.yaml: googleapis googleapis_auth async)

import 'package:googleapis/drive/v2.dart';
import 'package:googleapis_auth/auth_io.dart';
import 'package:async/async.dart';

final _credentials = new ServiceAccountCredentials.fromJson(r'''
{
  "private_key_id": "*PRIVATE_KEY_ID*",
  "private_key": "*PRIVATE_KEY_CONTENT*",
  "client_email": "*[email protected]*",
  "client_id": "*SOMETHING.apps.googleusercontent.co*m",
  "type": "service_account"
}
''', impersonatedUser: "*USER@YOUR_DOMAIN*");  //here you type user

const _SCOPES = const [DriveApi.DriveScope];

main() async {
  var http_client = await clientViaServiceAccount(_credentials, _SCOPES);
  var drive = new DriveApi(http_client);
  var docs = await drive.files.list(maxResults: 10);

  for (var itm in docs.items) {
    print(itm.title); //list docs titles
  }
}

Upvotes: 0

Ridgh
Ridgh

Reputation: 121

Upgrade:

the code:

com.google.api.client.googleapis.auth.oauth2.GoogleCredential.Builder credential_origine_builder = new GoogleCredential.Builder().setTransport(HTTP_TRANSPORT)
                    .setJsonFactory(JSON_FACTORY)
                    .setServiceAccountId("[[]]")
                    .setServiceAccountScopes(DriveScopes.DRIVE)
                    .setServiceAccountPrivateKeyFromP12File(new File("cfg/file.p12"));

credential_origine_builder.setServiceAccountUser("[email protected]");

works fine.

If we change the .setServiceAccountScopes(DriveScopes.DRIVE) to

.setServiceAccountScopes(DriveScopes.DRIVE,Oauth2Scopes.USERINFO_EMAIL,Oauth2Scopes.USERINFO_PROFILE)

for retrieving the name and ID of the user It seems to not be compatible with .setServiceAccountUser("[email protected]");

Using the 3 scopes works fine only with the user "owner" of the keys...keep building

Upvotes: 0

Alain
Alain

Reputation: 6034

You can do that using Service Accounts and specifying the user to impersonate when building your assertion claim.

Once you have created a Service Account key in your API project (from the APIs Console), you will have to add this project to the list of authorized third party app in the cPanel. More information about this can be found here. The "Client Id" you need to use is the one bound to the Service Account key and looks like <APP_ID>-<OTHER_KEY>.apps.googleusercontent.com

Since you want to manage other users file, you will have to authorize the Drive wide scope: https://www.googleapis.com/auth/drive.

Most of our client libraries take care of abstracting the claim generation for developers. If you could specify which language your are planning to use, I can update this answer by providing a code snippet to help you get started.

Upvotes: 5

Related Questions