IssueTracker

A short description of the request:

Currently, user authentication is supported in a very limited way, in one 2 ways, both of which can't be used outside the domain the app is created in:

• By publishing the app to the domain-internal Google Workspace marketplace, and user-installing it there.
• By granting domain-wide delegation (DWD) of authority to the app in the Google Workspace admin console, and choosing up to 5 users or a single group to be able to impersonate, in the Google Chat API configuration in the GCP console.

It would be extremely useful and convenient to be able to deploy my chat app using user authentication by granting it DWD, and to be able to impersonate any user in the domain, without having to be published in the Google Workspace marketplace.

In addition, using uesr authentication through DWD outside of the domain the app was created in would be useful for my use case, of deploying a chat app in a customer's environment, without making it available publicly.

What is the purpose of this new feature?

To support user authentication through domain-wide delegation of authority for the entire domain the app was created in without publishing on the Google Workspace marketplace, and to support user authentication through DWD for domains other than the one the chat app was created in.

What existing APIs would this affect?

The APIs that requires user authentication or that act differently when using user authentication to app authentication, e.g., spaces.setup and spaces.members.create.

Please provide any additional information below.

A pretty common use case for chat applications (in e.g., Slack, Microsoft Teams, and Google Chat) is to be installed in specific customers' environments and to able to send a Direct Message (DM) to all users in the domain, and to specific channels. Oftentimes in these cases, the developer of the app does not wish the app to be publicly available, and only installed in their respective customers' environments. Supporting such a use case would benefit many users of Google Workspace and Google Chat, and user authentication through domain-wide delegation of authority for the entire domain and outside the domain the app was created in seems like the perfect solution for this use case.