Cannot impersonate user for gmail with service account

einarpersson · June 7, 2022, 2:52pm

Hi! I am pretty new here.

We are a small company (non-profit) that have a number of clients.

I want to build an internal tool that makes it possible to fetch all ingoing/outgoing emails to certain clients (email-addresses). The idea is that everyone on the team should be able to via a dashboard get an “activity feed” with all messages related to each client regardless of who’ve sent/received them from our side.

I created a service account, and activated Domain-wide delegation with scope https://mail.google.com/
I’ve enabled the Gmail API

In n8n (cloud) I’ve created service account google credentials, added the service account email as well as the private key. It says “Connection tested successfully” until I add a user to impersonate. And as I’ve understood it, I need to impersonate an user to be able to fetch its messages.

If “impersonate user” is ON but without email specified, it works. But if I add my own email for example, it says:

Couldn’t connect with these settings 
401 - {"error":"unauthorized_client","error_description":"Client is unauthorized to retrieve access tokens using this method, or client not authorized for any of the scopes requested."}

So I am stuck here.

Any ideas on how to troubleshoot this? What could be the error?

MutedJam · June 8, 2022, 8:03am

Hey @einarpersson, I am sorry to hear you’re having trouble here. Unfortunately I am not an admin in our Google Workspace account (so can’t test this myself), but have asked internally for help with looking into this.

einarpersson · June 8, 2022, 2:45pm

Ok, yes thanks! Right now I am kind of stuck.

Supplying a couple of screenshots to show my settings

einarpersson · June 8, 2022, 7:43pm

@MutedJam

I have verified that I can use the service account credentials to impersonate a user for Google Sheets as shown in this tutorial. Note though that the credentials user interface still gives an error message (but they work!) which is described in this github issue (2397).

However my original problem persists, since I want to use Gmail API, and here I still get an error even if I just “ignore” the error in the credentials UI.

–
Am I lacking any scopes for gmail?
What scopes are needed?

**Edit: **

I found this this definition of scopes regarding gmail.
After I added all those, it started working!

However - Necessary scopes for these nodes should really be available in the node documentation!

A_Salim · June 30, 2024, 10:20pm

Hey @einarpersson. I know I’m 2 years late but how did you manage to add the scopes to that node ? would appreciate the help from anyone

A_Salim · June 30, 2024, 10:22pm

I should mention I’m using the Gmail New Message trigger node. so I’m not sending a request but rather waiting for one

Patrick_White · October 7, 2024, 8:05am

Hey mate did u find anything on this? Spent a full week around google oauth, service accounts and bloody nora I would love this to be over.

A_Salim · October 8, 2024, 4:35pm

Hey, I didn’t really get to work through this but I used the IMAP Email node to check my inbox instead as a workaround.

Patrick_White · October 10, 2024, 12:52am

github.com/n8n-io/n8n

Google Service Account Impersonation failing validation (but working)

opened 11:22AM - 02 Nov 21 UTC

closed 12:42PM - 17 Jan 23 UTC

Yann-J

node/issue

**Describe the bug** Google Service Account authentication works fine, but fa…ils whenever we try to configure impersonation (even though the same works from other apps). The returned error from Google is: ``` Private key validation failed: 401 - {"error":"unauthorized_client","error_description":"Client is unauthorized to retrieve access tokens using this method, or client not authorized for any of the scopes requested."} ``` **To Reproduce** 1. Create a Google Service Account and generate JSON key. 2. Enable the Drive API to the account's project 3. Grant it domain-wide delegation by adding its client id in the Google Workspace delegation settings, and enable the `https://www.googleapis.com/auth/drive` scope for domain delegation 4. Create a new Google API credentials in n8n, set service account email and Private key. Verify that it works fine 5. Enable Impersonation and provide a valid email from the domain. Test credential again, it fails, even with minimal API scopes (Drive). **Expected behavior** Credential should work with impersonation. **Environment (please complete the following information):** - OS: Official Docker image - n8n Version: 0.145.0 - Database system: SQLite - Operation mode: `own` **Additional context** The same Service Account / impersonated user combination has been confirmed to work fine with other applications (rclone) which can successfully read and write files from my drive, ruling out any misconfiguration in the user / workspace settings. The service account is also working fine without impersonation (but this is not a solution for us, since those accounts have a serious Drive quota limitation). I suspect that n8n is maybe asking for too many scopes when authenticating (?). We've only enabled the Drive scope for delegation... But we haven't been able to figure out which other scopes might need adding... ![image](https://user-images.githubusercontent.com/59641363/139837146-50279a9e-658f-4cc2-9b8c-6c2315b2a896.png) Any help appreciated!

This worked a charm !!!