Receiving Insufficient Permission error from DirectoryService

Question

I am trying to setup c# code to manage our Google domain.

I am receiving this error whenever I call service.Users.List() or any other method from the DirectoryServic

Answer 1

Here is my working credentials code:

using (var stream =
    new FileStream("client_secret.json", FileMode.Open, FileAccess.Read))
    {
        string credPath = System.Environment.GetFolderPath(
            System.Environment.SpecialFolder.Personal);
            credPath = Path.Combine(credPath, ".credentials/calendar-dotnet-quickstart.json");

            UserCredential credential = GoogleWebAuthorizationBroker.AuthorizeAsync(
                GoogleClientSecrets.Load(stream).Secrets,
                new string[] { CalendarService.Scope.Calendar },
                "username@gmail.com",
                CancellationToken.None,
                new FileDataStore(credPath, true)).Result;
            Console.WriteLine("Credential file saved to: " + credPath);
        }

Make sure to Enable the API in the Console,

Answer 2

Scopes

It appears that you are trying this Quickstart:

• .NET Quickstart for Directory API

However, the scope(s) used in that tuturoial are:

new [] { DirectoryService.Scope.AdminDirectoryUserReadonly };

However, in the code your posted code you have:

new[] { DirectoryService.Scope.AdminDirectoryOrgunit, DirectoryService.Scope.AdminDirectoryUser },

Tokens

After you change your scopes (shown above), you may have to delete your OAuth2 token, and then re-authorize access for your application. (Unless you haven't done the "authorize access" step yet.)

\token.json\Google.Apis.Auth.OAuth2.Responses.TokenResponse-user

Enable APIs

Also, as I think you already discovered, enabling the Directory API is different process than enabling the Gmail API (and found at different URLs)

Enable Directory API

Enable Gmail API

Answer 3

2 options:

1. You didn't include the right Scope. Are you sure that DirectoryService.Scope.AdminDirectoryOrgunit, DirectoryService.Scope.AdminDirectoryUser are enough?
2. Did you enable the API in the Console? More information is available at: https://developers.google.com/api-client-library/dotnet/get_started#auth, Look for your project in https://console.cloud.google.com/project and make sure that you enabled the Directory Admin API.

Please update this thread if one of these options worked or something else is still missing for you.

Answer 4

The doc at url https://developers.google.com/gmail/api/quickstart/dotnet has scope set as static string[] Scopes = { GmailService.Scope.GmailReadonly }; set it as GmailService.Scope.MailGoogleCom and then continue with the flow as specified in the document.It was a bummer i was editing the scope in my token respnse file