Can I impersonate users of the Google Drive API domain with Google Apps Script?

I’m the research leader and school administrator of our Google Apps for Learning.

I used Google Apps Script for many applications (absentee control, sending emails, automatic reporting, ScriptDb databases, etc.) using gas services. It is fantastic.

Basically, I need to create a folder structure (years, courses, teachers, ...) in Google Drive for students.

Using Google Apps Script services, I can do this easily, but then the folders belong to the creator (administrator), and I think that then users spend the administrative quota of the storage. I do not care. (Yes, I can make the application run by users and create a structure in my Google Drive, but I would prefer to do it automatically and without interference)

To create these documents (and folders) in Google Drive, users (teachers, students, ...) adapted the code provided by Vakar Ahmad in this answer [ Add the author to the spreadsheet ...

This allows me to own documents of other users, to update them using the Google Docs List API (access for Google Apps administrators to impersonate a domain user), and also adapted to create folders and files on other Google Drive users. It works fine. I mention here:

How to add a folder in Google Drive ...

But now version 3 of the Google Docs AP List is officially out of date and encourages us to work with the Google API drive.

I tried to do the same with this new Google API. Has anyone been able to do this? Is it possible? I don’t know where to start!

Thanks.

Sergi

Updated:

This is the code that I am working on, but getting the error "wrong request":

(...)

var user = e.parameter.TB_email // I get user from a TextBox //https://developers.google.com/accounts/docs/OAuth2ServiceAccount //{Base64url encoded header}.{Base64url encoded claim set}.{Base64url encoded signature} //{Base64url encoded header} var header = '{"alg":"RS256","typ":"JWT"}' var header_b64e = Utilities.base64Encode(header) //{Base64url encoded claim set} var t_ara = Math.round((new Date().getTime())/1000) // now var t_fins = t_ara + 3600 // t + 3600 sec var claim_set = '{"iss":" 1111111111-xxxxxxxxxxxxxxxxxxxxxx@developer.gserviceaccount.com ",'+ '"prn":"' + user + '",' + '"scope":"https://www.googleapis.com/auth/prediction",'+ '"aud":"https://accounts.google.com/o/oauth2/token",'+ '"exp":'+t_fins+','+ '"iat":'+t_ara+'}' // where '1111111111-xxxxxxxxxxx... is my CLIENT-ID (API Access -> Service Account) var claim_set_b64e = Utilities.base64Encode(claim_set) claim_set_b64e = claim_set_b64e.replace(/=/g,'') var to_sign = header_b64e + '.' + claim_set_b64e // [signature bytes] ??? // password 'isnotasecret???' var key_secret = DocsList.getFileById('0Biiiiiiiiii-XXXXXXXXXXX').getBlob().getBytes() // where '0Biiiiiiiiii-XXXXXXXXXXX'... is my p12 file (key_secret) uploaded to GDRive // I don't know if this is correct !!! var sign = Utilities.base64Encode(Utilities.computeHmacSha256Signature(to_sign, key_secret)) var JWT_signed = to_sign + '.' + sign JWT_signed = JWT_signed.replace(/=/g,'') // Token Request ///////////////////////////////////////////////////////////// var url = 'https://accounts.google.com/o/oauth2/token' //var url = 'https%3A%2F%2Faccounts.google.com%2Fo%2Foauth2%2Ftoken' ??? //var url = 'https:' + '%2F%2Faccounts.google.com%2Fo%2Foauth2%2Ftoken' ??? var parameters = { "method" : "POST", "payload" : '"' + 'grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer&assertion=' + JWT_signed + '"', "contentType" : "application/x-www-form-urlencoded" } var content = UrlFetchApp.fetch(url,parameters) //.getContentText() // Token Request end //////////////////////////////////////////////////////// 

And I get an "Invalid Request", not JSON with a token

The first 2 parts (title and set of requirements) are in order. The result is equal to the result of the Google OAuth page.

I do not know if the part of the signature is correct or an error in the request for the token.

+4
source share
1 answer

The problem with your example above is that it calculates the signature using hmacsha256. You need to use rsasha256. For script applications, there are two service account libraries. One of them I have compiled is: https://gist.github.com/Spencer-Easton/f8dad65932bff4c9efc1

The problem with both libraries is that they are made from jsrsa, which runs very slowly on the server side.

+2
source

All Articles