title: Google cloud client libraries and user authentication
body: <p>I am developing my first app for Google Cloud Platform.</p>
  
  <p>In particular, I am using Node.js as base-framework. Google itself provides <a href="https://cloud.google.com/nodejs/docs/reference/libraries" rel="nofollow noreferrer">Node.js client libraries</a> to interact with their services.</p>
  
  <p>For instance, this code is able to create a new bucket within Cloud Storage:</p>
  
  <pre><code>var storage = require('@google-cloud/storage')();
  var bucket = storage.bucket('albums');
  bucket.create(function(err, bucket, apiResponse) {
    if (!err) {
      // The bucket was created successfully.
    }
  });
  
  //-
  // If the callback is omitted, we'll return a Promise.
  //-
  bucket.create().then(function(data) {
    var bucket = data[0];
    var apiResponse = data[1];
  });
  </code></pre>
  
  <p>However, if I deploy this code on Google Application Engine, the action above is done using a service account (I suppose, at least) and not as end-user, even after an OAuth authentication, thus ignoring the IAM policies in place.</p>
  
  <p>How could I avoid this problem, and use an user-centric flow for my requested? Can I use the Identiy-Aware Proxy? If yes, how?</p>
  
  <p><strong>Update</strong></p>
  
  <p>To make my question more understandable:</p>
  
  <p>Consider this code:</p>
  
  <pre><code>router.get('/test2', oauth2.required, (req, res, next)  =&gt; {
  
    const Storage = require('@google-cloud/storage');
  
    // Creates a client
    const storage = new Storage();
  
    // Lists all buckets in the current project
    storage
      .getBuckets()
      .then(results =&gt; {
        const buckets = results[0];
  
        console.log('Buckets:');
        buckets.forEach(bucket =&gt; {
          console.log(bucket.name);
        });
        res.send("There are " + buckets.length + " buckets.");
      })
      .catch(err =&gt; {
        res.send(err);
      });
  
  });
  </code></pre>
  
  <p>This route can be invoked if a given user has already signed in via OAuth2.</p>
  
  <p>I would like to invoke the <code>getBuckets()</code> method passing the OAuth accessToken to perform this operation impersonating the user itself.
  In this way, the action cannot skip the IAM rules in place in GCP for that given user currently logged.</p>
  
  <p>I didi try:</p>
  
  <pre><code>  const storage = new Storage({
          auth: {
              'bearer': req.user.accessToken
    }});
  </code></pre>
  
  <p>But it does not work. The application still uses my default account.</p>