Received error "Not Authorized to access this resource/api" when trying to use Google Directory API and Service Account Authentication

Question

I'm really struggling with trying to use Service Account authentication to use the Google Directory API (Admin SDK).

Using client based three legged OAuth this works (tested here - https://developers.google.com/admin-sdk/directory/v1/reference/members/insert) but there's a problem with the permission delegation to the service account I am using. Under the Google Apps administration, I enabled using APIs and added the service account to the list of allowed OAuth clients as instructed.

Here is the code:

import httplib2
import sys

from apiclient.discovery import build
from oauth2client.client import SignedJwtAssertionCredentials

credentials = SignedJwtAssertionCredentials(
    '<KEY>@developer.gserviceaccount.com',
    '<KEY DATA>',
    scope='https://www.googleapis.com/auth/apps.groups.settings https://www.googleapis.com/auth/admin.directory.group https://www.googleapis.com/auth/admin.directory.group.member'
)
http = httplib2.Http()
http = credentials.authorize(http)

service = build("admin", "directory_v1", http=http)
groups = service.groups()
g = groups.get(groupKey="<GROUP NAME>").execute()

Eventually, I get the following error:

apiclient.errors.HttpError: <HttpError 403 when requesting https://www.googleapis.com/admin/directory/v1/groups/<GROUP NAME>?alt=json returned "Not Authorized to access this resource/api">

I tried using the following API as well:

service = build("groupssettings", "v1", http=http)

But this returns an error as well - "Backend Error".

Jay Lee · Accepted Answer · 2013-09-09 20:54:28Z

19

Even though you're using a Service Account you still need to act on behalf of a Google Apps user in the instance that has the proper admin permissions. Try doing:

credentials = SignedJwtAssertionCredentials(
  '<KEY>@developer.gserviceaccount.com',
  '<KEY DATA>',
  scope='https://www.googleapis.com/auth/apps.groups.settings https://www.googleapis.com/auth/admin.directory.group https://www.googleapis.com/auth/admin.directory.group.member',
  sub='[email protected]'
)

where [email protected] is a super administrator in your Google Apps account.

answered Sep 9, 2013 at 20:54

Jay Lee

13.5k3 gold badges32 silver badges60 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

Ron Reiter Over a year ago

Thanks, it worked! How did you know this solution? I knew this type of solution was the one I was looking for but I couldn't find the relevant docs.

Seb P Over a year ago

This sub='[email protected]' make it works !

Jay Lee Over a year ago

This process is now documented at: developers.google.com/admin-sdk/directory/v1/guides/delegation

Sardonic Over a year ago

Do we still use '[email protected]' as serviceAccountUser?? It seems like only '[email protected]' is legitimate.

user85461 Over a year ago

Using the google.oauth2.service_account.Credentials API, this is:

creds = service_account.Credentials.from_service_account_info(service_account_json, scopes=scopes, subject="[email protected]")

```

|

Collectives™ on Stack Overflow

Received error "Not Authorized to access this resource/api" when trying to use Google Directory API and Service Account Authentication

1 Answer 1

6 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

6 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related