How do I authorize a google drive service account access to a google account without using google apps?

Question

I'd like to use Google Drive to work as a quasi-CMS for a website I'm making so that the content owners can edit their content using Google Drive. I'd like to use a specific user account that has access to Google Drive (as of writing this post, service accounts DO NOT have direct access to Google Drive) and is able to share documents with the content owners.

After reading through the API and tutorials, I have found the answer in delegation: https://developers.google.com/drive/delegation

My main issue with this process is that the website is not managed by Google Apps and therefore the steps outlined in 'Delegate domain-wide authority to your service account' confuse me - it seems like it should be possible to handle this delegation without using Google Apps, but after searching through the settings in Google Drive for my specific user account, I can't seem to find the ability to authorize impersonation.

A snippet of the code I'm using:

static public function getService() {
  $key = file_get_contents(GOOGLEAPI_KEYFILE);
  $auth = new Google_AssertionCredentials(GOOGLEAPI_SERVICE_EMAIL, array(GOOGLEAPI_SCOPE), $key);
  $auth->setPrn(GOOGLEAPI_IMPERSONATION);
  self::$apiClient = new Google_Client();
  self::$apiClient->setUseObjects(true);
  self::$apiClient->setAssertionCredentials($auth);
  return new Google_DriveService(self::$apiClient);
}

GOOGLEAPI_IMPERSONATION is the specific user account and when I run this code, the exception states:

Error refreshing the OAuth2 token, message: '{ "error" : "access_denied" }

Anyone offer any assistance? Am I misunderstanding a fundamental concept of how oAuth works in terms of delegation?

Answer 1

Service accounts are meant for two different cases:

• Authorizing an app/process to authenticate & invoke services using its own identity. Think of services like prediction, cloud storage, etc. where the data is owned by the app.
• Impersonating users in a google apps domain where the domain admin can pre-authorize the app to act on behalf of users in their domain.

Impersonation works for Google Apps domains because the admins have a mechanism to authorize the app out of band for their users via the control panel. Of course they can only authorize the app to access the data for the accounts they managed. For individual users not part of an organization, apps need to use the normal OAuth flows to request authorization from each user.

I haven't tested it in a while, but last I checked it is possible to use Drive with a service account acting as itself. The only limitation I ran into was it wasn't possible to purchase additional quota and the app was limited to the initial 5gb free storage.