1

I'm trying to call the Admin sdk from google AppEngine using Go, I have already done the following:

  • Added Admin SDK to my appengine project
  • added the [email protected] to the service accounts for the project

Following the example here https://godoc.org/golang.org/x/oauth2/google#example-AppEngineTokenSource

I'm getting: Error 403: Not Authorized to access this resource/api, forbidden

When I did this from the command line, I had to set the Subject account. Is there a way to do this with AppEngineTokenService?

client := &http.Client{
    Transport: &oauth2.Transport{
        Source: google.AppEngineTokenSource(ctx,
            "https://www.googleapis.com/auth/admin.directory.user"),
        Base: &urlfetch.Transport{
            Context: ctx,
        },
    },
}

svc, err := admin.New(client)
if err != nil {
    fmt.Printf("Error getting svc\n")
    ctx.Errorf("error getting service %v", err)
}
usersvc := admin.NewUsersService(svc)

listcall := usersvc.List()
listcall.Domain("example.com")
users, err := listcall.Do()
5
  • You can grant the service account access to certain scopes in the Control Panel as explained in the Google Drive domain-wide documentation developers.google.com/drive/web/…. Use Admin SDK scopes instead.
    – SGC
    Commented Jan 2, 2015 at 22:22
  • I did this for the offline service account. I don't have a client_id for the appengine account, only an email address which that page will not accept. Do you know how I can register the appengine service account?
    – dar
    Commented Jan 3, 2015 at 0:22
  • Did you try this link cloud.google.com/appengine/docs/java/gettingstarted/creating
    – SGC
    Commented Jan 3, 2015 at 0:25
  • That link looks to me like it explains setting up a project, which I already have done. You can find the service account name on the appengine settings page as explained here: cloud.google.com/appengine/articles/prediction_service_accounts The problem I have is that I don't know the client_id for the service account, so I cannot figure out how to grant it API access. The service account name is like [email protected] but it needs to be a domain, not an email address.
    – dar
    Commented Jan 3, 2015 at 0:37
  • Turns out the appengine service account does have access to the admin api - it just doesn't have access to my Google Apps domain information. I think the way to allow it access is to specify the Subject name, but I don't see how to do this.
    – dar
    Commented Jan 3, 2015 at 20:51

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.