Google API 服务帐户授权错误 [英] Google API Service Account Authorization Error

问题描述

我正在使用 google-api-php-client 客户端来使用服务帐户连接到 Google 云端硬盘.大多数时候它都有效，但每隔一段时间(比如我坐在这里一遍又一遍地刷新页面，它是每 5 到 10 次)，我会收到一个 Google_Service_Exception 和消息 unauthorized_client: 客户端无权使用此方法检索访问令牌.该错误仅在 $this->drive_service->files->listFiles() 代码存在时发生.如果我直接使用服务帐户而不是使用 setSubject() 来模拟其他用户，则不会发生这种情况.

I am using the google-api-php-client client to connect to Google Drive using a Service Account. Most of the time it works, but every so often (say if I sit here an refresh the page over and over it's every 5th to 10th time), I receive a Google_Service_Exception with the message unauthorized_client: Client is unauthorized to retrieve access tokens using this method. The error only occurs if the $this->drive_service->files->listFiles() code is present. It does not occur if I use the Service Account directly rather than using setSubject() to impersonate another user.

        $this->client = new Google_Client();
        $this->client->useApplicationDefaultCredentials();
        $this->client->addScope("https://www.googleapis.com/auth/drive");
        $this->client->setSubject('xxxx');
        $this->drive_service = new Google_Service_Drive($this->client);
        $files = $this->drive_service->files->listFiles();

有什么想法吗?

2017 年 2 月 21 日更新:错误不再是间歇性的，每次都会发生，所以我根本无法再通过服务帐户连接到普通帐户.

Update Feb 21, 2017: The error is no longer intermittent, it happens every time, so I can no longer connect at all to a regular account through a service account.

2017 年 3 月 10 日更新:这似乎是用户的误解.服务帐户必须被授予域范围的权限"才能模拟该域的用户——这是我没有做过的事情.我只是按照 这里.

Update March 10, 2017: It seems as though this is a user misunderstanding. The service account must be given "domain-wide authority" in order to impersonate users of that domain - something I have not done. I had simply authorized a client to access the users account as described here.

推荐答案

我不知道为什么您的错误会定期发生，但我的理解是要冒充用户，您必须授予服务帐户访问权限.

I don't know why your error happens periodically but my understanding is that to impersonate an user, you must grant the service account access.

这篇关于Google API 服务帐户授权错误的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！