Google Admin sdk 目录 403

我正在尝试将 googleapi 2.0 与服务帐户一起使用，以在企业域上的用户上使用 Directory gooogle admin sdk。 我已按照建议进行操作（this例如）并准备了一个“希望工作”的poc java代码。

像这样的东西...

package com.mc3info.google.api20.test;

import java.io.File;
import java.security.NoSuchAlgorithmException;
import java.security.UnrecoverableKeyException;
import java.security.cert.CertificateException;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
import java.util.Set;
import java.util.regex.Matcher;
import java.util.regex.Pattern;

import com.google.api.client.googleapis.auth.oauth2.GoogleCredential;
import com.google.api.client.googleapis.javanet.GoogleNetHttpTransport;
import com.google.api.client.http.HttpTransport;
import com.google.api.client.http.javanet.NetHttpTransport;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.jackson2.JacksonFactory;
import com.google.api.services.admin.directory.Directory;
import com.google.api.services.admin.directory.Directory.Members;
import com.google.api.services.admin.directory.Directory.Users.Get;
import com.google.api.services.admin.directory.DirectoryScopes;
import com.google.api.services.admin.directory.Directory.Groups;
import com.google.api.services.admin.directory.Directory.Users;
import com.google.api.services.admin.directory.model.User;

public class TestUsersList {


    public static void main(String[] args) {

        try {
          File f = new File("config/xxxxxxx-privatekey.p12");
          System.out.println(f.getAbsolutePath());
          ArrayList<String> scopes = new ArrayList<String>();
//          scopes.add(DirectoryScopes.ADMIN_DIRECTORY_GROUP);
//          scopes.add(DirectoryScopes.ADMIN_DIRECTORY_GROUP_READONLY );
//          scopes.add(DirectoryScopes.ADMIN_DIRECTORY_GROUP_MEMBER);
//          scopes.add(DirectoryScopes.ADMIN_DIRECTORY_GROUP_MEMBER_READONLY);
          scopes.add(DirectoryScopes.ADMIN_DIRECTORY_USER );
          scopes.add(DirectoryScopes.ADMIN_DIRECTORY_USER_READONLY );
//          scopes.add(DirectoryScopes.ADMIN_DIRECTORY_USER_SECURITY);
            HttpTransport myHttpTransport = new NetHttpTransport();
            JsonFactory JSON_FACTORY = new JacksonFactory();
          GoogleCredential credential = (new GoogleCredential.Builder()
            .setTransport(myHttpTransport )
            .setJsonFactory(JSON_FACTORY)
              .setServiceAccountId("[email protected]")
            .setJsonFactory(JSON_FACTORY)
            .setServiceAccountPrivateKeyFromP12File(f )
            .setServiceAccountScopes(scopes)
            ).build();

            credential.refreshToken();
//          String at = credential.getAccessToken();
            String applicationName = "NYAPPLICATIONNAME"; 


            Directory dir = new Directory.Builder(myHttpTransport, JSON_FACTORY, credential)
                .setApplicationName(applicationName )
                .setHttpRequestInitializer(credential)
                .build();
            com.google.api.services.admin.directory.Directory.Users.List ures = dir.users().list();
            ures.setDomain("genericidoc.it");
            ures.setOrderBy("email");

//            ures.setSortOrder("ASCENDING");
//            ures.setFields("users(agreedToTerms,changePasswordAtNextLogin,creationTime,customerId,deletionTime,etag,hashFunction,id,includeInGlobalAddressList,ipWhitelisted,isAdmin,isDelegatedAdmin,isMailboxSetup,kind,lastLoginTime,name,orgUnitPath,password,primaryEmail,suspended,suspensionReason,thumbnailPhotoUrl");

            com.google.api.services.admin.directory.model.Users lures = ures.execute();
            //HERE print all data 
//            for (){
//              System.out.println("Utente : ");
//            }
//            
            Groups grp = dir.groups();

            com.google.api.services.admin.directory.model.Groups res = grp.list().execute();



//            Directory.Members.List members  = dir.members().list("someexisting email");

            /*
             * Values for getting GoogleCredential, found in the
             * "Service account section" at:
             * https://code.google.com/apis/console/#access
             */
            // serviceAccountId from the "Email address" field.


            // Name of group to get for testing the authentication

        } catch (Throwable t) {
            t.printStackTrace();
        }
    }
}

但出现 403 错误：

并且...是的，不应要求刷新 Token() 调用，但它确保我至少握手没问题...

403 Forbidden
{
 "code" : 403,
 "errors" : [ {
 "domain" : "global",
 "message" : "Not Authorized to access this resource/api",
 "reason" : "forbidden"
 } ],
 "message" : "Not Authorized to access this resource/api"
}

看看谷歌的文档将服务帐户与 Admin SDK 结合使用以进行域范围的委派.

• 你没有提到，但你绝对需要授予服务帐户的客户端 ID 对 Admin SDK 范围的访问权限从您的 Google Apps 控制面板。

• 您的代码缺少一行，例如.setServiceAccountUser(userEmail)它允许服务帐户模拟您的 Google Apps 域中有权搜索目录的用户（可能是超级管理员用户）。