.NET 7中服务账号模拟用户创建谷歌日历事件遇权限问题

在.NET 7环境下，使用Google服务账号调用日历API时，不指定User参数可以正常创建日历事件；但**指定User（模拟域内终端用户）**后触发以下错误：

Error: unauthorized_client,
Description: Client is unauthorized to retrieve access tokens using this method, or client not authorized for any of the scopes requested.

已完成的配置：

• 服务账号已配置全域委派
• 通过OAuth2授予了日历相关权限
• 已为该服务账号开通目标用户的日历访问权限（未授权的账号无法创建日历条目）

需求：如何获取正确的凭据，让服务账号能在域内模拟终端用户操作日历？

现有API调用代码 #

Google.Apis.Calendar.v3.CalendarService CS = await SA.AuthenticateServiceAccountSO();

var result = CS.Events.Insert((Event)newEvent, clientemail).Execute();

现有认证方法代码 #

public async Task<CalendarService> AuthenticateServiceAccountSO()
{
    await Task.Delay(1);
    string? serviceAccountCredentialFilePath = _config.GetValue<string>("ServiceAccountFilePath");
    string? ClientEmail = _config.GetValue<string>("TestingUserAccountEmail");
    
    string[] scopes = new string[] { CalendarService.Scope.Calendar };
    
    ServiceAccountCredential original = (ServiceAccountCredential)GoogleCredential.FromFile(serviceAccountCredentialFilePath).UnderlyingCredential;
    
    var initializer = new ServiceAccountCredential.Initializer(original.Id)
                          {
                              User = ClientEmail,
                              Key = original.Key,
                              Scopes = scopes
                          };
    
    var credential = new ServiceAccountCredential(initializer);
    
    CalendarService service = new(new BaseClientService.Initializer()
                {
                    HttpClientInitializer = credential,
                    ApplicationName = "Calendar_Appointment event Using Service Account Authentication"
                });
    
    return service;
}

解决方案（适配.NET 7与最新Google.Apis库） #

针对最新版Google.Apis库，推荐使用官方封装的CreateWithUser方法构建模拟用户凭据，替代手动初始化ServiceAccountCredential的方式，避免底层参数配置遗漏：

修改后的认证方法：

public async Task<CalendarService> AuthenticateServiceAccountWithImpersonation()
{
    string serviceAccountFilePath = _config.GetValue<string>("ServiceAccountFilePath") 
        ?? throw new ArgumentNullException("ServiceAccountFilePath未配置");
    string impersonateUserEmail = _config.GetValue<string>("TestingUserAccountEmail")
        ?? throw new ArgumentNullException("TestingUserAccountEmail未配置");
    
    string[] scopes = { CalendarService.Scope.Calendar };

    // 从服务账号文件直接创建带模拟用户的凭据
    GoogleCredential credential = GoogleCredential.FromFile(serviceAccountFilePath)
        .CreateScoped(scopes)
        .CreateWithUser(impersonateUserEmail);

    CalendarService service = new CalendarService(new BaseClientService.Initializer()
    {
        HttpClientInitializer = credential,
        ApplicationName = "Calendar_Appointment event Using Service Account Authentication"
    });

    return service;
}

关键验证点 #

1. 全域委派范围匹配：在Google Admin控制台中，确认服务账号的全域委派已添加https://www.googleapis.com/auth/calendar范围，与代码中的Scope完全一致
2. 日历权限确认：目标用户的日历需共享给服务账号，且授予编辑/修改权限
3. NuGet版本检查：确保Google.Apis.Calendar.v3和Google.Apis.Auth包为最新稳定版（建议v1.60+）
4. 用户邮箱有效性：模拟的用户邮箱必须是域内有效账号，且与共享日历的目标用户完全匹配

内容的提问来源于stack exchange，提问作者user13814551