使用Service Account创建Google Calendar事件的权限及异常问题排查

Let's break down your issues and walk through the official, working solution for creating Google Calendar events with attendees (including non-G-Suite users) using a Service Account without user authorization.

Root Cause of Your Problems #

1. 403 Error Even After Enabling Domain-Wide Delegation:
   Your initial authentication code didn't set the serviceAccountUser field. Service Accounts can't invite attendees on their own—they must impersonate a G-Suite domain user (like your noreply@xxxxx.com address) to perform this action. Without impersonation, the Service Account acts as its own identity, which lacks permission to send attendee invites.

2. "Could Not Find Event" After Removing Attendees:
   When you created the event without attendees, it was saved to the Service Account's internal (and largely inaccessible) calendar, not your noreply@xxxxx.com calendar. That's why the link led to a missing event.

Official Step-by-Step Solution #

1. Complete G-Suite & GCP Configuration #

First, ensure your Service Account has proper domain-wide delegation setup:

• GCP Console:
  1. Go to IAM & Admin > Service Accounts, select your Service Account.
  2. Edit the account, check Enable G Suite Domain-wide Delegation, then save. Note the generated Client ID.
• G Suite Admin Console (admin.google.com):
  1. Navigate to Security > API Controls > Manage Domain Wide Delegation.
  2. Click Add new, paste the Client ID, then add these OAuth scopes:
     • https://www.googleapis.com/auth/calendar (full calendar access)
     • Or https://www.googleapis.com/auth/calendar.events (limited to event operations)
  3. Save the changes.

2. Correct Java Authentication Code (With Impersonation) #

The key fix is adding setServiceAccountUser to impersonate your G-Suite domain user:

import com.google.api.client.googleapis.auth.oauth2.GoogleCredential;
import com.google.api.client.googleapis.javanet.GoogleNetHttpTransport;
import com.google.api.client.json.gson.GsonFactory;
import com.google.api.services.calendar.Calendar;
import com.google.api.services.calendar.CalendarScopes;

import java.io.FileInputStream;
import java.io.IOException;
import java.security.GeneralSecurityException;
import java.util.Collections;

public class CalendarAuthHelper {
    private static final GsonFactory JSON_FACTORY = GsonFactory.getDefaultInstance();

    public static Calendar getAuthorizedService(String credsPath, String impersonateUser) 
            throws IOException, GeneralSecurityException {
        GoogleCredential credential = GoogleCredential.fromStream(new FileInputStream(credsPath))
                .createScoped(Collections.singleton(CalendarScopes.CALENDAR))
                // Critical: Impersonate your G-Suite domain user here
                .setServiceAccountUser(impersonateUser);

        return new Calendar.Builder(GoogleNetHttpTransport.newTrustedTransport(), JSON_FACTORY, credential)
                .setApplicationName("Your App Name")
                .build();
    }
}

3. Create Event with Attendees (Including Non-G-Suite Users) #

Use the authenticated service to create events in your impersonated user's calendar (e.g., noreply@xxxxx.com's primary calendar):

import com.google.api.services.calendar.model.Event;
import com.google.api.services.calendar.model.EventAttendee;
import com.google.api.services.calendar.model.EventDateTime;

import java.io.IOException;
import java.security.GeneralSecurityException;
import java.util.ArrayList;
import java.util.List;
import java.util.TimeZone;

public class CreateCalendarEvent {
    public static void main(String[] args) {
        try {
            String serviceAccountKeyPath = "path/to/your/service-account-key.json";
            String impersonatedUser = "noreply@xxxxx.com"; // Your G-Suite domain user
            Calendar calendarService = CalendarAuthHelper.getAuthorizedService(serviceAccountKeyPath, impersonatedUser);

            // Build the event
            Event event = new Event()
                    .setSummary("Team Sync")
                    .setLocation("Virtual")
                    .setDescription("Monthly team sync meeting with cross-domain attendees");

            // Set start/end times
            EventDateTime start = new EventDateTime()
                    .setDateTime(new com.google.api.client.util.DateTime("2024-10-15T14:00:00"))
                    .setTimeZone(TimeZone.getDefault().getID());
            event.setStart(start);

            EventDateTime end = new EventDateTime()
                    .setDateTime(new com.google.api.client.util.DateTime("2024-10-15T15:30:00"))
                    .setTimeZone(TimeZone.getDefault().getID());
            event.setEnd(end);

            // Add attendees (mix of G-Suite and non-G-Suite users)
            List<EventAttendee> attendees = new ArrayList<>();
            attendees.add(new EventAttendee().setEmail("colleague@your-g-suite-domain.com"));
            attendees.add(new EventAttendee().setEmail("external-partner@example.com"));
            event.setAttendees(attendees);

            // Send email invites to all attendees
            event.setSendUpdates("all");

            // Insert event into the impersonated user's primary calendar
            Event createdEvent = calendarService.events().insert("primary", event).execute();
            System.out.println("Event created successfully: " + createdEvent.getHtmlLink());

        } catch (IOException | GeneralSecurityException e) {
            e.printStackTrace();
        }
    }
}

Critical Notes #

• Impersonation is Mandatory: All calendar operations are performed under the impersonated G-Suite user's identity, so events will appear in their calendar, and invites will be sent from their email.
• Attendee Permissions: The impersonated user must have permission to send calendar invites (this is enabled by default for G-Suite users).
• Event Visibility: The generated htmlLink will now point to the correct event in the impersonated user's calendar, so you won't see the "Could not find event" error anymore.

内容的提问来源于stack exchange，提问作者Naanavanalla