javascriptnode.jsgoogle-admin-sdkgoogle-reseller-api

Problems authenticating Service Account for google reseller api using the nodejs library

I am trying to access the google reseller api using the nodejs library, which has very shi..., I mean spotty documentation. I tried following the example here, but I fail at step 3 with this error:

  code: 403,
  errors: [
    {
      domain: 'global',
      reason: 'insufficientPermissions',
      message: 'Authenticated user is not authorized to perform this action.'
    }
  ]

My configuration looks like this:

    const OAUTH2_SCOPES = [
      "https://www.googleapis.com/auth/admin.directory.user",
      "https://www.googleapis.com/auth/apps.order",
      "https://www.googleapis.com/auth/siteverification",
      "https://www.googleapis.com/auth/cloud-platform",
    ];

   const authJWT = new google.auth.JWT({
      keyFile: JSON_PRIVATE_KEY_FILE,
      scopes: OAUTH2_SCOPES,
      subject: RESELLER_ADMIN_USER,
      email: "gsuite-reseller@some-cool-name-because-why-not.iam.gserviceaccount.com",
    });

Using basic google fu, I found this thread, which suggested that my problem has to do with impersonation. So I exchanged the email in the subject property, with my account email, which has the owner rights specified. I also gave the service account owner rights, because at that point I am pretty clueless. This unfortunately only changed the error message to:

status: 401,
statusText: 'Unauthorized'

Does anybody have an idea what goes wrong? The 401 suggests that there are credentials missing. Would I have to also specify my private emails credentials in addition to the ones of the service account? If yes, then where? I did not find any property on the google.auth.JWT.options object which sounded promising.

Solution

  • Why do you need domain-wide delegation?

    References: