谷歌管理目录v1 api groups.list权限不足错误

Question

我正在尝试使用谷歌管理api进行授权，并列出邮件列表用户。我从api控制台下载了一个密钥，然后做了：

require 'google/api_client'
client= Google::APIClient.new(application_name: "myapp", application_version: "0.1")
groups= client.discovered_api('admin', 'directory_v1')
key = Google::APIClient::PKCS12.load_key(Dir['*.p12'].first, 'notasecret')
client.authorization = Signet::OAuth2::Client.new(
  token_credential_uri: 'https://accounts.google.com/o/oauth2/token',
  audience: 'https://accounts.google.com/o/oauth2/token',
  scope: 'https://www.googleapis.com/auth/admin.directory.group.readonly',
  issuer: '[e-mail]',
  signing_key: key)
client.authorization.fetch_access_token!
puts client.execute(api_method: groups.users.list, parameters: {}).body

我尝试添加groupKey:"[e-mail]"我尝试设置域："mysite.com"它总是导致"权限不足"

我还需要做些什么才能在组中列出用户？

Answer 1

尝试以下操作：

require 'google/api_client'
## Email of the Service Account #
SERVICE_ACCOUNT_EMAIL = '<some-id>@developer.gserviceaccount.com'
## Email account of the Admin User ##
ADMIN_EMAIL = '[e-mail]'
## Path to the Service Account's Private Key file #
SERVICE_ACCOUNT_PKCS12_FILE_PATH = '/path/to/<public_key_fingerprint>-privatekey.p12'
##
# Build an Admin SDK client instance authorized with the service account
# that acts on behalf of the given user.
#
# @param [String] user_email
#   The email of the user.
# @return [Google::APIClient]
#   Client instance
def build_client(user_email)
    key = Google::APIClient::PKCS12.load_key(SERVICE_ACCOUNT_PKCS12_FILE_PATH, 'notasecret')
    asserter = Google::APIClient::JWTAsserter.new(SERVICE_ACCOUNT_EMAIL,
        'https://www.googleapis.com/auth/admin.directory.group.readonly', key)
    client = Google::APIClient.new
    client.authorization = asserter.authorize(ADMIN_EMAIL)
    client
end

这大致改编自Google Drive Domain Wide授权文档。将服务帐户与管理员SDK目录API一起使用时，仍然需要模拟管理员用户。

Answer 2

我也遇到过同样的问题。我写了一个示例要点，解释了如何设置：

https://gist.github.com/thomaswitt/7468182

步骤是：

1. 转到谷歌云控制台(https://cloud.google.com/console)
2. 使用P12文件创建服务帐户
3. 在API中启用Admin SDK
4. 创建项目
5. 在此项目中创建已注册的应用程序
6. 转到"证书"部分并生成密钥
7. 同时下载JSON文件
8. 转到应用程序控制台>安全>扩展>第三方OAuth(https://admin.google.com/AdminHome?#OGX:ManageOauthClients)
9. 添加API客户端。Client name是JSON中Client_id的值文件，API作用域为https://www.googleapis.com/auth/admin.directory.user.readonly