title: Is it possible to impersonate domain's users with Google Drive API using Google Apps Script?
body: <p>I am a head of studies and school administrator of our Google Apps for Education.</p>
  
  <p>I used Google Apps Script for a lot of applications (control of absences, sending emails, automatic reporting, ScriptDb databases and more) using gas services. It's fantastic.</p>
  
  <p>Basically I need to create a folder structure (years, courses, teachers, ...) within the Google Drive of students.</p>
  
  <p>With Google Apps Script services I can do it easily but then the folders belong to the creator (administrator) and I think then users spend the administrator storage quota. This does not interest me.
  (Yes, I can make an application to be executed by the users and create the structure in its Google Drive, but I'd rather do it in an automated manner and without intervention) </p>
  
  <p>To create this documents (and folders) in Google Drive users (teachers, students, ...) have adapted the code provided by Waqar Ahmad in this response [ <a href="https://stackoverflow.com/questions/10565463/add-an-writer-to-a-spreadsheet-via-google-document-list-api/10571203#10571203">Add an writer to a spreadsheet ... </a> ]</p>
  
  <p>That allows me to take possession of documents of other users to make updates using the Google Document List API (Google Apps administrative access to impersonate a user of the domain) and also have adapted to create folders and files on other Google Drive users. It works perfectly. I mention here:</p>
  
  <p><a href="https://stackoverflow.com/questions/12958382/how-to-add-a-google-drive-folder-to-my-drive-section-to-other-users/13614186#13614186">How to add a Google Drive folder ...</a></p>
  
  <p>But now, the version 3 of the Google Documents List AP, has been officially deprecated and encourage us to work with the Google API Drive.</p>
  
  <p>I tried to do the same with this new Google API. Has anyone managed to do this? Is it possible? I have no idea where to start!</p>
  
  <p>Thank you.</p>
  
  <p>Sergi</p>
  
  <p>Updated:</p>
  
  <p>This is the code i'm working but I get an "invalid request" error:</p>
  
  <p>(...)</p>
  
  <pre><code>  var user = e.parameter.TB_email // I get user from a TextBox
  
  //https://developers.google.com/accounts/docs/OAuth2ServiceAccount
  //{Base64url encoded header}.{Base64url encoded claim set}.{Base64url encoded signature}
  
  //{Base64url encoded header}
   var header = '{"alg":"RS256","typ":"JWT"}' 
   var header_b64e = Utilities.base64Encode(header)
  
  //{Base64url encoded claim set}
   var t_ara = Math.round((new Date().getTime())/1000) // now 
   var t_fins = t_ara + 3600                           // t + 3600 sec
  
  
   var claim_set = '{"iss":"1111111111-xxxxxxxxxxxxxxxxxxxxxx@developer.gserviceaccount.com",'+
                   '"prn":"' + user + '",' +
                   '"scope":"https://www.googleapis.com/auth/prediction",'+
                   '"aud":"https://accounts.google.com/o/oauth2/token",'+
                   '"exp":'+t_fins+','+
                   '"iat":'+t_ara+'}'
  
     // where '1111111111-xxxxxxxxxxx... is my CLIENT-ID (API Access -&gt; Service Account)                   
  
  
   var claim_set_b64e = Utilities.base64Encode(claim_set)
   claim_set_b64e = claim_set_b64e.replace(/=/g,'')
  
  
   var to_sign = header_b64e + '.' + claim_set_b64e
  
   // [signature bytes] ???  // password 'isnotasecret???'
   var key_secret = DocsList.getFileById('0Biiiiiiiiii-XXXXXXXXXXX').getBlob().getBytes()
  
      // where '0Biiiiiiiiii-XXXXXXXXXXX'... is my p12 file (key_secret) uploaded to GDRive
      // I don't know if this is correct !!!
  
   var sign = Utilities.base64Encode(Utilities.computeHmacSha256Signature(to_sign, key_secret))
  
  
   var JWT_signed = to_sign + '.' + sign
   JWT_signed = JWT_signed.replace(/=/g,'')
  
   // Token Request /////////////////////////////////////////////////////////////
   var url = 'https://accounts.google.com/o/oauth2/token'
     //var url = 'https%3A%2F%2Faccounts.google.com%2Fo%2Foauth2%2Ftoken' ???
     //var url = 'https:' + '%2F%2Faccounts.google.com%2Fo%2Foauth2%2Ftoken' ???
  
   var parameters = {
   "method" : "POST",
   "payload" : '"' + 'grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer&amp;assertion=' + JWT_signed + '"',
   "contentType" : "application/x-www-form-urlencoded"
   }
  
   var content = UrlFetchApp.fetch(url,parameters) //.getContentText()
   // Token Request end ////////////////////////////////////////////////////////
  </code></pre>
  
  <p>And I get an "Invalid Request" and not a JSON with the token</p>
  
  <p>The 2 first parts ( header &amp; claim set ) are OK. The result are equal to the result of Google OAuth page.</p>
  
  <p>I don't know if the signature part are correct or if the error is in the token request. </p>