What is the proper way to authenticate with Google to use Google Directory API in the Admin SDK?

Question

I've been having trouble over the past few days using the Google Directory API in the Admin SDK for Google Apps. The documentation leaves a lot to be desired and when I contacted Google Apps Enterprise support they indicated they do not support the API. I am using the most recent Python API client library provided by Google as they suggest this is the best way to go. I've logged in to the Google API Console and created a Service Account and downloaded the OAuth2 key. I've also turned on the Admin SDK in the console. Here is my code:

f = file("xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-privatekey.p12", "rb")
key = f.read()
f.close()

credentials = SignedJwtAssertionCredentials(
    "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx@developer.gserviceaccount.com",
    key,
    scope = "https://www.googleapis.com/auth/admin.directory.orgunit"
)

http = httplib2.Http()
http = credentials.authorize(http)

directoryservice = build("admin", "directory_v1", http=http)

orgunits = directoryservice.orgunits().list(customerId='XXXXXXX').execute(http=http)
pprint.pprint(orgunits)

Note that customerId is our Google Apps customer ID. I tried it with "my_customer" as Google seems to indicate should work when using an account that is super admin, but I receive the return "invalid customerId" when I try it that way. So I hardcoded our actual customerId.

When harcoded always receive the return "Login Required" but it seems as if the authentication process is working as the directory object gets created via the build command. Am I doing something wrong?

Note, I also read somewhere that sometimes the request needs to come from a domain account rather than the Service Account and to do this you need to add:

sub = "domain_account_superadmin@example.com"

In the SignedJwtAssertionCredentials call... which I tried, but then receive the message "access_denied"

Thanks in advance for suggestions.

Answer 1

See the google drive example here: https://developers.google.com/drive/delegation Don't forget to delegate domain wide authority for the service account and scopes. Here is an example for listing organization units via service account:

import sys
import apiclient.discovery
import oauth2client.client
import httplib2
import pprint

# see example for using service account here: 
#   https://developers.google.com/drive/delegation
def main (argv):
    scopes = ('https://www.googleapis.com/auth/admin.directory.orgunit')
    service_account_email = 'xxx@developer.gserviceaccount.com'
    acting_as_user = 'yyy@zzz' # must have the privileges to view the org units
    f = file('key.p12', 'rb')
    key = f.read()
    f.close()
    credentials = oauth2client.client.SignedJwtAssertionCredentials(
        service_account_email,
        key,
        scope=scopes,
        sub=acting_as_user
        )
    http = httplib2.Http()
    http = credentials.authorize(http)
    directoryservice = apiclient.discovery.build('admin', 'directory_v1', http=http)
    response = directoryservice.orgunits().list(customerId='my_customer').execute(http=http)
    pprint.pprint(response)

if __name__ == '__main__':
    main(sys.argv)