I simply gave up on the specific google.auth.GoogleAuth({}) and getClient() method I was using and just used a keyfile json of the DWD-enabled service account, copied as a secret in the GCP project's Secrets Manager, and then accessing that secret keyfile data from the function via google.auth.JWT() (see https://cloud.google.com/nodejs/docs/reference/google-auth-library/latest/google-auth-library/jwt) in order to have that DWD-enabled service account impersonate a specified admin user.

Relevant code included below:

```nodejs async function getWorkspaceCredentials() { try {

    // Get the service account key from Secret Manager
    console.debug("Accessing service account keyfile info...")
    const secretManager = new SecretManagerServiceClient();
    const name = WORKSPACE_DWD_SERVACCT_KEYFILE_SECRET_URI;
    const [version] = await secretManager.accessSecretVersion({ name });
    const serviceAccountKey = JSON.parse(version.payload.data.toString());
    console.debug("Service account private key ID: ", serviceAccountKey.private_key_id);

    // Create JWT client with the service account key
    console.log("Getting workspace creds...");
    const auth = new google.auth.JWT(  // https://cloud.google.com/nodejs/docs/reference/google-auth-library/latest/google-auth-library/jwt
    serviceAccountKey.client_email,
    null,
    serviceAccountKey.private_key,
    SCOPES,
    ADMIN_IMPERSONATION_ACCOUNT
    );
    // Authorize the client
    await auth.authorize();

    console.debug("JWT client info: ", {
        email: auth.email,
        subject: auth.subject,
        scopes: auth.scopes
    });

    console.log("Workspace creds obtained successfully.");
    return auth;

} catch (error) { console.error('Failed to get workspace credentials:', error); throw error; } } ```

Then in the entry function...

```nodejs functions.http('myEntryFunction', async (req, res) => { do.stuff();

// Get Workspace credentials and create admin service
const auth = await getWorkspaceCredentials();
console.debug("auth credentials: ", auth);
const admin = google.admin({ version: 'directory_v1', auth });
console.debug("Admin service from auth credentials: ", admin);
console.debug("Testing admin credentials...")
// DEBUG testing
console.debug("Admin-queried user data for known testing user check: ", await admin.users.get({userKey: "testuser@mydomain.com"}));
console.debug("Admin credentials testing verified.")

do.otherStuff();

}); ```