Using Google API Python client with SignedJwtAssertionCredentials

Question

I am trying to get a list of users from Google using google_api_python_client-1.4.0. I getting the access_denied error even through I have domain wide delegation authority.

Interesting thing is that.. when I use the same certificate/credentials with .net client library, it works.

The error I am getting is File "/Library/Python/2.7/site-packages/oauth2client-1.4.6-py2.7.egg/oauth2client/client.py", line 807, in _do_refresh_request oauth2client.client.AccessTokenRefreshError: access_denied: Requested client not authorized.

# Load the key in PKCS 12 format that you downloaded from the Google API
# Console when you created your Service account.
f = file('Gkeys/87ty8g87-privatekey.p12', 'rb')
key = f.read()
f.close()
# Create an httplib2.Http object to handle our HTTP requests and authorize it
# with the Credentials. Note that the first parameter, service_account_name,
# is the Email address created for the Service account. It must be the email
# address associated with the key that was created.
credentials = SignedJwtAssertionCredentials(
    '[email protected]',
    key,
    scope=['https://www.googleapis.com/auth/admin.directory.group.readonly','https://www.googleapis.com/auth/admin.directory.user.readonly'],
    private_key_password='notasecret',
    sub='[email protected]'

)


http = httplib2.Http()
http = credentials.authorize(http)


directory_service = build('admin', 'directory_v1', http=http)

all_users = []
page_token = None

params = {'groupKey': '[email protected]'}

while True:
  try:
    if page_token:
      params['pageToken'] = page_token
    #current_page = directory_service.users().list(**params).execute()
    #current_page = directory_service.members().list(**params).execute()
    current_page = directory_service.members().list(groupKey='[email protected]').execute()

    all_users.extend(current_page['users'])
    page_token = current_page.get('nextPageToken')
    if not page_token:
      break
  except errors.HttpError as error:
    print 'An error occurred: %s' % error
    break

for user in all_users:
  print user['primaryEmail']

Jay Lee · Accepted Answer · 2015-04-10 23:23:22Z

1

Are you sure the scopes you authorized in the control panel exactly match those you're requesting here? If you authorized the read/write scope and are using the readonly scope here I believe that would cause your error.

answered Apr 10, 2015 at 23:23

Jay Lee

13.5k3 gold badges32 silver badges60 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

ZOO Over a year ago

Thank you Jay! That was it. I didn't know that scope needs to match exactly.

Collectives™ on Stack Overflow

Using Google API Python client with SignedJwtAssertionCredentials

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related