在Google Cloud Function中通过关联服务账户获取google.oauth2凭证的问题

方案一：无需密钥文件实现域委派 #

google.auth.default()返回的ComputeEngineCredentials没有with_subject方法，你可以通过云函数的metadata服务获取关联服务账户信息，直接构建支持委派的凭证：

@functions_framework.cloud_event
def process_message(cloud_event):
    import google.auth
    import requests
    from google.oauth2 import service_account
    from googleapiclient.discovery import build

    SCOPES = ['https://www.googleapis.com/auth/gmail.readonly']
    USER_EMAIL = "user@your-domain.com"  # 替换为目标用户邮箱

    # 获取云函数关联服务账户的邮箱
    metadata_url = "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/email"
    service_account_email = requests.get(metadata_url, headers={"Metadata-Flavor": "Google"}).text

    # 构建支持域委派的凭证
    delegated_credentials = service_account.Credentials.from_service_account_info(
        {
            "client_email": service_account_email,
            "token_uri": "https://oauth2.googleapis.com/token",
        },
        scopes=SCOPES,
        subject=USER_EMAIL
    )

    # 调用Gmail API
    service = build('gmail', 'v1', credentials=delegated_credentials)
    results = service.users().messages().list(userId='me').execute()

    return results

关键前提： #

• 服务账户已开启全域委派权限（云控制台服务账户详情页配置）
• Google Workspace Admin控制台中，已为该服务账户授权https://www.googleapis.com/auth/gmail.readonly范围（路径：安全 > API控制 > 域宽权限委派）

方案二：修复impersonated_credentials的404错误 #

你之前遇到的Gaia id not found错误，大概率是配置或参数问题，以下是修复后的代码及排查点：

修复后代码 #

@functions_framework.cloud_event
def process_message(cloud_event):
    import google.auth
    from google.auth import impersonated_credentials
    from googleapiclient.discovery import build

    SCOPES = ['https://www.googleapis.com/auth/gmail.readonly']
    USER_EMAIL = "user@your-domain.com"

    # 获取源服务账户凭证（需包含IAM权限）
    source_credentials, _ = google.auth.default(scopes=["https://www.googleapis.com/auth/iam"])

    # 创建模拟用户的凭证
    target_credentials = impersonated_credentials.Credentials(
        source_credentials=source_credentials,
        target_principal=USER_EMAIL,
        target_scopes=SCOPES,
        lifetime=3600  # 有效期最长3600秒
    )

    # 调用Gmail API
    service = build('gmail', 'v1', credentials=target_credentials)
    results = service.users().messages().list(userId='me').execute()

    return results

必查配置项： #

1. 目标用户邮箱正确性：确认target_principal是域内存在的完整邮箱，无拼写错误
2. API启用状态：云控制台中已启用IAM Service Account Credentials API
3. 权限覆盖：服务账户已在Google Workspace中完成域宽权限委派授权

内容的提问来源于stack exchange，提问作者user21817668