Google Admin SDK 403 Not Authorized to Access this Resource/API

Question

I use the following code in a java web application to try to get all users of a group:

GoogleCredential credential = GoogleCredential.fromStream(Util.class.getResourceAsStream("[credential_file].json")).createScoped(SCOPES);

Directory directory = new Directory.Builder(httpTransport, JSON_FACTORY, credential).build();

Directory.Members dirMem = directory.members();
Members members = dirMem.list("[group_email]").execute();

This results in an exception 403 (Not authorized to access this resource/API) on the last line (dirMem.list...).

From the documentation (https://developers.google.com/admin-sdk/directory/v1/guides/delegation) and other posts, I saw that the solution to this is to set a service account user with setServiceAccountUser(). However, this means that I have to use a p12 file instead of a json file (Google recommends using a json file when you create the key).

Is there any way to get around this issue while still using a json file (it also involves less code).

Thanks.

Spindrift

You can use a service account json key file rather then the P12 service account jSon key file. Remember service account authentication code and Oauth2 authentication code are different. – Whiteside

Thanks. I did try to use a service account key file (generated by following the instructions here: developers.google.com/identity/protocols/…). It contains the fields: type: "service account", project_id, private_key_id, private_key, client_email, client_id, etc. Is this not the right json key file? Or is there something missing in my code above? – Spindrift

Sounds right to me. You are going to have to find an example for using the json file instead of the p12 file. And remember the service account needs to be authorized to access the data. Make sure you added it as a user on Google domain. Note: I am not a java programmer, and I don't have access to Google domain. I can only give you hints sorry. – Whiteside

Answer 1

For now, I am just using the p12 file as outlined here:

https://developers.google.com/admin-sdk/directory/v1/guides/delegation

If anyone knows of a way to execute the code in this question with a json file, feel free to comment/answer.

Spindrift

Answer 2

As suggested by this answer to a related question, including the sub (subject, I think) to indicate the email address of a delegated admin in your Google Apps account is a necessary step for the API calls to work. That delegated admin will also probably need to be authorized to access/modify the data or endpoints you are calling. Since my experience has been with the PHP client, not Java, I don't know the specifics of how you will provide that email address to the Java classes in use in your example.

Pantomime

Wow. I don't think this was anywhere in the tutorials and such. This worked for php by using $client->setSubject('[email protected]') – Turtledove

Answer 3

As JSON credentials is not supported serviceAccountUser I've done workaround: make credential copy.

See code here: https://mcmap.net/q/2034678/-google-directory-api-returns-not-authorized-when-call-users-list-execute

Adis

Answer 4

Here's the solution by setting the admin email with a JSON file:

import com.google.api.client.googleapis.auth.oauth2.GoogleCredential;
import com.google.api.services.admin.directory.Directory;
import com.google.api.services.admin.directory.DirectoryScopes;
import static com.google.api.client.googleapis.util.Utils.getDefaultJsonFactory;
import static com.google.api.client.googleapis.util.Utils.getDefaultTransport;
// ...

String ADMIN_EMAIL = "[email protected]";
String jsonConfigFile = "/GSuite Integration.json";
List<String> scopes = Arrays.asList(DirectoryScopes.ADMIN_DIRECTORY_USER, DirectoryScopes.ADMIN_DIRECTORY_USERSCHEMA_READONLY);

GoogleCredential credential;
try (InputStream is = CredentialsWorkaroundTest.class.getResourceAsStream(jsonConfigFile)) {
    credential = GoogleCredential.fromStream(is)
        .createDelegated(ADMIN_EMAIL)
        .createScoped(scopes);
}

Directory service = new Directory.Builder(getDefaultTransport(), getDefaultJsonFactory(), credential)
        .setApplicationName(APPLICATION_NAME)
        .build();

(Domain-wide delegation is not required)

Note - using google-api-client version 1.28.0

Eminence