Google API-使用服务目录

Question

我有一个应用程序在谷歌API控制台。它启用了管理SDK，也启用了市场SDK。当我试图从某个域获取用户时，它总是显示一条消息“错误调用gethttps://www.googleapis.com/admin/directory/v1/users?domain=mydomain.com:（403）不授权访问此资源/api”。我得到的代码是这样的:

    $client = new Google_Client();
    $client->setApplicationName("Client_User_Feed");            

    $key = file_get_contents('/path/to/key/key-file-privatekey.p12');
    $cred = new Google_Auth_AssertionCredentials(
        '{code}@developer.gserviceaccount.com',
        array('https://www.googleapis.com/auth/admin.directory.user'),
        $key
    );
    $client->setAssertionCredentials($cred);
    $service = new Google_Service_Directory($client);           

    $users = $service->users->listUsers(array('domain' => 'mydomain.com'));

我该如何解决这个问题？

Answer 1

您需要使用以下内容来模拟管理员用户:

SUB=AdminUser/Code>

获取userid的示例代码:

$client_id = '{code}.apps.googleusercontent.com';  //Client ID from Developers Console
$service_account_name = '{code}@developer.gserviceaccount.com'; //Email Address from Developers Console
$key_file_location = '{path}{file}.p12';    //Path to the P12 key downloaded from Developers Console
$impersonateUser = '[e-mail]';   //The user's account we are fetching information from   

    try {
    $client = new Google_Client();  //Instantiate the Google Client
    $client->setApplicationName("ApplicationName");

    $adminService = new Google_Service_Directory($client);

    $key = file_get_contents($key_file_location);
    $cred = new Google_Auth_AssertionCredentials(  //Instantiate the Auth class
        $service_account_name,
        array('https://www.googleapis.com/auth/admin.directory.user'),         //Set the scope
        $key
    );

    $adminUser = '[e-mail]';
    $cred->sub = $adminUser;  //The sub function of Auth lets us impersonate a user so that our service account ($client_id) can act on the user's behalf

    $client->setAssertionCredentials($cred);
    if ($client->getAuth()->isAccessTokenExpired()) {
        $client->getAuth()->refreshTokenWithAssertion($cred);
    }

    $getUser = getUserId($adminService, $impersonateUser);
    $impersonateUser = $getUser['primaryEmail'];

    if (isset($impersonateUser) && !empty($impersonateUser)) {
        $_SESSION['gmailUserID'] = $impersonateUser;
    }   
    //echo $_SESSION['gmailUserID'] . "<br />";
    } catch (Exception $e) {
        LogErr($e);
    }

function getUserId($adminService, $impersonateUser) {
    try {
    $userId = $adminService->users->get($impersonateUser);
    return $userId;
    } catch (Exception $e) {
    LogErr($e);
    }
}