Google Admin SDK User access API using Java

Question

I am trying to fetch and update the Users of my domain using Google Admin API.

  private static final JsonFactory JSON_FACTORY = JacksonFactory.getDefaultInstance();
  private static final List<String> SCOPES = Arrays.asList(
      "https://www.googleapis.com/auth/admin.directory.user",
      "https://www.googleapis.com/auth/admin.directory.user.readonly");

  public static void main(String[] args) {
    try {
      HttpTransport httpTransport = new NetHttpTransport();


      GoogleCredential credential =
          new GoogleCredential.Builder()
              .setTransport(httpTransport)
              .setJsonFactory(JSON_FACTORY)
              .setServiceAccountId(
                  "[email protected]")
              .setServiceAccountUser("[email protected]")
              .setServiceAccountScopes(SCOPES)
              .setServiceAccountPrivateKeyFromP12File(
                  new File("C:\\privatekey.p12")).build();

      Directory admin =
          new Directory.Builder(httpTransport, JSON_FACTORY, credential)
              .setApplicationName("User Sync Service")
              .setHttpRequestInitializer(credential).build();

      Directory.Users.List list = admin.users().list();
      Users users = list.execute();
      System.out.println("************");
    } catch (Exception e) {
      e.printStackTrace();
    }
  }

From my Google Console

enter image description here

API Access is enabled from my Security panel
ServiceAccountUser is Super Admin.

But I am still getting this error

com.google.api.client.auth.oauth2.TokenResponseException: 400 Bad Request
{
  "error" : "access_denied"
}
    at com.google.api.client.auth.oauth2.TokenResponseException.from(TokenResponseException.java:105)
    at com.google.api.client.auth.oauth2.TokenRequest.executeUnparsed(TokenRequest.java:287)
    at com.google.api.client.auth.oauth2.TokenRequest.execute(TokenRequest.java:307)
    at com.google.api.client.googleapis.auth.oauth2.GoogleCredential.executeRefreshToken(GoogleCredential.java:269)
    at com.google.api.client.auth.oauth2.Credential.refreshToken(Credential.java:489)
    at com.google.api.client.auth.oauth2.Credential.intercept(Credential.java:217)
    at com.google.api.client.http.HttpRequest.execute(HttpRequest.java:858)
    at com.google.api.client.googleapis.services.AbstractGoogleClientRequest.executeUnparsed(AbstractGoogleClientRequest.java:410)
    at com.google.api.client.googleapis.services.AbstractGoogleClientRequest.executeUnparsed(AbstractGoogleClientRequest.java:343)
    at com.google.api.client.googleapis.services.AbstractGoogleClientRequest.execute(AbstractGoogleClientRequest.java:460)

Update: Screenshot from ManageOath

enter image description here

Were you able to get a solution for this? I am kind of in the same situation — user1076371
– user1076371, Commented Oct 1, 2013 at 14:42
@user1076371, yes. I can help you with this since Google Doc is quite misleading — RaceBase
– RaceBase, Commented Oct 3, 2013 at 5:24
It's bit hard to say. But Can you post screenshot from Oauth Token Screen? — RaceBase
– RaceBase, Commented Oct 7, 2013 at 11:59

Jay Lee · Accepted Answer · 2013-09-11 14:58:18Z

3

It looks like the documentation is somewhat ambiguous about customer and domain. One or the other must be specified. You can set the customer attribute when using the list() function. It should be set to the customer's ID (a unique, random looking string) or, if you're authenticating as an admin already in the Google Apps instance, you can just specify exactly customer=my_customer. Alternatively, you can specify domain=example.com where example.com is a primary or secondary domain in the Google Apps instance. When specifiying a domain, only users who have a primary (home) address in that domain will be returned in the results. When specifying customer, all users in the Google Apps instance will be returned.

You can confirm this using the Google API Explorer. Leaving customer blank always results in an error. However, putting my_customer for customer attribute should fix it.

edited Sep 11, 2013 at 14:58

answered Sep 10, 2013 at 12:47

Jay Lee

13.5k3 gold badges32 silver badges60 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

RaceBase Over a year ago

Still I am getting same error. Tried with setDomain and setCustomer.

RaceBase Over a year ago

Google API Explorer is also throwing error even if i fill Customer and domain or individually both details

Research Development Over a year ago

@JayLee u there i need one help on this issue

Silvano · Accepted Answer · 2013-09-10 22:16:17Z

1

You need to specify either the domain or the customer parameter:

Directory.Users.List list = admin.users().list()
   .setDomain("<target_domain>");

// or

Directory.Users.List list = admin.users().list()
   .setCustomer("<target_customer_id>");

I filed a bug to update the docs to make it clear that at least one of those two parameters is required.

answered Sep 10, 2013 at 22:16

Silvano

1,0156 silver badges6 bronze badges

1 Comment

RaceBase Over a year ago

Still I am getting same error. Tried with setDomain and setCustomer.

AMS · Accepted Answer · 2013-09-10 10:59:41Z

0

Proceed to https://admin.google.com/yourdomain/ManageOauthClients and check that those scopes are added for your xxxxxxxxxxxxxxxxxx.apps.googleusercontent.com service account id.

answered Sep 10, 2013 at 10:59

AMS

2536 silver badges22 bronze badges

5 Comments

RaceBase Over a year ago

It's already there. and I updated the original post with screenshot too

AMS Over a year ago

What happens if you just drop setApplicationName("User Sync Service") and setHttpRequestInitializer(credential)?

AMS Over a year ago

Sorry, your code looks good to me. Other than it, it could be the privatekey file...

RaceBase Over a year ago

I deleted exisiting service account and created new one. Still same error

RaceBase Over a year ago

I tried this developers.google.com/admin-sdk/directory/v1/reference/users/… by giving my email address, it eventually pulled the user without a issue

Collectives™ on Stack Overflow

Google Admin SDK User access API using Java

3 Answers 3

3 Comments

1 Comment

5 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

3 Comments

1 Comment

5 Comments

Your Answer

Sign up or log in

Post as a guest

Related