How to do impersonation

[yduan-polo]

I have a service account, and a regular account. Regular account has all the permissions too edit sheets. How do I connect using service account and impersonating the user account?

I believe the setup on GCP is already done because a Java application using the same service account and impersonating the user account works (using com.google.api.client.googleapis.auth.oauth2.GoogleCredential). How can this be done through pygsheets?

[nithinmurali]

I dont really understand the question. But if you want to use service account you can just do
gc = pygsheets.authorize(service_file='path/to/service_account_credentials.json')

[yduan-polo]

The service account A doesn't have permission to access sheets owned by user account B, therefore when connect I want service account A to impersonate user account B. What parameter should I specify to impersonate account B when creating credentials?

[nithinmurali]

I don't think Sheets will allow you to access another account which the service account has no permissions to access.
if you looking into this for pentesting you should probably look into the google auth library, pygsheets is just a wrapper around them.

https://developers.google.com/sheets/api/quickstart/python

[elliotpalmer]

In case someone else has this issue, I think I've found the solution. You need to create a custom credentials object to set the account you want to impersonate. This assumes you've already configured the service account with domain-wide delegation.

Note: this only works within a Google Workplace domain and has to be setup by an Administrator. I assume there are other requirements if you are creating a public facing application, YMMV.

    import pygsheets
    SCOPES = ["https://www.googleapis.com/auth/drive"]
    credentials = (
        pygsheets
        .authorization
        .service_account
        .Credentials
        .from_service_account_file("./path/to/service_account_credentials.json", scopes=SCOPES)
        .with_subject("user@yourdomain.com")
    )
    gc = pygsheets.authorization.Client(credentials=credentials)

I was able to use the docs here: https://developers.google.com/identity/protocols/oauth2/service-account#authorizingrequests to piece it together. Hope this helps.