1

I am setting up a service account in GCP in order to call the Directory API.

But I always get permission error: Not Authorized to access this resource/api.

I have setup this role but no luck. How do I know what permission I need to configure in order to call the API?

enter image description here

Wytrzymały Wiktor
  • 11,492
  • 5
  • 29
  • 37
Joey Yi Zhao
  • 37,514
  • 71
  • 268
  • 523
  • You need to have a [domain-wide-delegation](https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account) on your service account - otherwise it won't work. – Wojtek_B Jul 22 '21 at 08:16

1 Answers1

0

Google Directory API is not a part of GCP - hence any roles / permissions you assign to your service account will not work.

You have to create a role and assign it to a user in order to be able to work with this API.

Your service account is not a Domain Admin so it doesn't have access. You can however enable domain-wide-delegation and make the service account impersonate domain admin so your requests will be accepted;

This page describes how to allow members and resources to impersonate, or act as, an Identity and Access Management (IAM) service account. It also explains how to see which members are able to impersonate a given IAM service account.

Have a look at this answer which may be usefull to you. One more document that you may find helpful is "Authorising your request".

Wojtek_B
  • 4,245
  • 1
  • 7
  • 21