NodeJS Example - Firebase Cloud Functions - Instantiate an Admin SDK Directory service object

Question

Goal

Use googleapis with Firebase Cloud Functions to get a list of all users in my G Suite domain.

Question

How do I Instantiate an Admin SDK Directory service object. I do not see a NodeJS example, and I'm not clear how to setup and make the request with googleapis.

Context

This code runs from Firebase Cloud Functions, and it seems to authenticate okay. Now, how do I setup the service object at //TODO in the following code:

// Firebase Admin SDK
const functions = require('firebase-functions')
const admin = require('firebase-admin')
admin.initializeApp(functions.config().firebase)

// Google APIs
const googleapis = require('googleapis')
const drive = googleapis.drive('v3')
const gsuiteAdmin = googleapis.admin('directory_v1')

// Service Account Key - JSON
let privatekey = require("./privatekey.json")

let jwtClient = new googleapis.auth.JWT(
    privatekey.client_email,
    null,
    privatekey.private_key,
    ['https://www.googleapis.com/auth/drive',
        'https://www.googleapis.com/auth/admin.directory.user'])

// Firebase Cloud Functions - REST
exports.authorize = functions.https.onRequest((request, response) => {
    //authenticate request
    jwtClient.authorize(function (err, tokens) {
        if (err) {
            console.log(err)
            return
        } else {
            console.log("Successfully connected!")
        }

        // TODO
        // USE SERVICE OBJECT HERE??
        // WHAT DOES IT LOOK LIKE?

        response.send("Successfully connected!")
    })
})

My first JWT wasn't providing Domain-Wide Delegation, and when I added an impersonator I got errors. The code and setup is fine. I created a new key in my Service Account (which was already set up with DwD), and I swapped in the new key.json (auto downloaded from GCP). This solved the issue, and the App is making requests to the drive api as any user in our G Suite Domain! When I get code for using the Directory API, I'll add an answer. — Chadd
– Chadd, Commented Nov 9, 2017 at 20:45

Chadd · Accepted Answer · 2017-11-14 16:28:48Z

Order of Operations:

Create Service Account Credentials in Google Cloud Console
Add Domain-Wide Delegation to the Service Account
Authorize the API in G Suite - Security - Advanced
Go back to the Service Account and Download the .json key file

I downloaded the .json key file too soon, e.g., before authorizing the APIs in G Suite. The order, Setting up the Service Account with DwD and then authorization the API in G Suite API and then downloading the .json key file is important.

The Example

// Firebase Admin SDK
const functions = require('firebase-functions')
const admin = require('firebase-admin')
admin.initializeApp(functions.config().firebase)

// Google APIs
const googleapis = require('googleapis')
const drive = googleapis.drive('v3')
const directory = googleapis.admin('directory_v1')

// Service Account Key - JSON
let privatekey = require("./privatekey.json")
let impersonator = '[email protected]'

let jwtClient = new googleapis.auth.JWT(
    privatekey.client_email,
    null, // not using path option
    privatekey.private_key,
    ['https://www.googleapis.com/auth/drive',
        'https://www.googleapis.com/auth/admin.directory.user',
        'https://www.googleapis.com/auth/admin.directory.user.readonly'],
    impersonator
)

// Firebase Cloud Functions - REST
exports.getUsers = functions.https.onRequest((request, response) => {
    //authenticate request
    jwtClient.authorize(function (err, tokens) {
        if (err) {
            console.log(err)
            return
        } else {
            console.log("Successfully connected!")
        }
        //Google Drive API
        directory.users.list ({
            auth: jwtClient,
            domain: 'example.com',
            maxResults: 10,
            orderBy: 'email',
            viewType: 'domain_public'
          }, function(err, res) {
            if (err) {
              console.log('The API returned an error: ' + err)
              return;
            }
            var users = res.users;
            if (users.length == 0) {
              console.log('No users in the domain.');
            } else {
              console.log('Users:');
              for (var i = 0; i < users.length; i++) {
                var user = users[i];
                console.log('%s (%s)', user.primaryEmail, user.name.fullName)
              }
              response.send(users)
            }        
        })
    })
})

UPDATE

The example above is not secure. A Cloud Function, especially with G Suite Domain-wide Delegation, should not respond to http requests unless they come from your application. See in this example that the Cloud Function uses admin.auth().verifyIdToken(idToken)... to validate that the request is authenticated by Firebase.

If you don't properly handle your G Suite DwD Cloud Function, you risk exposing your G Suite API to the public.

Collectives™ on Stack Overflow

NodeJS Example - Firebase Cloud Functions - Instantiate an Admin SDK Directory service object

Goal

Question

Context

1 Answer 1

Order of Operations:

The Example

UPDATE

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

Goal

Question

Context

1 Answer 1

Order of Operations:

The Example

UPDATE

Comments

Your Answer

Sign up or log in

Post as a guest

Related