Client is unauthorized to retrieve access tokens using this method or client not authorized for any scope requested API Directory C#

Question

I am getting the following error when trying to access the directory api by getting a list of users

Google.Apis.Auth.OAuth2.Responses.TokenResponseException: Error:"unauthorized_client", Description:"Client is unauthorized to retrieve access tokens using this method, or client not authorized for any of the scopes requested.", Uri:""

Based on my previous googling efforts and reading stack overflow I am not sure what is causing this. As far as I am aware I have everything set up correctly. I have it setup to use the drive api in a very similar fashion and that works perfectly.

My service account does have domain wide delegation which is why I think it may have something to do with the second part of the error. Any ideas what could be causing this?

        protected async virtual Task<DirectoryService?> GetDirectoryService()
        {
            if (currentDirectory == null)
            {
                string[] scopes = new string[] { DirectoryService.Scope.AdminDirectoryUser };

                var initializer = new ServiceAccountCredential.Initializer(configuration["GoogleServiceAccount:AccountEmail"]){Scopes = scopes, User = configuration["GoogleServiceAccount:UserEmail"] };
                var cred = new ServiceAccountCredential(initializer.FromPrivateKey(configuration["GoogleServiceAccount:SecretKey"]));

                currentDirectory = new DirectoryService(new BaseClientService.Initializer { HttpClientInitializer = cred, ApplicationName = "DriveAPI" });
            }
            return currentDirectory;

Answer 1

User = configuration["GoogleServiceAccount:UserEmail"]

User is the user on your domain that you want to delegate as not the service accounts email address.

update

Client is unauthorized to retrieve access tokens using this method, or client not authorized for any of the scopes requested

This error message in my exprence normally means that you are using code that does not match the type of credetinals you are using.

There are serval types of authorization, service account, Oauth installed and oauth web (lets ignore mobile for now). The code used for these credentials is different.

So if you use a service account key file with code designed for an Ouath2 installed app. You will normally get "Client is unauthorized to retrieve access tokens using this method, or client not authorized for any of the scopes requested"

The code I normally use for delegation with a service account is as follows. it looks similar to yours so i'm inclined to agree that you are using service account code. Which means to me you are probably using the wrong key file. I would double check. Open it it should say "type": "service_account".

// Load the Service account credentials and define the scope of its access.
var credential = GoogleCredential.FromFile(PathToServiceAccountKeyFile)
            .CreateWithUser("[email protected]")
            .CreateScoped(new[] {DriveService.ScopeConstants.Drive});

My suggestion is to now double check and ensure that you are using the service account key file from google cloud console that was created by a user on your domain, and that you configured domain wide deligation for and have added the admin sdk scopes for remember the OAuth Scopes for admin have to be set, as well configuring an authorized user.