使用服务帐户访问G Suite管理员SDK [英] Accessing G Suite Admin SDK using service account
问题描述
我正在尝试使用服务帐户访问Directory API( https://developers.google.com/identity/协议/OAuth2ServiceAccount )并在Powershell中实现REST客户端
I am trying to use a service account to access Directory API (https://developers.google.com/admin-sdk/directory/v1/reference/users/list). The simplest task is to list users in the organization. That works well with my user account, tested with the OAuth 2.0 Playgorund. But I need to use service account. I am following documentation for two-legged OAuth (https://developers.google.com/identity/protocols/OAuth2ServiceAccount) and implementing REST client in Powershell
- 在Google管理控制台中启用了API访问权限
- 已创建服务帐户并下载了P12凭据.该帐户在Cloud Console中被授予了多个组织范围内的角色:浏览器,安全性查看器,组织查看器-以便测试各种方案
- 在管理控制台中授予域范围的权限,其API范围为 https://www.googleapis.com/auth/admin.directory.user
Powershell代码:
Powershell code:
# Forming the JWT claim set
$cert = Get-PfxCertificate -FilePath "c:\ps\GAdmin\apiaccess-123456.p12" -Password (ConvertTo-SecureString "notasecret" -AsPlainText -Force)
$now = (Get-Date).ToUniversalTime()
$createDate = [Math]::Floor([decimal](Get-Date($now) -UFormat "%s"))
$expiryDate = [Math]::Floor([decimal](Get-Date($now.AddHours(1)) -UFormat "%s"))
$rawclaims = [Ordered]@{
iss = "p12service@apiaccess-123456.iam.gserviceaccount.com"
scope = "https://www.googleapis.com/auth/admin.directory.user"
aud = "https://www.googleapis.com/oauth2/v4/token"
iat = $createDate
exp = $expiryDate
} | ConvertTo-Json
# Encoding the JWT claim set
$jwt = New-Jwt -PayloadJson $rawclaims -Cert $cert -Verbose
# Making the access token request
$apiendpoint = "https://www.googleapis.com/oauth2/v4/token"
$splat = @{
Method = "POST"
Uri = $apiendpoint
ContentType = "application/x-www-form-urlencoded"
Body = "grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer&assertion=$jwt"
}
$res = Invoke-WebRequest @splat -Verbose
$accesstoken = ($res.content | ConvertFrom-Json).access_token
# Calling Google APIs - list of users
$usersapiendpoint = "https://www.googleapis.com/admin/directory/v1/users?list&customer=my_customer&domain=mydomain.com.au"
$splat = @{
Method = "GET"
Uri = $usersapiendpoint
Headers = @{authorization = "Bearer $accesstoken"}
}
$userlistres = Invoke-WebRequest @splat -Verbose
这会导致错误:
code 403, "Not Authorized to access this resource/api"
调用其他API即可.我需要做什么才能启用对Directory API的编程访问?我是否缺少服务帐户/SDK访问的配置步骤?
Calling other APIs works. What do I need to do to enable programmatic access to the Directory API? Am I missing a configuration step for the service account/SDK access?
推荐答案
此工作正常!域范围的权限委派和模拟(在$ rawclaims中的sub = "user@example.com"
项)是必要且正确的.
Got this working! The domain-wide authority delegation and impersonation (a sub = "user@example.com"
entry in the $rawclaims) were necessary and correct.
问题在于,通过域范围委派授予服务帐户的特权与我的主张中所请求的特权(我有几个)不匹配:
The problem was that there was a mismatch between the privileges granted to the service account through the domain-wide delegation, and those requested in my claim (I had several):
scope = "https://www.googleapis.com/auth/admin.directory.user https://www.googleapis.com/auth/iam https://www.googleapis.com/auth/cloud-platform"
一旦声明匹配授予的特权,我就会收到我的令牌.
Once claims matched granted privileges, I received my tokens.
这篇关于使用服务帐户访问G Suite管理员SDK的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!