Google_Service_Directory with Default Credential - keep getting (403) Not Authorized to access this resource/api

Question

I'm trying to get info on a group using default credentials. My code is

        putenv( 'GOOGLE_APPLICATION_CREDENTIALS=' . XXX_SSO_SERVICE_ACCOUNT_CREDENTIALS_JSON );
        $service_account_client = new \Google_Client();

        $service_account_client->useApplicationDefaultCredentials();

        $service_account_client->setScopes([
            \Google_Service_Directory::ADMIN_DIRECTORY_GROUP_READONLY,
            \Google_Service_Directory::ADMIN_DIRECTORY_GROUP_MEMBER_READONLY,
            \Google_Service_Directory::ADMIN_DIRECTORY_USER_READONLY,
        ]);

        $groups_service = new \Google_Service_Directory( $service_account_client );
        $groups = $groups_service->groups->listGroups([
            'userKey' => 'contractor@xxx.com',
            'domain' => 'xxx.com'
        ]);

I keep getting the error "Not Authorized to access this resource/api"

I've no access to the G Suite admin console but I've been told that the perimissions are set correctly.

I've also tried adding the email of the user to impersonate

 $service_account_client = new \Google_Client( ['subject'=> 'admin@xxx.com'] );

but I still get the same error.

Answer 1

In my case the admin user was not admin@xxx.com but another email. So the correct answer here is to use

    putenv( 'GOOGLE_APPLICATION_CREDENTIALS=' . XXX_SSO_SERVICE_ACCOUNT_CREDENTIALS_JSON );
    $service_account_client = new \Google_Client( ['subject'=> 'aaa.cccc@xxx.com'] );// Set the mail of an admin of G Suite

    $service_account_client->useApplicationDefaultCredentials();

    $service_account_client->setScopes([
        \Google_Service_Directory::ADMIN_DIRECTORY_GROUP_READONLY,
        \Google_Service_Directory::ADMIN_DIRECTORY_GROUP_MEMBER_READONLY,
        \Google_Service_Directory::ADMIN_DIRECTORY_USER_READONLY,
    ]);

    $groups_service = new \Google_Service_Directory( $service_account_client );
    $groups = $groups_service->groups->listGroups([
        'userKey' => 'contractor@xxx.com',
        'domain' => 'xxx.com'
    ]);