Question

我正在尝试使用C＃和google-admin-directory_v1-rev24-csharp-1.7.0-beta客户端库创建用户但是我一直在设置例外：

Google.GoogleApiException was unhandled
  HResult=-2146233088
  Message=Google.Apis.Requests.RequestError
Not Authorized to access this resource/api [403]
Errors [
    Message[Not Authorized to access this resource/api] Location[ - ] Reason[forbidden] Domain[global]
]

Source=Google.Apis
ServiceName=admin
StackTrace:
   at Google.Apis.Requests.ClientServiceRequest`1.Execute() in c:\code\google.com\google-api-dotnet-client\default\Tools\Google.Apis.Release\bin\Debug    \output\default\Src\GoogleApis\Apis\Requests\ClientServiceRequest.cs:line 102
   at ConsoleApplication1.Program.Main(String[] args) in c:\Users\darin.BASEHEX\Documents\Visual Studio 2013\Projects    \ConsoleApplication1\ConsoleApplication1\Program.cs:line 55
   at System.AppDomain._nExecuteAssembly(RuntimeAssembly assembly, String[] args)
   at Microsoft.VisualStudio.HostingProcess.HostProc.RunUsersAssembly()
   at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
   at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
   at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
   at System.Threading.ThreadHelper.ThreadStart()
  InnerException:

我首先在Developers控制台中创建了一个项目，在我打开ADMIN SDK的API设置页面下，在Credentials页面下创建了一个服务帐户并下载了p12.key证书，我填写了同意屏幕和然后，我转到管理控制台的“安全性”页面，选择“高级”选项卡，选择“管理第三方OAuth客户端”访问权限，粘贴在我创建的服务帐户的客户端ID中，并分配范围https://www.googleapis.com/auth/admin.directory.user/。正在提出例外：

User results = service.Users.Insert(newuserbody).Execute();

完整的C＃程序如下。

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.Security.Cryptography.X509Certificates;
using Google.Apis.Auth.OAuth2;
using Google.Apis.Admin.Directory.directory_v1;
using Google.Apis.Admin.Directory.directory_v1.Data;
using Google.Apis.Services;

namespace ConsoleApplication1
{
    class Program
    {
        static void Main(string[] args)
        {

            String serviceAccountEmail = "A bunch of alpha numerics@developer.gserviceaccount.com";

            var certificate = new X509Certificate2(@"key.p12", "notasecret", X509KeyStorageFlags.Exportable);

            ServiceAccountCredential credential = new ServiceAccountCredential(

               new ServiceAccountCredential.Initializer(serviceAccountEmail) 

               {
                   Scopes = new[] { DirectoryService.Scope.AdminDirectoryUser },

                   User = "admin@mydomain.com"  <-------- Added ADMIN User to fix

               }.FromCertificate(certificate));

            // Create the service.

            var service = new DirectoryService(new BaseClientService.Initializer()

            {
                HttpClientInitializer = credential,
                ApplicationName = "User Provisioning",
            });

            User newuserbody = new User();
            UserName newusername = new UserName();
            newuserbody.PrimaryEmail = "bbacon@mydomain.com";
            newusername.GivenName = "Bob";
            newusername.FamilyName = "Bacon";
            newuserbody.Name = newusername;
            newuserbody.Password = "iambacon";

            User results = service.Users.Insert(newuserbody).Execute();

        Console.WriteLine("Press any key to continue!");
            Console.ReadKey();
        }
    }
}

我觉得这是非常简单的事情，但是我已经没有任何关于要看什么的想法了。任何帮助将不胜感激！

Answer 1

您的服务帐户似乎没有模仿此次通话中的任何用户。如果要使用服务帐户创建新用户，则需要模拟管理员帐户（注意：只有管理员才能创建用户）。

查看域广泛授权的此Drive示例：

https://developers.google.com/drive/delegation

你可以看到，对于.net部分，它有这个额外的行：

ServiceAccountUser = userEmail

您需要创建一个授权服务帐户的服务对象，该服务帐户将代表给定用户。

Google Admin SDK无法创建用户 - 例外403禁止使用

1 个答案: