Problem
ssosync authenticates to the Google Admin SDK only via a downloaded service-account key (google.JWTConfigFromJSON). That's a blocker in environments that prohibit SA keys:
- GCP org policy
iam.disableServiceAccountKeyCreation (common in hardened orgs).
- Running ssosync outside GCP (e.g. an AWS Lambda), where the modern keyless approach is Workload Identity Federation rather than a static key.
There is currently no way to run ssosync without a long-lived key.
Proposal
When no service-account key is provided, fall back to Application Default Credentials + service-account impersonation (google.golang.org/api/impersonate), carrying the Workspace admin as Subject so domain-wide delegation still applies. It activates only when a key is absent and GOOGLE_IMPERSONATE_SERVICE_ACCOUNT is set; the existing key path and the requested scopes are unchanged (fully backward compatible).
This lets ssosync run keyless — e.g. an AWS Lambda federated to GCP via WIF, impersonating the sync service account — with no long-lived credential.
We run this in production today, and I'm opening a PR alongside this issue per the CONTRIBUTING issue-first guidance.
Problem
ssosyncauthenticates to the Google Admin SDK only via a downloaded service-account key (google.JWTConfigFromJSON). That's a blocker in environments that prohibit SA keys:iam.disableServiceAccountKeyCreation(common in hardened orgs).There is currently no way to run ssosync without a long-lived key.
Proposal
When no service-account key is provided, fall back to Application Default Credentials + service-account impersonation (
google.golang.org/api/impersonate), carrying the Workspace admin asSubjectso domain-wide delegation still applies. It activates only when a key is absent andGOOGLE_IMPERSONATE_SERVICE_ACCOUNTis set; the existing key path and the requested scopes are unchanged (fully backward compatible).This lets ssosync run keyless — e.g. an AWS Lambda federated to GCP via WIF, impersonating the sync service account — with no long-lived credential.
We run this in production today, and I'm opening a PR alongside this issue per the CONTRIBUTING issue-first guidance.