使用服务帐户进行Google Admin SDK身份验证 [英] Google Admin SDK authentication with service account

问题描述

我的团队当前正在开发一个应用程序，以使用Admin SDK在GCP中列出我公司的域用户，以用于入职和离职.

My team is currently developing an application to list my company's domain users in GCP, using the Admin SDK, for onboarding and offboarding purposes.

我们正在使用服务帐户来执行此操作，并且已在Google Admin的高级设置中添加了admin.directory.user.readonly范围. Admin SDK API已激活，我们可以在凭据"区域中看到服务帐户.

We're using a service account to do this and we've have added the admin.directory.user.readonly scope, in the Google Admin's advanced settings, to it. The Admin SDK API is activated and we can see the service account in the Credentials area.

当我们调用 https://www.googleapis.com/admin/directory /v1/users 端点，其参数为viewType=domain_public和domain=[our domain]，同时使用通过 oauth2l ，我们收到以下消息:

When we invoke the https://www.googleapis.com/admin/directory/v1/users endpoint with the parameters viewType=domain_public and domain=[our domain], while using an access token generated with oauth2l, we receive the following message:

{
   "error": {
       "errors": [
           {
               "domain": "global",
               "reason": "forbidden",
               "message": "Not Authorized to access this resource/api"
           }
       ],
       "code": 403,
       "message": "Not Authorized to access this resource/api"
   }
}

是否可以应用我们没有愿景的任何域限制?

Could there be any domain restriction being applied that we don't have vision of?

推荐答案

该服务帐户无权为您的G Suite实例调用Directory APi.它有权访问的是在您授予其访问权限的Directory API范围内，充当您域中的用户.

The service account does not have permission to call Directory APi for your G Suite instance. What it does have access to do is act as a user in your domain within the context of the Directory API scope(s) you granted it access to.

获取服务帐户凭据时，需要添加sub=[e-mail]参数，以便您充当域管理员，而不是服务帐户.参见:

When getting service account credentials you need to add the sub=[e-mail] parameter so that you are acting as your domain admin, not the service account. See:

https://developers.google.com/identity/protocols/OAuth2ServiceAccount

还有一些代码示例，位于:

And some code examples at:

https://developers.google.com/admin-sdk /directory/v1/guides/delegation

这篇关于使用服务帐户进行Google Admin SDK身份验证的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！