[Golang] Use google admin sdk from service account impersonating as user #adminsdk

service-account-admin-sdk.go

// It took me few hours how to get this to work
// Have a service account in GCP which wanted to use Admin SDK with Google Workspace
// The service account needs to have the following role: `roles/iam.serviceAccountTokenCreator`
// You need to create a domain wide delegation for the service account client id

import (
	"google.golang.org/api/impersonate"
	"google.golang.org/api/option"
  	"context"
)

func main() {
	ctx := context.Background()
	// // Base credentials sourced from ADC or provided client options.
	ts, err := impersonate.CredentialsTokenSource(
		ctx,
		impersonate.CredentialsConfig{
			TargetPrincipal: "[email protected]", // this is the *service account*
			Scopes:          []string{admin.AdminDirectoryGroupReadonlyScope, admin.AdminDirectoryUserReadonlyScope}, // the scopes you want to obtain
			Subject:         "[email protected]", // service accounts impersonate as a *user* in the google workspace, so you must enter an email here 
		})

	adminService, err := admin.NewService(context.Background(), option.WithTokenSource(ts))
	if err != nil {
		return nil, err
	}

	res, err := a.adminService.Groups.List().Context(ctx)
	// ...
  
}