Create Google Calendar Event With Credentials To Impersonate User with Google Calendar API Library .NET 7 C#

In .NET 7, without specifying a User in the

ServiceAccountCredential.Initializer(original.Id)

block, my calendar event can be created with no errors. But if I specify a user as shown below, I get this error:

> Error: unauthorized_client,
> Description: Client is unauthorized to retrieve access tokens using this method, or client not authorized for any of the scopes requested.

My service account has domain-wide delegation, allowed scope of
calendar via OAuth2, and I have specifically granted the SA access to the user's calendar (when I try on accounts that have not specifically granted access, I can't create a calendar entry at all).

How do I get appropriate credentials for the service account to impersonate the end user within my domain?

Credit for getting this far to creating-a-serviceaccountcredential-for-a-user-from-a-systems-account

Previous answers don't seem to be working on latest release.

In my API code, which calls the authentication service then creates the event:

Google.Apis.Calendar.v3.CalendarService CS = await SA.AuthenticateServiceAccountSO();

var result = CS.Events.Insert((Event)newEvent, clientemail).Execute();

In Service AuthenticateServiceAccountSO():

public async Task<CalendarService> AuthenticateServiceAccountSO()
{
    await Task.Delay(1);
    string? serviceAccountCredentialFilePath = _config.GetValue<string>("ServiceAccountFilePath");
    string? ClientEmail = _config.GetValue<string>("TestingUserAccountEmail");
    
    string[] scopes = new string[] { CalendarService.Scope.Calendar };
    
    ServiceAccountCredential original = (ServiceAccountCredential)GoogleCredential.FromFile(serviceAccountCredentialFilePath).UnderlyingCredential;
    
    var initializer = new ServiceAccountCredential.Initializer(original.Id)
                          {
                              User = ClientEmail,
                              Key = original.Key,
                              Scopes = scopes
                          };
    
    var credential = new ServiceAccountCredential(initializer);
    
    CalendarService service = new(new BaseClientService.Initializer()
                {
                    HttpClientInitializer = credential,
                    ApplicationName = "Calendar_Appointment event Using Service Account Authentication"
                });
    
    return service;
}

You're currently copying relatively little of the service account credential - in particular, there's no KeyId. But you can do it all much more simply anyway:

var credential = GoogleCredential.FromFile(serviceAccountCredentialFilePath)
    .CreateScoped(CalendarService.Scope.Calendar)
    .CreateWithUser(ClientEmail);