From 261adee26b5778f61bb2deb0d3c8ec5242f6ee80 Mon Sep 17 00:00:00 2001
From: Mark Sagi-Kazar <mark.sagikazar@gmail.com>
Date: Tue, 4 Oct 2022 08:55:57 +0200
Subject: [PATCH] fix(connector/google): make admin email optional for default
creds
Signed-off-by: Mark Sagi-Kazar <mark.sagikazar@gmail.com>
---
connector/google/google.go | 11 +++++++++--
connector/google/google_test.go | 9 +++++----
2 files changed, 14 insertions(+), 6 deletions(-)
diff --git a/connector/google/google.go b/connector/google/google.go
index 72cc6a18..eb9596cd 100644
--- a/connector/google/google.go
+++ b/connector/google/google.go
@@ -283,7 +283,9 @@ func (c *googleConnector) getGroups(email string, fetchTransitiveGroupMembership
// the google admin api. If no serviceAccountFilePath is defined, the application default credential
// is used.
func createDirectoryService(serviceAccountFilePath, email string, logger log.Logger) (*admin.Service, error) {
- if email == "" {
+ // We know impersonation is required when using a service account credential
+ // TODO: or is it?
+ if email == "" && serviceAccountFilePath != "" {
return nil, fmt.Errorf("directory service requires adminEmail")
}
@@ -308,7 +310,12 @@ func createDirectoryService(serviceAccountFilePath, email string, logger log.Log
if err != nil {
return nil, fmt.Errorf("unable to parse credentials to config: %v", err)
}
- config.Subject = email
+
+ // Only attempt impersonation when there is a user configured
+ if email != "" {
+ config.Subject = email
+ }
+
return admin.NewService(ctx, option.WithHTTPClient(config.Client(ctx)))
}
diff --git a/connector/google/google_test.go b/connector/google/google_test.go
index 5cecbec9..b0c4f3a2 100644
--- a/connector/google/google_test.go
+++ b/connector/google/google_test.go
@@ -74,10 +74,11 @@ func TestOpen(t *testing.T) {
for name, reference := range map[string]testCase{
"missing_admin_email": {
config: &Config{
- ClientID: "testClient",
- ClientSecret: "testSecret",
- RedirectURI: ts.URL + "/callback",
- Scopes: []string{"openid", "groups"},
+ ClientID: "testClient",
+ ClientSecret: "testSecret",
+ RedirectURI: ts.URL + "/callback",
+ Scopes: []string{"openid", "groups"},
+ ServiceAccountFilePath: serviceAccountFilePath,
},
expectedErr: "requires adminEmail",
},
--
GitLab