Google Admin SDK-服务帐户无法访问资源 [英] Google Admin SDK - Service account can't access resource

问题描述

我已经通过console.developers.google.com创建了服务帐户客户端.生成的密钥，.p12证书，启用的DwD等... 然后，我继续作为管理员 API引用中的描述者. (HTTP/REST版本).其中包括在Google管理员->安全->进步设置中将范围分配给这些客户端ID. 当前管理员安全配置状态 在我成功地交换了访问令牌的代码并请求了我的域下的用户列表后，我得到了这个响应.

I've created Service Account client via console.developers.google.com. Generated keys, .p12 cert, enabled DwD, and so ... Then I've continued as describer in Admin API references. (HTTP/REST version). That included asingning scopes to these clients id at Google Admin -> Security -> Advancet Settings. Current admin security config state After I succesfully exchanged code for access token and made request for list of users under my domain i got this response.

{   
  "error": {
    "errors": [
      {
        "domain": "global",
        "reason": "forbidden",
        "message": "Not Authorized to access this resource/api"
      }
    ],
    "code": 403,
    "message": "Not Authorized to access this resource/api" 
  } 
}

请求是GET，授权载体ya29.ElrxA8F [剩余的权限] 而Google开发人员控制台信息中心会在Admin SDK中显示带有错误请求的图表

Request is GET, Authorization Bearer ya29.ElrxA8F[rest of acctoken] and the google dev console dashboard shows chart with error request at Admin SDK

推荐答案

您必须将客户端模拟为指定用户

You must impersonificate your client as designated user

所以我错过了:json auth有效负载中的"sub"参数: 这是正确的json对象(具有您的ID等)，您需要使用它来从服务帐户访问Admin SDK:

so I missed: "sub" parameter in json auth payload: This is correct json object (of cource with your ids, etc), that you need to use to access your Admin SDK from Service Account:

{
"iss":"[e-mail]"， "sub":"[e-mail]"，
"scope":"googleapis.com/auth/prediction"，
"aud":"googleapis.com/oauth2/v4/token"，
"exp":1328554385，"iat":1328550785 }

{
"iss":"[e-mail]", "sub":"[e-mail]",
"scope":"googleapis.com/auth/prediction",
"aud":"googleapis.com/oauth2/v4/token",
"exp":1328554385, "iat":1328550785 }

请参阅 Google管理员SDK参考. (带有"sub"参数的部分)

Take a look at google admin sdk reference for more details. (Part with "sub" parameter)

这篇关于Google Admin SDK-服务帐户无法访问资源的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！