无法使用Google Directory API Admin SDK列出用户

Question

我正在尝试使用AdminService来管理我的域的用户和组,但我遇到了一个简单的请求来获取我的域的所有用户.C#中有代码:

public Users GetAllUsers()
{
    var provider = new AssertionFlowClient(
        GoogleAuthenticationServer.Description,
        new X509Certificate2(privateKeyPath, keyPassword, X509KeyStorageFlags.Exportable))
    {
        ServiceAccountId = serviceAccountEmail,
        Scope = AdminService.Scopes.AdminDirectoryUser.GetStringValue()
    };

    var auth = new OAuth2Authenticator<AssertionFlowClient>(provider, AssertionFlowClient.GetState);

    m_serviceGroup = new AdminService(new BaseClientService.Initializer()
    {
        Authenticator = auth,
    });

    var request = m_serviceUser.Users.List();
    request.Domain = m_domainName;
    return request.Fetch();
}

当Fetch()表示:我得到一个异常:

Code: 403    
Message: Not Authorized to access this resource/api 
Error: {Message[Not Authorized to access this resource/api] Location[ - ] Reason[forbidden] Domain[global]}

我按照此处的说明启用了API访问权限,并在域控制面板中授权了我的服务帐户:

[Security]->[Advanced Setting]->[Authentication]->[Manage third party OAuth Client access]

范围:

https://www.googleapis.com/auth/admin.directory.group 
https://www.googleapis.com/auth/admin.directory.user

在API控制面板中也启用了Admin SDK服务.

我尝试使用DriveService并成功列出/创建/删除文件没有任何问题,因此代码的身份验证部分应该没问题.我无法弄清楚还需要配置什么,或者我的代码是否有任何其他问题.

谢谢你的帮助.

Answer 1

如页面所述:

管理API客户端访问

开发人员可以使用Google注册其Web应用程序和其他API客户端,以便访问Google日历等服务中的数据.您可以授权这些注册客户端访问您的用户数据,而无需用户单独提供同意或密码.学到更多

服务帐户需要根据用户的行为进行操作,因此在初始化客户端时,需要分配ServiceAccountUser.

    var provider = new AssertionFlowClient(
        GoogleAuthenticationServer.Description,
        new X509Certificate2(privateKeyPath, keyPassword, X509KeyStorageFlags.Exportable))
        {
            ServiceAccountId = serviceAccountEmail,
            Scope = AdminService.Scopes.AdminDirectoryUser.GetStringValue(),
            ServiceAccountUser = domainManangerEmail
        };

编辑:不推荐使用AssertionFlowClient,以下内容应该有效:

var cert = new X509Certificate2(privateKeyPath, keyPassword, X509KeyStorageFlags.Exportable);
var serverCredential = new ServiceAccountCredential(
    new ServiceAccountCredential.Initializer(serviceAccountEmail)
        {
            Scopes = new []{DirectoryService.Scope.AdminDirectoryUser},
            User = domainManagerAccountEmail
        }.FromCertificate(cert));
var dirService = new DirectoryService(new BaseClientService.Initializer()
        {
            HttpClientInitializer = serverCredential
        });