Directory API: Not Authorized to access this resource/api

[nicholasc]

I created a project in the Google Cloud Platform and went ahead and activated the Admin SDK & Gmail APIs. I then created a domain-wide service account in the project, downloaded the JSON key file and gave it authorization to the following scopes in the Admin Console:

https://www.googleapis.com/auth/admin.directory.user
https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/admin.directory.group.member
https://www.googleapis.com/auth/gmail.settings.basic

Using the JSON file, I can create a JWT auth object and access the Gmail API just fine. However, I keep getting 403: Not Authorized to access this resource/api when attempting to use any resource on the Directory API.

In the API & Services Dashboard on the Google Cloud Platform, I can see the requests coming in and being denied but I can't think of any reason why this would not work properly.

Here is the code I am using (of course using a different domain than mydomain.com):

const useDirectory = async keyFile => {
  const auth = new google.auth.GoogleAuth({
    keyFile,
    scopes: [
      'https://www.googleapis.com/auth/admin.directory.user',
      'https://www.googleapis.com/auth/admin.directory.group'
      'https://www.googleapis.com/auth/admin.directory.group.member'
    ]
  });

  return google.admin({
    version: "directory_v1",
    auth: await auth.getClient()
  });
};

const token = path.resolve("./token.json");
if (!fs.existsSync(token)) {
  throw new Error("Could not find token.json for authentication.");
}

const directory = await useDirectory(token);
const users = await directory.groups
  .list({ domain: "mydomain.com" })
  .catch(console.error);

Environment details

• OS: macOS Mojave 10.14.6
• Node.js version: 10.16.3
• npm version: 6.11.3
• google-auth-library version: 5.2.0

Steps to reproduce

Too many steps based on the description of the issue.

[bcoe]

@nicholasc I believe the scope for list might be:

https://www.googleapis.com/auth/admin.directory.user.security

can you give this a shot?

[nicholasc]

It did not work.

The url used by the library is

https://www.googleapis.com/admin/directory/v1/groups

Based on the API Reference the scope for that url is

https://www.googleapis.com/auth/admin.directory.group

[devatclearoutio]

I too face the same problem when trying to manage the G Suite users using service account credential, but hitting the same problem

[bcoe]

@nicholasc I work on the GCP client libraries team, which is a few steps away from the Gmail API. I've added the bug label, and we will make an effort to dig into this when possible, but:

It might also be worth following the directions here to get help with the gmail API, just in case someone on stack overflow knows an immediate solution to your problem.

[nicholasc]

Hello @bcoe .

I appreciate that this will be looked into as I am still facing this issue. I've temporarily resorted to a manual list of our users but I don't see this as a viable solution long term.

Thank you for referring me to the Gmail API help section. However, this is not related to the Gmail API, which I have been able to use with a service account, but with the Directory API within the Admin SDK. I went here and looked for similar issue on stack overflow but haven't been able to find much of anything.

Again, thank you.

[nicholasc]

Found relevant issue on the Admin SDK Bug issue tracker:
https://issuetracker.google.com/issues/113755665

No real solution at the moment.

[somejavadev]

@nicholasc, thanks for pointing out the issue tracker. The solution there was to use a legit admin user's account which is not a viable solution. This is also occurring in the java API at the moment. @bcoe Is there any other possible way to determine which groups a user belong to using service account authentication?

[allaway1]

Seeing the same issue. Have Domain Wide Delegation enabled and added the scopes for the client in Admin.

[tchimih]

I have the same issue, I gave my service accounts all the authorization in GSuite Admin and gave him the right scopes with domain wide delegation and I'm facing the same error. FYI, I use a server to server oauth scheme (JWT).

[SqiSch]

@nicholasc I believe the scope for list might be:

https://www.googleapis.com/auth/admin.directory.user.security

can you give this a shot?

Thanks a lot. This scope fixed my problem.