CODEWITHSUNDEEP
jsonpython-3.xgoogle-apps-scriptgoogle-apigoogle-api-python-client
user9201220
user9201220

Reputation:

Creating the users in the google domain (python)

I am creating an application in which I am getting a Client_secret.json file, and in my application I'm trying to load that json file and get the credentials from it using the following code:

credentials=get_credentials(filename)
http = credentials.authorize(httplib2.Http())
service = discovery.build('admin', 'directory_v1', http=http)
userinfo = {'primaryEmail': primaryEmail,
    'name': { 'givenName':user },
    'password': password
}
service.users().insert(body = userinfo).execute()

It gives the following error:

httpError 403 when requesting https //www.googleapis.com/admin/directory/v1/users?alt=json returned insufficient permission

I'm not sure what I'm doing wrong or am I missing something? I was wondering if the problem is in the json file which I'm creating?

Any help would be appreciated.

Thanks, Aman

Upvotes: 0

Views: 1088

Answers (2)

Daniel_dev
Daniel_dev

Reputation: 105

Well, you can start by checking a few things:

  1. If you're using a service account, be sure to enable the "wide domain delegation option" to allow a service account to access user data on behalf of your users and perform operations.

  2. Check if the scope https //www.googleapis.com/admin/directory/v1/users is authorized for your client ID on your google admin console > Security > Advanced settings > Authentication > Manage API client access.

  3. Check if the user that you're using to insert the new user have enough privileges a.k.a super admin privileges.

  4. Check if the Admin SDK API is active on your project.

Keep in mind that just downloading the client_json and activating a API isn't enough to allow these types of operations. For certain APIs like Admin SDK, the user you're gonna use to consume those services need to have specific privileges.

Here's a few helpful links

https://developers.google.com/identity/protocols/OAuth2ServiceAccount#delegatingauthority https://support.google.com/a/answer/162106?hl=en

Upvotes: 2

ScottMcC
ScottMcC

Reputation: 4460

I would first check to make sure that you have the correct Admin privileges on the account that you are trying to use OAuth credentials on. I would try logging into the account and going to this reference page in the Directory API for Users:insert

https://developers.google.com/admin-sdk/directory/v1/reference/users/insert

On the right hand side you should go to the Try this API section and see if that account has permissions to create new users.

Also another thing I noticed as well, is that you're not setting the required field familyName inside of the name field. familyName is a required property.

Upvotes: 0

Related Questions