This website uses Cookies. Click Accept to agree to our website's cookie use as described in our Privacy Policy. Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Log in to ask a question
Get hands-on experience with 20+ free Google Cloud products and $300 in free credit for new customers.
Log in to ask a question

Admin SDK API Returning Status Code 403 - Cannot Figure Out Root of Permission Issue

Posted on 04-17-2024 11:09 AM
nic_mscomp
Bronze 1
Bronze 1
Reply posted on --/--/---- --:-- AM
I am automating employee offboarding (deleting Google Workspace users) by making Http callouts from Salesforce to Google Cloud Admin SDK API using a service account for authentication/authorization. 
 
For context, this article is essentially the entirety of the Salesforce setup procedure and majority of Google Project setup. (I've confirmed authentication/authorization using the Calendar API like in the article)
 
The call is made and there seems to be a permission issue on the service account side. 
 
HTTP Response Error: 
DEBUG | JSON RESPONSE: {
  "error": {
    "code": 403,
    "message": "Not Authorized to access this resource/api",
    "errors": [
      {
        "message": "Not Authorized to access this resource/api",
        "domain": "global",
        "reason": "forbidden"...
 
I have enabled the Admin SDK API and the service account is listed under credentials. 
Service account role is set to "Owner". 
I even enabled Domain-wide delegation and included the authorization scope of:

as listed in the documentation.

What could I be missing here to open up authorization to use Admin SDK APIs?

Solved Solved
1 4 2,006
Jump to Solution
1 ACCEPTED SOLUTION

Posted on --/--/---- --:-- AM
nic_mscomp
Bronze 1
Bronze 1
Reply posted on --/--/---- --:-- AM

I found the root issue. In order to use the Admin SDK API, the service account must impersonate an administrator of the domain. Domain-wide delegation is not enough to interacted with Admin SDK API.

To implement this, you must include the email address of an admin of your domain in the JWT subject, in addition to audience, issuer, and scope. (JSON Claims Set in a JSON Web Token (JWT))

Endpoint:  
https://admin.googleapis.com/admin/directory/v1
 
Issuer:
Google Service account:
xxx@xxx.iam.gserviceaccount.com
 
Audience Claim:
https://www.googleapis.com/oauth2/v4/token
 
Subject:
Domain administrator email address
 
Obviously provide the correct certificate/key produced for service account authorization as well.
 
NOTE: No additional permissions are required to be added to the service account in the GCP console. Simply enable the API. In my case I set the service account role to owner.

View solution in original post

Jump to Solution
4 REPLIES 4
Top Labels in this Space
Top Solution Authors
View all