Create Google Users using API

Question

I'm following the documentation from Google on how to create a user through the API but I cannot figure what I'm missing.

This is the code I'm using:

    string SERVICE_ACCOUNT_PKCS12_FILE_PATH = @"myfile.p12";
    string SERVICE_ACCOUNT_EMAIL = "[email protected]";


    void CreateUser()
    {
        var certificate = new X509Certificate2(SERVICE_ACCOUNT_PKCS12_FILE_PATH, "notasecret", X509KeyStorageFlags.Exportable);


        ServiceAccountCredential credential = new ServiceAccountCredential(
           new ServiceAccountCredential.Initializer(SERVICE_ACCOUNT_EMAIL)
           {
               Scopes = new[] { DirectoryService.Scope.AdminDirectoryUser }
           }.FromCertificate(certificate));


        var service = new DirectoryService(
            new BaseClientService.Initializer()
            {
                HttpClientInitializer = credential,
                ApplicationName = "apitest"
            });

        var user = new Google.Apis.Admin.Directory.directory_v1.Data.User()
        {
            Name = new Google.Apis.Admin.Directory.directory_v1.Data.UserName()
            {
                GivenName = txtName.Text,
                FamilyName = txtFamilyName.Text
            },
            Password = txtPasword.Text,
            PrimaryEmail = txtEmail.Text
        };


        try
        {
            var result = service.Users.Insert(user).Execute();
        }
        catch (Exception ex)
        {
        }
    }

At this point I always get:

Google.Apis.Requests.RequestError
Not Authorized to access this resource/api [403]
Errors [
Message[Not Authorized to access this resource/api] Location[ - ] Reason[forbidden] Domain[global]
]

I've enabled the Admin SDK API and created a service account, which is the one I'm using here.

possible duplicate of Google Admin SDK Unable to Create User - Exception 403 Forbidden — Benjamin Diele
– Benjamin Diele, Commented Aug 5, 2014 at 8:09
Note I am not even sure you can do this. Assuming you could the service account would need access to what ever domain it is you are trying to add users to. You may be able to take the service account email address and add that as an admin giving it the permissions needed to add users. — Linda Lawton - DaImTo
– Linda Lawton - DaImTo, Commented Aug 5, 2014 at 8:10

vmasanas · Accepted Answer · 2014-08-05 12:55:14Z

1

The trick to the above code is that I forgot to add the admin account email on the crendentials.

This code will fix the problem:

           ServiceAccountCredential credential = new ServiceAccountCredential(
           new ServiceAccountCredential.Initializer(SERVICE_ACCOUNT_EMAIL)
           {
               Scopes = new[] { DirectoryService.Scope.AdminDirectoryUser },
               User = "[email protected]"
           }.FromCertificate(certificate));

answered Aug 5, 2014 at 12:55

vmasanas

5152 gold badges10 silver badges20 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Moby's Stunt Double Over a year ago

Thanks so much for this. I was banging my head against the wall for a bit.

Collectives™ on Stack Overflow

Create Google Users using API

1 Answer 1

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related