Google Admin SDK authentication with service account

问题

My team is currently developing an application to list my company's domain users in GCP, using the Admin SDK, for onboarding and offboarding purposes.

We're using a service account to do this and we've have added the admin.directory.user.readonly scope, in the Google Admin's advanced settings, to it. The Admin SDK API is activated and we can see the service account in the Credentials area.

When we invoke the https://www.googleapis.com/admin/directory/v1/users endpoint with the parameters viewType=domain_public and domain=[our domain], while using an access token generated with oauth2l, we receive the following message:

{
   "error": {
       "errors": [
           {
               "domain": "global",
               "reason": "forbidden",
               "message": "Not Authorized to access this resource/api"
           }
       ],
       "code": 403,
       "message": "Not Authorized to access this resource/api"
   }
}

Could there be any domain restriction being applied that we don't have vision of?

回答1:

The service account does not have permission to call Directory APi for your G Suite instance. What it does have access to do is act as a user in your domain within the context of the Directory API scope(s) you granted it access to.

When getting service account credentials you need to add the sub=admin@yourdomain.com parameter so that you are acting as your domain admin, not the service account. See:

https://developers.google.com/identity/protocols/OAuth2ServiceAccount

And some code examples at:

https://developers.google.com/admin-sdk/directory/v1/guides/delegation

来源：https://stackoverflow.com/questions/60078324/google-admin-sdk-authentication-with-service-account

标签

google-cloud-platform