Google Reseller API获取GoogleJsonResponseException: 403禁止

Question

我正在做一个使用Google Apps Reseller API的项目。

我遇到了一个403 Forbidden Exception.

代码(大部分来自Google Codelab示例:

try {
        try {
        Reseller service = GoogleResellerApiUtil.getResellerService();
        Customer customerRecord = service.customers().get("acme.com").execute(); //crashes here
    // "acme.com" is also used in the example from Google
        System.out.println(customerRecord.toString());

    } catch (GoogleJsonResponseException e) {
        e.printStackTrace();
    }

这是我用来连接到API的类。我提供了一个p12文件，它使用服务帐户，当调用API时，它是模拟超级管理员之一，所以它应该被允许进行所有调用。

目前我只使用只读作用域。

public class GoogleResellerApiUtil {
    /** HTTP_TRANSPORT */
    private static final HttpTransport HTTP_TRANSPORT = new NetHttpTransport();
    /** JSON Factory*/
    private static final JsonFactory JSON_FACTORY = new JacksonFactory();
    /** Service Account Email */
    public static final String SERVICE_ACCOUNT_EMAIL = "****@appspot.gserviceaccount.com";
    /** P12 File Location */
    public static final String PRIVATE_KEY_FILE = "WEB-INF/key.p12";
    /** Reseller Admin Account to impersonate */
    public static final String RESELLER_ADMIN = "**.**@**.com";
    /** Scopes */
    public static final List<String> SCOPES = Arrays.asList(ResellerScopes.APPS_ORDER_READONLY);
    /** Application name. */
    private static final String APPLICATION_NAME = "**-subscription-portal";
    /** Logger */
    private final static Logger LOGGER =
        Logger.getLogger(GoogleResellerApiUtil.class.getName());

    public static GoogleCredential getCredentials() throws IOException {
        GoogleCredential credentials = null;
        try {
            credentials = new GoogleCredential.Builder()
                .setTransport(HTTP_TRANSPORT)
                .setJsonFactory(JSON_FACTORY)
                .setServiceAccountId(SERVICE_ACCOUNT_EMAIL)
                .setServiceAccountScopes(SCOPES)
                .setServiceAccountUser(RESELLER_ADMIN)
                .setServiceAccountPrivateKeyFromP12File(new File(PRIVATE_KEY_FILE))
                .build();
        } catch (GeneralSecurityException e) {
            e.printStackTrace();
        }
        System.out.println("credential has been build, returning credential "); //this gets printed, so I think the credentials are valid?
    return credentials;
}
    /**
     * Build and return an authorized Reseller client service.
     * @return an authorized Reseller client service
     * @throws IOException
     */
    public static Reseller getResellerService() throws Exception {
        Credential credential = getCredentials();
        return new Reseller.Builder(
            HTTP_TRANSPORT, JSON_FACTORY, credential)
            .setApplicationName(APPLICATION_NAME)
            .build();
    }
}

但是在调用时我得到以下错误消息:

com.google.api.client.googleapis.json.GoogleJsonResponseException: 403 OK
{
  "code" : 403,
  "errors" : [ {
    "domain" : "global",
    "message" : "Forbidden",
    "reason" : "forbidden"
  } ],
  "message" : "Forbidden"
}
at com.google.api.client.googleapis.json.GoogleJsonResponseException.from(GoogleJsonResponseException.java:146)
etc. etc. etc.

Answer 1

在Reseller API: Manage Subscriptions中指出

注意:如果customerAuthToken无效或已过期，API响应返回一个403 "Forbidden"错误。

要解决此问题，请确保请求必须由具有访问数据权限的经过身份验证的用户授权。如Reseller API: Authorizing

中所述

注意:授予Reseller API权限的用户必须是域超级管理员。

除此之外，在令牌过期中还建议您编写代码来预测授予的令牌可能不再工作的可能性。令牌可能由于以下原因之一而停止工作:

• 用户已撤销访问权限。
• 该令牌已六个月未使用。
• 用户更改密码，令牌包含Gmail范围
• 用户的令牌请求数已超过一定数量。

希望有帮助!