Google 관리자 sdk 디렉토리 403

Question

서비스 계정에 googleapi 2.0을 사용하여 entrprise 도메인의 사용자에 대해 gooogle admin sdk 디렉토리를 사용하려고합니다. 필자는 (예를 들어 this) 제안 된대로 진행하고 "작업하고 싶습니다"poc Java 코드를 준비했습니다. 이 같은

뭔가를해야만 ...

package com.mc3info.google.api20.test; 

import java.io.File; 
import java.security.NoSuchAlgorithmException; 
import java.security.UnrecoverableKeyException; 
import java.security.cert.CertificateException; 
import java.util.ArrayList; 
import java.util.Arrays; 
import java.util.List; 
import java.util.Set; 
import java.util.regex.Matcher; 
import java.util.regex.Pattern; 

import com.google.api.client.googleapis.auth.oauth2.GoogleCredential; 
import com.google.api.client.googleapis.javanet.GoogleNetHttpTransport; 
import com.google.api.client.http.HttpTransport; 
import com.google.api.client.http.javanet.NetHttpTransport; 
import com.google.api.client.json.JsonFactory; 
import com.google.api.client.json.jackson2.JacksonFactory; 
import com.google.api.services.admin.directory.Directory; 
import com.google.api.services.admin.directory.Directory.Members; 
import com.google.api.services.admin.directory.Directory.Users.Get; 
import com.google.api.services.admin.directory.DirectoryScopes; 
import com.google.api.services.admin.directory.Directory.Groups; 
import com.google.api.services.admin.directory.Directory.Users; 
import com.google.api.services.admin.directory.model.User; 

public class TestUsersList { 


    public static void main(String[] args) { 

     try { 
      File f = new File("config/xxxxxxx-privatekey.p12"); 
      System.out.println(f.getAbsolutePath()); 
      ArrayList<String> scopes = new ArrayList<String>(); 
//   scopes.add(DirectoryScopes.ADMIN_DIRECTORY_GROUP); 
//   scopes.add(DirectoryScopes.ADMIN_DIRECTORY_GROUP_READONLY); 
//   scopes.add(DirectoryScopes.ADMIN_DIRECTORY_GROUP_MEMBER); 
//   scopes.add(DirectoryScopes.ADMIN_DIRECTORY_GROUP_MEMBER_READONLY); 
      scopes.add(DirectoryScopes.ADMIN_DIRECTORY_USER); 
      scopes.add(DirectoryScopes.ADMIN_DIRECTORY_USER_READONLY); 
//   scopes.add(DirectoryScopes.ADMIN_DIRECTORY_USER_SECURITY); 
      HttpTransport myHttpTransport = new NetHttpTransport(); 
      JsonFactory JSON_FACTORY = new JacksonFactory(); 
      GoogleCredential credential = (new GoogleCredential.Builder() 
      .setTransport(myHttpTransport) 
      .setJsonFactory(JSON_FACTORY) 
       .setServiceAccountId("xxxxxxxxxxxx@developer.gserviceaccount.com") 
      .setJsonFactory(JSON_FACTORY) 
      .setServiceAccountPrivateKeyFromP12File(f) 
      .setServiceAccountScopes(scopes) 
      ).build(); 

      credential.refreshToken(); 
//   String at = credential.getAccessToken(); 
      String applicationName = "NYAPPLICATIONNAME"; 


      Directory dir = new Directory.Builder(myHttpTransport, JSON_FACTORY, credential) 
       .setApplicationName(applicationName) 
       .setHttpRequestInitializer(credential) 
       .build(); 
      com.google.api.services.admin.directory.Directory.Users.List ures = dir.users().list(); 
      ures.setDomain("genericidoc.it"); 
      ures.setOrderBy("email"); 

//   ures.setSortOrder("ASCENDING"); 
//   ures.setFields("users(agreedToTerms,changePasswordAtNextLogin,creationTime,customerId,deletionTime,etag,hashFunction,id,includeInGlobalAddressList,ipWhitelisted,isAdmin,isDelegatedAdmin,isMailboxSetup,kind,lastLoginTime,name,orgUnitPath,password,primaryEmail,suspended,suspensionReason,thumbnailPhotoUrl"); 

      com.google.api.services.admin.directory.model.Users lures = ures.execute(); 
      //HERE print all data 
//   for(){ 
//    System.out.println("Utente : "); 
//   } 
//    
      Groups grp = dir.groups(); 

      com.google.api.services.admin.directory.model.Groups res = grp.list().execute(); 



//   Directory.Members.List members = dir.members().list("someexisting email"); 

      /* 
      * Values for getting GoogleCredential, found in the 
      * "Service account section" at: 
      * https://code.google.com/apis/console/#access 
      */ 
      // serviceAccountId from the "Email address" field. 


      // Name of group to get for testing the authentication 

     } catch (Throwable t) { 
      t.printStackTrace(); 
     } 
    } 
} 

하지만 403 오류 점점 :

그리고를 ... 예, refreshToken() invokation는 requied하지 않아야하지만 나에게 적어도 악수를했다 thath 알을 보장합니다 확인 ...

403 Forbidden 
{ 
"code" : 403, 
"errors" : [ { 
"domain" : "global", 
"message" : "Not Authorized to access this resource/api", 
"reason" : "forbidden" 
} ], 
"message" : "Not Authorized to access this resource/api" 
} 

Answer 1

using service accounts with Admin SDK for domain-wide delegation에 Google의 문서를보십시오.

• 언급하지 않았지만 Google Apps 제어판에서 grant the service account's client id access to the Admin SDK scopes해야합니다.

• 코드에 .setServiceAccountUser(userEmail)과 같은 행이 누락되었습니다. 서비스 계정이 디렉토리 (주로 최고 관리자)를 검색 할 권한이있는 Google Apps 도메인의 사용자로 가장 할 수 있습니다.