Appendix B: Use Impersonation in Google Calendar API

Some customers may not want to use the opt-in model where the room shares the calendar with the service account. Instead, a second configuration option is available that will allow the service account (used by Crestron Fusion® software) to access the Google Calendar® API to use the identity of another account.

Typically, the account that the service account impersonates has elevated privileges. With elevated privileges, the account being impersonated can read and write to the room calendar that is being shared.

NOTE: For impersonation, it is not necessary to share room accounts with the service account and should be avoided.

To configure impersonation:

  1. Open the Google API Console menu using the process described in Initial Setup.
  2. Select the Permissions link to open the Permissions page. The user can access the service accounts Crestron Fusion will use to access the Google Calendar API.

    3. Permissions Link

    Permissions Link

  3. Select the Service accounts link to display the services accounts list.

    4. Permissions Link

    Permissions Link

  4. Select the View Client ID link to open the Credentials form. The View Client ID contains the service account that will use impersonation.

    5. Service Accounts List

    Service Accounts List

  5. Note the Client ID for later use, and then select Cancel.
  6. Navigate to www.google.com and sign in as an Administrator.

    7. Google API Console - Sign in Page

    Google API Console - Sign in Page

  7. Select the grid icon at the top of the page.
  8. Select the Admin icon to open the Admin console menu.

    9. Admin Console Menu

    Admin Console Menu

  9. Select the Security link to open the Security form.

    10. Security Link

    Security Link

  10. Select the Show more link.

    11. Security Form

    Security Form

  11. Select the Advanced settings link.

    12. Advanced Settings Link

    Advanced Settings Link

  12. Select the Manage API client access link to open the Manage API client access page.

    13. Manage API Client Access Link

    Manage API Client Access Link

  13. Enter the following:
    • Client Name: Enter the Service Account Name from the Credentials form.
    • One or More API Scopes: Enter "https://www.googleapis.com/auth/calendar".

    Manage API Client Access Page

    Manage API Client Access Page

  14. Select Authorize.
  15. Confirm that the service account was added to the list. At this point the service account is authorized to access any account.

    16. Manage API Client Access Page

    Manage API Client Access Page

  16. Open the Crestron Fusion Web Client and select Configuration to open the Configuration page.
  17. Select All from the tree menu and then select Add to open the Add Config Entry window.

    18. Configuration Page

    Configuration Page

  18. Determine the user account to be used for impersonation. Typically the admin account is used. However, an account with elevated privileges can be used.
  19. Obtain the email for this account from the Google API Sign In page.
  20. In the Add Config Entry page, enter the following:
    • Name: GoogleImpersonationUser
    • Type: VarChar250
    • Description: Google Impersonation User
    • Value: Email address (from step 18 above)

    Add Config Entry Page

    Add Config Entry Page

  21. Select Save & Close. The service account is now set to impersonate the account with the elevated privileges noted above.
  22. Run the tests as described in Set Up Crestron Fusion to Access Google Calendar API to confirm the impersonation has been configured properly.