title: Transfer ownership of Google Drive documents
body: <p>We develop application in C# which need to transfer ownership of all Google Drive documents related to the curtain domain to a single certain user without permission of original owner. We are using trial version of Google Apps business account.</p>
  
  <p>In principal, we need to do this: <a href="http://screencast.com/t/effVWLxL0Mr4" rel="nofollow">http://screencast.com/t/effVWLxL0Mr4</a> but in C# code.</p>
  
  <p>Accourding to the documentation, it is implemented in OAuth2 as superadmin functionality. <a href="https://support.google.com/a/answer/1247799?hl=en" rel="nofollow">https://support.google.com/a/answer/1247799?hl=en</a> (1).
   But document was deprecated and more over we did not find any API call to do that. </p>
  
  <p>Using account of project creator, it is appeared, that he can not access to all files and can not see files is not shared with him. </p>
  
  <p>In Google Admin Console  in manage API client access we added access rights to him  to access files without permission to files without permission. Link: <a href="http://screencast.com/t/zU9cc6Psyb" rel="nofollow">screencast.com/t/zU9cc6Psyb</a>.  We added routes access routes there according to that document link:  <a href="http://trovepromo-tf.trove-stg.com/0m1-sds/support.google.com/a/answer/162106?hl=en" rel="nofollow">trovepromo-tf.trove-stg.com/0m1-sds/support.google.com/a/answer/162106?hl=en</a> and tried again.
   It did not work out...</p>
  
  <p>Also, We found out that we need to use service account to have access to all data of all users of the domain, therefore we generated API keys for service account link:  <a href="http://screencast.com/t/rNKuz6zchwV" rel="nofollow">screencast.com/t/rNKuz6zchwV</a> in the created project and got authenticated in the application using the following code:</p>
  
  <pre><code>var certificate = new X509Certificate2(@"C:\Temp\key.p12", "notasecret", X509KeyStorageFlags.Exportable);
  
          ServiceAccountCredential credential = new ServiceAccountCredential(
             new ServiceAccountCredential.Initializer("Service account email")
             {
                 User= "admin@domain.com",
                 Scopes = new[] { DriveService.Scope.Drive }
             }.FromCertificate(certificate));
  </code></pre>
  
  <p>but when we try to get list of folders, we get error :"<code>access_denied</code>", Description:<code>"Requested client not authorized.", Uri:""</code></p>
  
  <p>Please help us to transfer ownership of one user to another by service account! </p>
  
  <p><strong>Update from 13-08-2014:</strong> </p>
  
  <p>Dear, It seems I have problem with user impersonalization.<br>
  1) When I use api to connect on behalf of user. During the authentication it redirects to browser and ask permisstion. After that all is completely fine, I can manimulate with folders except one one thing: I can not transfer ownership to him
  2) When I use service account without impersonalization, authentication looks like the following: </p>
  
  <pre><code>ServiceAccountCredential credential = new ServiceAccountCredential(
             new ServiceAccountCredential.Initializer(ServiceAccountId)
             {
  
                 Scopes = new[] { DriveService.Scope.Drive, 
                                            DriveService.Scope.DriveAppdata,
                                            DriveService.Scope.DriveFile, 
                                            DriveService.Scope.DriveScripts,
                                            DirectoryService.Scope.AdminDirectoryUser,
                                            DirectoryService.Scope.AdminDirectoryGroup,
                                            DirectoryService.Scope.AdminDirectoryOrgunit,
                                            DirectoryService.Scope.AdminDirectoryUserReadonly 
                  },
  
  
             }.FromCertificate(certificate));
  </code></pre>
  
  <p>Then I can access to all files shared to service account but (again) I can not transfer the rights.</p>
  
  <p>3) Then I try impersonalize Service account by adding  sypeadministrator email account to the user User = myaddress@mydomain.com</p>
  
  <pre><code>ServiceAccountCredential credential = new ServiceAccountCredential(
             new ServiceAccountCredential.Initializer(ServiceAccountId)
             {
  
                 Scopes = new[] { DriveService.Scope.Drive, 
                                            DriveService.Scope.DriveAppdata,
                                            DriveService.Scope.DriveFile, 
                                            DriveService.Scope.DriveScripts,
                                            DirectoryService.Scope.AdminDirectoryUser,
                                            DirectoryService.Scope.AdminDirectoryGroup,
                                            DirectoryService.Scope.AdminDirectoryOrgunit,
                                            DirectoryService.Scope.AdminDirectoryUserReadonly 
                  },
               User = AdminEmail,
  
             }.FromCertificate(certificate));
  </code></pre>
  
  <p>Then I have Error:"access_denied", Description:"Requested client not authorized.", Uri:""</p>
  
  <p>How can I impersonalize service account correctly?</p>
  
  <p><strong>Updated 13-08-2014</strong></p>
  
  <p>We found out that basic api for authentication is here: <a href="https://developers.google.com/accounts/docs/OAuth2ServiceAccount#creatingjwt" rel="nofollow">https://developers.google.com/accounts/docs/OAuth2ServiceAccount#creatingjwt</a></p>
  
  <p>Normally, all what I showed before is an .net implementation of the protocol. </p>
  
  <p>How can we please do impersonalization of of user in .net code. We did not find any working .net implementation of it. </p>