CODEWITHSUNDEEP
javaservice-accountsgoogle-reseller-api
Tristan
Tristan

Reputation: 40

Google Reseller API getting GoogleJsonResponseException: 403 Forbidden

I'm working on a project that uses the Google Apps Reseller API (Found here).

I'm running into a 403 Forbidden Exception.

Code (most of it origins from the Google Codelab Example Here:

try {
        try {

        Reseller service = GoogleResellerApiUtil.getResellerService();

        Customer customerRecord = service.customers().get("acme.com").execute(); //crashes here
    // "acme.com" is also used in the example from Google
        System.out.println(customerRecord.toString());


    } catch (GoogleJsonResponseException e) {
        e.printStackTrace();
    }

And this is the class I use to connect to the API. I've provided a p12 file and it uses the service account, when calling the API it is impersonating one of the super admins, so it should be allowed to make all the calls.

At the moment I'm only using the read-only scope.

public class GoogleResellerApiUtil {
    /** HTTP_TRANSPORT */
    private static final HttpTransport HTTP_TRANSPORT = new NetHttpTransport();

    /** JSON Factory*/
    private static final JsonFactory JSON_FACTORY = new JacksonFactory();

    /** Service Account Email */
    public static final String SERVICE_ACCOUNT_EMAIL = "****@appspot.gserviceaccount.com";

    /** P12 File Location */
    public static final String PRIVATE_KEY_FILE = "WEB-INF/key.p12";

    /** Reseller Admin Account to impersonate */
    public static final String RESELLER_ADMIN = "**.**@**.com";

    /** Scopes */
    public static final List<String> SCOPES = Arrays.asList(ResellerScopes.APPS_ORDER_READONLY);

    /** Application name. */
    private static final String APPLICATION_NAME = "**-subscription-portal";

    /** Logger */
    private final static Logger LOGGER =
        Logger.getLogger(GoogleResellerApiUtil.class.getName());



    public static GoogleCredential getCredentials() throws IOException {

        GoogleCredential credentials = null;

        try {
            credentials = new GoogleCredential.Builder()
                .setTransport(HTTP_TRANSPORT)
                .setJsonFactory(JSON_FACTORY)
                .setServiceAccountId(SERVICE_ACCOUNT_EMAIL)
                .setServiceAccountScopes(SCOPES)
                .setServiceAccountUser(RESELLER_ADMIN)
                .setServiceAccountPrivateKeyFromP12File(new File(PRIVATE_KEY_FILE))
                .build();
        } catch (GeneralSecurityException e) {
            e.printStackTrace();
        }

        System.out.println("credential has been build, returning credential "); //this gets printed, so I think the credentials are valid?
    return credentials;
}

    /**
     * Build and return an authorized Reseller client service.
     * @return an authorized Reseller client service
     * @throws IOException
     */
    public static Reseller getResellerService() throws Exception {
        Credential credential = getCredentials();
        return new Reseller.Builder(
            HTTP_TRANSPORT, JSON_FACTORY, credential)
            .setApplicationName(APPLICATION_NAME)
            .build();
    }
}

But I get the following error message when making the call:

com.google.api.client.googleapis.json.GoogleJsonResponseException: 403 OK
{
  "code" : 403,
  "errors" : [ {
    "domain" : "global",
    "message" : "Forbidden",
    "reason" : "forbidden"
  } ],
  "message" : "Forbidden"
}
at com.google.api.client.googleapis.json.GoogleJsonResponseException.from(GoogleJsonResponseException.java:146)
etc. etc. etc.

Upvotes: 0

Views: 584

Answers (1)

Teyam
Teyam

Reputation: 8082

It is noted in Reseller API: Manage Subscriptions that

Note: If the customerAuthToken is not valid or has expired, the API response returns a 403 "Forbidden" error.

To solve the issue, please make sure that requests must be authorized by an authenticated user who has access to the data. As also noted in Reseller API: Authorizing

Note: The user granting permission for the Reseller API must be a domain super administrator.

In addition to that, it was suggested in Token expiration that you write your code to anticipate the possibility that a granted token might no longer work. A token might stop working for one of these reasons:

  • The user has revoked access.
  • The token has not been used for six months.
  • The user changed passwords and the token contains Gmail scopes.
  • The user account has exceeded a certain number of token requests.

Hope that helps!

Upvotes: 1

Related Questions