Can I use a Service Account to authenticate users on my website, enabling them to view selected files from my Google Drive?

user_14287788 0
Viewed 77

So I am building a website in Javascript/html and have user specific data stored in google drive. Now, I am under certain stipulations which I need to work around.

Firstly, the files on google drive must be kept on 'shared within my organisation'. They contain private data and so I can't share them with anyone with the link.

Secondly, we have created our own user/login system and separate from Google's and we don't want our users to have to make google accounts in order to access their data.

I've read about service accounts, and am wondering if it's possible to share the files with a service account, then have users authenticate as that service account (behind the scenes) once they login successfully. I'm still reading trying to figure out whether this is possible, but hoping someone could save me some time and let me know if it is.

So far, I have set up the service account and have the client ID as well as an API key for Google Drive API. I have enabled 'Domain-Wide Delegation' for the service account and done the same on the admin console of my google drive and shared a test folder with the service account email. I'm currently looking at the OAuth sign-in and reading through it carefully (https://developers.google.com/identity/protocols/oauth2/service-account). I will post updates if I make any progress. Thanks in advance!

service-accounts google-drive-api google-cloud-platform javascript
1 Answers

Service accounts would give your application access to files stored on Google drive. There are two ways of going about this.

The service account is its own user it has its own drive account so you could upload the files directly to the service accounts google drive account. Or you could share a directory on your personal drive account with the service account and grant it access to the files that way.

If you have a gsuite domain then yes you could set up domain wide delegation which would allow the service account to "act" like a user on your domain and then service the files that way.

viewing

Service account access is just back end access, it has access to the files but not much more then that. It does not for example have the ability to open a file in the Google drive web application. The service account would need to download the files and then your web application would need to have some way of displaying these downloaded files. IMO if your going to be downloading the files anyway to your server there is really no need to be storing them on google drive.

service accounts client sided javascript

Service accounts do not support client sided javascript, you will need to use a server sided language.

user_18418390
Related