Search code examples
google-calendar-apigoogle-workspaceservice-accounts

Google service account: Delegate Domain-Wide Delegation of Authority to impersonate only ONE user

We need to access Google Calendar API with server application to create the events and invite the attendees. Google recommends to use service account for the applications.

The main problem here with the attendees inviting to the event, because the service account can't do it without the Domain-Wide Delegation of Authority (see image).

Organization do not want to give the service account an access to ALL user's data. So, I'm trying to find out can we delegate the Domain-Wide Delegation of Authority to the ONE user of the domain ? (restrict access to use another user's data).

P.S. it's only about Google Calendar API.

enter image description here

Solution

  • Actually what it meant to as to use a service account to access the Google Calendar API on behalf of users, is that you can use a single service account to impersonate different users one at a time. So if you want to impersonate just only one user, then there shouldn't be any problem. You just need to specify the user's email address to impersonate before making an authorized API call

    After you delegate domain-wide authority to the service account, You need to preparation to make an authorized API call where you need to specify the user to impersonate.

    For example, if you will check Google APIs Client Library for Java - Impersonation, GoogleCredential.Builder.setServiceAccountUser(String). This method only accept a single email address of the user to impersonate.

    enter image description here

    OPTION 1: (With the use of a service account)

    If you want to use a service account in your application which can only impersonate a specific user/users, you can publish an app in Google Apps Marketplace. Then you can restrict the access of this app for specific user/users or even by organization using admin console. Turn on or off a Google Workspace Marketplace app for users

    OPTION 2: (Without the use of a service account)

    You can access Google API through a specific user rather than with a service account. You just need to enable the API and generate API Keys. See Calendar API Quickstarts on how to setup and use the api.