Allow selection of limited service account DwD scopes

[jay0lee]

Today GAM expects users to authorize all scopes it uses for Domain-wide delegation (DwD). This is less than ideal if an admin wants to limit GAM's permissions to only certain scopes and API calls.

While admins can selectively add/remove scopes on the DwD page in the admin console which GAM links to, GAM still tries to use all the scopes it knows about for a given Google API when requesting a DwD access token which will fail if the admin removed scopes.

Possible solution:

1. On check serviceaccount GAM should write scopes that PASS to it's config file. Something like passing_dwd_scopes.
2. On DwD API call, GAM should:

• get list of scopes the API endpoint uses. Note that this list can be problematic. In some cases, only one of the given scopes is required, in others more than one is required to enable all functionality of the API call. (Classroom API is like this). Also note some APIs like Chat (at least at one point) may not list scopes per API endpoint. In this case we'd need to fall back on the full list of scopes supported by the API itself (e.g. the scopes for Gmail API instead of the scopes listed for Gmail API's delegates.create endpoint)
• get list of scopes that have PASSed check serviceaccount stored in some config setting like passing_dwd_scopes.
• Only use scopes in both of these lists. If the resulting diff is empty (no scopes shared between both lists) then fall back to default scopes for the given API endpoint.

[taers232c]

Jay, I'm looking at this. gam can already do some of what you want. gam user ***@***.*** ***@***.***> update serviceaccount Ross ---- Ross Scroggs ***@***.***

…

On Jan 2, 2024, at 10:27 AM, Jay Lee ***@***.***> wrote: Today GAM expects users to authorize all scopes it uses for Domain-wide delegation (DwD). This is less than ideal if an admin wants to limit GAM's permissions to only certain scopes and API calls. While admins can selectively add/remove scopes on the DwD page in the admin console which GAM links to, GAM still tries to use all the scopes it knows about for a given Google API when requesting a DwD access token which will fail if the admin removed scopes. Possible solution: On check serviceaccount GAM should write scopes that PASS to it's config file. Something like passing_dwd_scopes. On DwD API call, GAM should: get list of scopes the API endpoint uses. Note that this list can be problematic. In some cases, only one of the given scopes is required, in others more than one is required to enable all functionality of the API call. (Classroom API is like this). Also note some APIs like Chat (at least at one point) may not list scopes per API endpoint. In this case we'd need to fall back on the full list of scopes supported by the API itself (e.g. the scopes for Gmail API instead of the scopes listed for Gmail API's delegates.create endpoint) get list of scopes that have PASSed check serviceaccount stored in some config setting like passing_dwd_scopes. Only use scopes in both of these lists. If the resulting diff is empty (no scopes shared between both lists) then fall back to default scopes for the given API endpoint. — Reply to this email directly, view it on GitHub <#1671>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACCTYL273JH4PWHA6RVTO6TYMRGR5AVCNFSM6AAAAABBKMNNVOVHI2DSMVQWIX3LMV43ASLTON2WKOZSGA3DENZYHE4DMMI>. You are receiving this because you are subscribed to this thread.

[jay0lee]

Ross, suppose I wanted a GAM install that can list devices read-only but nothing else. I don't think we support using a scope like:

https://www.googleapis.com/auth/cloud-identity.devices.readonly

today?

[jay0lee]

https://cloud.google.com/identity/docs/reference/rest/v1/devices/list

[jay0lee]

Maybe we need to move check serviceaccount to something closer to create oauth where admin can pick which scopes they want? Today GAM claims it's a FAIL that it doesn't have access to specific DwD scopes but that's a perfectly valid scenario if the admin just wants to use some limited scopes and it's not good that they might authorize far more scopes than they really need.