PHP中的Google Apps Admin SDK Directory API 403 [英] Google Apps Admin SDK Directory API 403 in PHP

问题描述

我得到

 Error calling GET https://www.googleapis.com/admin/directory/v1/users/[e-mail]: (403) Not Authorized to access this resource/api

当运行时

        $client = new Google_Client();
        $client->setClientId(GOOGLEAPPS_CLIENT_ID);
        $client->setApplicationName(SITE_NAME);
        $key = file_get_contents(APPLICATION_PATH . 'googleapps-privatekey.p12');
        $assertion = new Google_AssertionCredentials(
                    GOOGLEAPPS_EMAIL_ADDRESS, // the service account name
                    array('https://www.googleapis.com/auth/admin.directory.user'), // see https://developers.google.com/admin-sdk/directory/v1/guides/authorizing
                    $key);
        $client->setAssertionCredentials($assertion);
        $service = new Google_DirectoryService($client);
        $user = $service->users->get('[e-mail]');

我按照指示 https://developers.google.com/admin-sdk/directory/v1/guides/prerequisites
并勾选启用API访问。我使用Google APIs控制台 https://code.google.com/apis/console 生成一个服务帐户密钥，并得到那个工作好。

I followed the instructions https://developers.google.com/admin-sdk/directory/v1/guides/prerequisites and ticked Enable API Access. I used the Google APIs console https://code.google.com/apis/console to generate a Service Account key and got that working OK.

https://groups.google.com/forum/#!msg/google-api-php-client/LM-mwmuZe7I/IA_K5v1R1UMJ

我使用了Google PHP库，并按照 https://code.google.com/p/google-api-php-client/wiki/OAuth2?hl=no#Service_Accounts 尝试获取服务帐户的工作。调试到他们的代码︰我正在授权罚款，并按预期得到一个新的Access令牌 https：//开发人员.google.com / accounts / docs / OAuth2ServiceAccount 。

I used the Google PHP library and followed the instructions https://code.google.com/p/google-api-php-client/wiki/OAuth2?hl=no#Service_Accounts to try and get service accounts working. Debugging into their code: I'm authorising fine and getting a fresh Access token as expected https://developers.google.com/accounts/docs/OAuth2ServiceAccount.

我无法弄清楚为什么我得到未授权访问此资源/ api消息，当我读到的所有内容都表示我已经把它全部切换到OK。任何想法？

I can't figure out why I'm getting the "Not Authorized to access this resource/api" message when everything I have read says I've switched it all on OK. Any ideas?

推荐答案

刚刚得到它的工作。您需要包含管理员的用户电子邮件，以便oAuth授权您为该用户。尝试

Just got it working. You need to include the user email of the admin so oAuth authorizes you for that user. Try

    $assertion = new Google_AssertionCredentials(
                GOOGLEAPPS_EMAIL_ADDRESS, // the service account name
                array('https://www.googleapis.com/auth/admin.directory.user'), // see https://developers.google.com/admin-sdk/directory/v1/guides/authorizing
                $key,
                'notasecret',
                'http://oauth.net/grant_type/jwt/1.0/bearer',
                '[e-mail]'
    );

此后，您需要授权client_id作为您从管理控制台请求的作用域 - >安全 - >高级设置 - >身份验证 - >管理OAuth客户端访问

Also after that you need to authorize the client_id for the scope you are requesting from Admin console->Security->Advanced Settings->Authentication->Manage OAuth Client access

这篇关于PHP中的Google Apps Admin SDK Directory API 403的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！