How to use Google Service Account to retrieve Google Drive activities via Activity API?

user_10593052 0
Viewed 201

I have a Google Drive under my personal Google account. I have also set up a Google App with service account under my personal Google account. That service account has Owner role.

I am trying to use the service account to get listing of recent activity on some folder in my Google Drive. I added the service account email as a shared user for the folder with Edit permission. But whenever I run the Google Activity API I get no results for activities, even though I am doing various things in the shared folder, like adding files.

I am doing this in PHP via

    $client = new Google_Client();
    $client->setApplicationName('Some App');
    $client->setAuthConfig( __DIR__  . '/service_account.json');
    $client->setScopes(Google_Service_DriveActivity::DRIVE_ACTIVITY_READONLY);
    $client->fetchAccessTokenWithAssertion();

    $service = new Google_Service_DriveActivity($client);

    // Print the recent activity in your Google Drive.
    $request = new Google_Service_DriveActivity_QueryDriveActivityRequest();
    $request->setPageSize(10);
    $results = $service->activity->query($request);

    if (count($results->getActivities()) == 0) {
        print "No activity.\n";
    else // do something

It always triggers "No activity". I step through the code, and there are no errors. The project the service account is attached to has Google Activity API enabled.

Maybe this doesn't work because the service account is not the one doing the activities? Though I thought the whole point of a service account is to get data access on behalf of someone (in this case the someone being myself).

I just did test - I used my Oauth2 credentials for my app instead of the service account credentials and it works. But that is the thing - I really need this working for service account.

google-drive-activity-api google-api-php-client service-accounts google-api php
2 Answers

if you check the Auth section of the documentation for the Drive activity api. You will notice that it doesn't say that service accounts are supported.

The reason that its not working well actually it is working is this.

The Activity API consists of the DriveActivity resource, which represents changes made to objects within a user's Google Drive, and the query method, which allows you to retrieve information about those changes.

Its looking for changes for that user. not for a folder or directory on drive which you shared with the service account

The service account is a user and if that user has not changed anything then you are going to see "No activity"

Though I thought the whole point of a service account is to get data access on behalf of someone (in this case the someone being myself).

It is in a way, but the you are currently you are doing it on behalf of the service account. You have not delegated permissions to another user. To be clear sharing a folder with a service account does NOT constitute setting up delegation so that it can act on your behalf. So ...

To do that you would need to enabled domain wide delegation from a workspace account. This is something that may be worth trying.

user_18418390

(Posted solution on behalf of the question author to move it to the answer space).

Using the accepted answer, and some reading up on this, I have things working. Here is what I did to get this working.

  1. Created Service account per usual instructions (such as here: https://developers.google.com/admin-sdk/directory/v1/guides/delegation, under "Create the service account and credentials")

  2. At same link above, under "Delegate domain-wide authority to your service account", set the service account to have domain delegation. These instructions are not that great, since they don't really talk much about scopes. In doing all this, it isn't clear if there is some scope needed for user impersonation to work, as well as scope for some API, such as Google Drive API, or Drive Activity. I went with these:

https://www.googleapis.com/auth/drive
https://www.googleapis.com/auth/drive.activity.readonly
https://www.googleapis.com/auth/admin.directory.user

but really not sure if in my case, just https://www.googleapis.com/auth/drive.activity.readonly is needed. I could test that readily enough, but for now not worrying.

  1. Then in my PHP code, I do as I was doing above, but with the needed $client->setSubject('myemail'); line, which I finally understood after reading here:

https://github.com/googleapis/google-api-php-client#delegatingauthority

under "Authentication of Service Accounts". So like this:

    $client = new Google_Client();
    $client->setApplicationName('Some App');
    $client->setAuthConfig( __DIR__  . '/service_account.json');
    $client->setScopes(Google_Service_DriveActivity::DRIVE_ACTIVITY_READONLY);
    $client->fetchAccessTokenWithAssertion();
    $client->setSubject('myemail');
    $service = new Google_Service_DriveActivity($client);

    // Print the recent activity in your Google Drive.
    $request = new Google_Service_DriveActivity_QueryDriveActivityRequest();
    $request->setPageSize(10);
    $results = $service->activity->query($request);
user_4724950
Related