Oauth service to service auth problems

[Carlos Peñas]

Wow quite an empty group... ¿Is there someone?

Hi I was late night hacking and testing google api client for Ruby.

I fell in an error perhaps by missunderstanding.


What I already done

- I already created an app in google developer console
- I enabled the calendar api
- I created the Server Key and downloaded the p12.
- I managed to see that calendar metadata using the google api explorer and browser oauth

What I'm triying to do:

I'm triying to get events from a privately shared calendar where I have read permissions (trough a group) in a google apps for work account (the-cocktail.com) in Ruby ona service to service auth

How I'm triying to do it

With this code:

  1 require 'google/api_client'
  2 require 'pp'
  3 client = Google::APIClient.new
  4
  5 cal = client.discovered_api('calendar','v3')
  6
  7 id = 'the-cocktail.com_xx...@group.calendar.google.com'  # id is the confirmed calendar ID
  8
  9 key = Google::APIClient::KeyUtils.load_from_pkcs12('sl.p12', 'notasecret')
 10 client.authorization = Signet::OAuth2::Client.new(
 11   :token_credential_uri => 'https://accounts.google.com/o/oauth2/token',
 12   :audience => 'https://accounts.google.com/o/oauth2/token',
 13   :scope => 'https://www.googleapis.com/auth/calendar',
 14   :issuer => 'xxxxxxxxxxxxx...@developer.gserviceaccount.com',  # confirmed issuer
 15
 16   :signing_key => key
 17 )
 18
 19 client.authorization.fetch_access_token!
 20
 21 result = client.execute(
 22   :api_method => cal.calendars.get,  
 23   :parameters => { 'calendarId' => id }  
 24 )
 25
 26 puts result.response.body
 27
 28 pp result

Results colected

When I do this y get a 404, something like "that calendar does not exists"

{
 "error": {
  "errors": [
   {
    "domain": "global",
    "reason": "notFound",
    "message": "Not Found"
   }
  ],
  "code": 404,
  "message": "Not Found"
 }
}

But if i change id per 'primary'

I get:

 {
 "kind": "calendar#calendar",
 "etag": "\"dAAhx6wYoPw2vqRAe54lk5wa0XQ/WEglF6_c5pVHKyggcENvvX1cS9g\"",
 "id": "xxxxxxxxxxxxxxxxx...@developer.gserviceaccount.com",    #same as issuer id ??? WTF
 "summary": "xxxxxxxxxxxxxxxxxx...@developer.gserviceaccount.com",
 "timeZone": "UTC"
}

Which seems to be a calendar but it's like the default calendar for the "email issuer" account that appears in the server key "email" field

I couldn't find a way to change that email into mine, so what I'm doing wrong?