0
我已经按照这里的方向https://developers.google.com/api-client-library/php/auth/service-accounts与服务帐户Googlephpapi管理用户
我添加的
https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/admin.directory.user
https://www.googleapis.com/auth/admin.directory.customer
https://www.googleapis.com/auth/admin.directory.domain
管理控制台以下是内我的服务帐户的客户端ID的范围代码我试图运行
putenv('GOOGLE_APPLICATION_CREDENTIALS=JSONFILELOCATION');
$client = new Google_Client();
$client->useApplicationDefaultCredentials();
$client->setApplicationName("Directory");
$client->setScopes(array(
Google_Service_Directory::ADMIN_DIRECTORY_CUSTOMER,
Google_Service_Directory::ADMIN_DIRECTORY_USER
));
$client->setSubject("[email protected]");
//$client->setSubject(SUPERADMINEMAILADDRESS);
$service = new Google_Service_Directory($client);
// Print the first 10 users in the domain.
$optParams = array(
'domain'=>'MYDOMAIN',
'maxResults' => 10,
'orderBy' => 'email',
);
$results = $service->users->listUsers($optParams);
结果我得到的是未经授权的客户端
Fatal error: Uncaught exception 'Google_Service_Exception' with message '{
"error": "unauthorized_client",
"error_description": "Unauthorized client or scope in request."
}
' in /var/web/composer/googlephpapi/vendor/google/apiclient/src/Google/Http/REST.php:118
Stack trace:
#0 /var/web/composer/googlephpapi/vendor/google/apiclient/src/Google/Http/REST.php(94): Google_Http_REST::decodeHttpResponse(Object(GuzzleHttp\Psr7\Response), Object(GuzzleHttp\Psr7\Request), 'Google_Service_...')
#1 [internal function]: Google_Http_REST::doExecute(Object(GuzzleHttp\Client), Object(GuzzleHttp\Psr7\Request), 'Google_Service_...')
#2 /var/web/composer/googlephpapi/vendor/google/apiclient/src/Google/Task/Runner.php(181): call_user_func_array(Array, Array)
#3 /var/web/composer/googlephpapi/vendor/google/apiclient/src/Google/Http/REST.php(58): Google_Task_Runner->run()
#4 /var/web/composer/googlephpapi/vendor/google/apiclient/src/Google/Client.php(781): Google_Http_REST::execute(Object(GuzzleHttp\Client), Object(GuzzleHttp\Psr7\Request), in /var/web/composer/googlephpapi/vendor/google/apiclient/src/Google/Http/REST.php on line 118
我正在尝试使用服务帐户的电子邮件地址。但我收到权限错误。如果我使用超级管理员电子邮件地址,我会得到结果。是否有我缺少能够使用服务帐户的设置?我认为,通过域名范围的授权,我可以使用服务帐户在不使用真实用户的情况下拥有完全访问权限。
作为服务帐户不是超级管理员的事实,这就是为什么你越来越未经授权的“客户端”。您只能使用服务帐户**冒充**用户。因此,该主题应始终是帐户的超级管理员。 – Morfinismo