Geek Answers Handbook

Google Admin API using Oauth2 for service account (Education Edition) - 403 Error

I'm having difficulty using the Google new Admin SDK. In particular, the directory API using Oauth2. I think I'm almost there, but I'm stuck trying to get user information using the Directory API (I use the Google Education Edition domain).

Basically what I'm trying to do is write a python script that sets or cancels the use of users based on their registration status, which our AD manages. I have a script that does this using Oauth1, but wants to update it to use Oauth2.

Here is a code snippet based on some examples that I found.

f = file('test_key.p12', 'rb') key = f.read() f.close() credentials = SignedJwtAssertionCredentials( ' 606346240424-10stfco1ukj9h4m4b4r40@developer.gserviceaccount.com ', key, scope= 'https://www.googleapis.com/auth/admin.directory.user') http = httplib2.Http() http = credentials.authorize(http) service = build(serviceName='admin', version='directory_v1', http=http) lists = service.users().get(userKey=' joe.blogs@mydomain.com ').execute(http=http) pprint.pprint(lists)

This part of the code looks correct, but when I try to execute the request, I get a 403 error.

ERROR: https://www.googleapis.com/admin/directory/v1/users/ joe.blogs@mydomain.com ? Alt = json returns "Not authorized to access this resource / api">

My first thought was that I did not enable this API in the Admin console ( Google API Console ), but I have one. (Actually, I included the administrator SDK, not the directory API, because the directory API is not included and seeing that it is part of the administrator SDK, will it work?).

Is there another step that I am missing, or have I made a stupid mistake somewhere?

+7
google-oauth
source share
2 answers

Bruce

you are pretty close.

A couple of elements:

  • If you are using App Engine, you need to convert the p12 key to pem and the header header
  • You must enable the user with superuser privileges (who has permission to perform these operations) whom you impersonate (not the user who is changing) using the sub= parameter

Thus, the complete code will look something like this:

  # domain configuration settings import domainconfig f = file(domainconfig.KEY_FILE, "rb") # b reads file in binary mode; not strictly necessary, but safer to avoid strange Windows EOL characters: https://stackoverflow.com/questions/9644110/difference-between-parsing-a-text-file-in-r-and-rb-mode key = f.read() f.close() credentials = SignedJwtAssertionCredentials( domainconfig.SERVICE_ACCOUNT_EMAIL, key, scope = domainconfig.SCOPE, sub=domainconfig.SUB_ACCOUNT_EMAIL # 'sub' supercedes the deprecated 'prn' ) http = httplib2.Http() http = credentials.authorize(http) directoryservice = build("admin", "directory_v1", http=http) users = directoryservice.users() response = users.get(userKey=' joe.blogs@mydomain.com ').execute()
+6
source share

This should help: https://developers.google.com/drive/delegation

When approving the credentials, you need to connect it to the user who will be changed. From the link above, pay attention to this section:

 credentials = SignedJwtAssertionCredentials(SERVICE_ACCOUNT_EMAIL, key, scope='https://www.googleapis.com/auth/drive', sub=user_email)
0
source share

More articles:


All Articles