How do I manage google groups and modify user attributes without domain wide delegation?

Question

I want to give GSAs direct access to modify Google users. I can't find current docs on this so assuming it's not possible right now?

It looks like this is only possible for working with groups: https://workspaceupdates.googleblog.com/2020/08/new-api-cloud-identity-groups-google.html

I need to give a GSA access to read group membership and also modify user attributes.

Right now I:

• create an admin a G Suite user
• create a GSA with domain wide auth with these scopes
  • https://www.googleapis.com/auth/admin.directory.group
  • https://www.googleapis.com/auth/admin.directory.user

Impersonate the G Suite user with the GSA and modify user attributes like this:

service = create_directory_service("G SUITE USER")
service.users().update(userKey=uKey, body=myAttributes).execute()

Do I still need domain wide delegation to modify user attributes? Or is it supported now as well?

Answer 1

You can follow this guide to create a Service Account, turning on the Admin SDK API (which allows the service account to provision/manage the users), and authorizing it.

The Service Account created can be used then to provision/manage the G-Suite users, here is a guide on how to manage user accounts using the Directory API, which is part of the Admin SDK.

In short, yes it is possible to manage users too, by using Service Accounts, not just groups.