Skip to content

Latest commit

 

History

History
26 lines (22 loc) · 1.89 KB

ServiceAccount.md

File metadata and controls

26 lines (22 loc) · 1.89 KB
Raw

Using a Service Account

Only complete this section if not authenticating via OAuth. See Authentication Methods for more details.

Important

ScubaGoggles requires the service account to have domain-wide delegation of authority to function.

  1. Login to https://console.cloud.google.com and navigate to your GCP project.
  2. From the hamburger menu, select IAM & Admin -> Service Accounts
  3. Select CREATE SERVICE ACCOUNT. Fill out the id field and then select DONE
  4. Click on the newly created service account then click KEYS -> ADD KEY -> Create new key -> JSON -> CREATE
  5. Move the downloaded file (begins with <service account>*.json) to the root directory folder of this repo, rename to credentials.json
  6. Now login to admin.google.com and navigate to Security -> Access and data control -> API controls
  7. Select MANAGE DOMAIN WIDE DELEGATION
  8. Select Add new
  9. Enter the client_id from the downloaded credentials (also visible after clicking on the created Service account under Details -> Unique ID)
  10. Enter each OAuth scope as listed in Permissions
  11. Select AUTHORIZE
  12. Finally, run ScubaGoggles with the --subjectemail option set to the email of an admin with necessary permissions to run ScubaGoggles.

Note

ScubaGoggles can be run using a service account in a different organization. To do so, specify the --customerid argument with the customer ID of the target organization (found in admin.google.com under Account -> Account settings)

Navigation