Import_projects.py authentication

[Lance752]

Hi Lukas, Thanks for creating and sharing this script and all of your gcp-tools it is very much appreciated. I'm getting the error below despite the client id for the service account having been granted the needed 2lo scopes in the G Suite console.

Retrieving users from Google Admin SDK Directory API... Traceback (most recent call last): File "C:\gcp-tools\import_projects.py", line 315, in main() File "C:\gcp-tools\import_projects.py", line 273, in main users = get_domain_users(admin) File "C:\gcp-tools\import_projects.py", line 109, in get_domain_users users = admin.get_users() File "C:\gcp-tools\lib\google.py", line 488, in get_users users_list = request.execute() File "C:\Python27\lib\site-packages\oauth2client_helpers.py", line 133, in positional_wrapper return wrapped(*args, **kwargs) File "C:\Python27\lib\site-packages\googleapiclient\http.py", line 836, in execute method=str(self.method), body=self.body, headers=self.headers) File "C:\Python27\lib\site-packages\googleapiclient\http.py", line 167, in _retry_request resp, content = http.request(uri, method, *args, **kwargs) File "C:\Python27\lib\site-packages\oauth2client\transport.py", line 159, in new_request credentials._refresh(orig_request_method) File "C:\Python27\lib\site-packages\oauth2client\client.py", line 749, in _refresh self._do_refresh_request(http) File "C:\Python27\lib\site-packages\oauth2client\client.py", line 819, in _do_refresh_request raise HttpAccessTokenRefreshError(error_msg, status=resp.status) oauth2client.client.HttpAccessTokenRefreshError: unauthorized_client: Client is unauthorized to retrieve access tokens using this method.

[lukwam]

It sounds like the service account you are using doesn't have the users scope that it needs in the G Suite domain in order to sub as a domain user.

/l

On Fri, Mar 30, 2018 at 2:36 PM, Lance752 [email protected] wrote:

Hi Lukas, Thanks for creating and sharing this script and all of your gcp-tools it is very much appreciated. I'm getting the error below despite the client id for the service account having been granted the needed 2lo scopes in the G Suite console.

Retrieving users from Google Admin SDK Directory API... Traceback (most recent call last): File "C:\gcp-tools\import_projects.py", line 315, in main() File "C:\gcp-tools\import_projects.py", line 273, in main users = get_domain_users(admin) File "C:\gcp-tools\import_projects.py", line 109, in get_domain_users users = admin.get_users() File "C:\gcp-tools\lib\google.py", line 488, in get_users users_list = request.execute() File "C:\Python27\lib\site-packages\oauth2client_helpers.py", line 133, in positional_wrapper return wrapped(*args, **kwargs) File "C:\Python27\lib\site-packages\googleapiclient\http.py", line 836, in execute method=str(self.method), body=self.body, headers=self.headers) File "C:\Python27\lib\site-packages\googleapiclient\http.py", line 167, in _retry_request resp, content = http.request(uri, method, *args, **kwargs) File "C:\Python27\lib\site-packages\oauth2client\transport.py", line 159, in new_request credentials._refresh(orig_request_method) File "C:\Python27\lib\site-packages\oauth2client\client.py", line 749, in _refresh self._do_refresh_request(http) File "C:\Python27\lib\site-packages\oauth2client\client.py", line 819, in _do_refresh_request raise HttpAccessTokenRefreshError(error_msg, status=resp.status) oauth2client.client.HttpAccessTokenRefreshError: unauthorized_client: Client is unauthorized to retrieve access tokens using this method.

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/lukwam/gcp-tools/issues/3, or mute the thread https://github.com/notifications/unsubscribe-auth/ABrwKoBC1wmWMQI8kTb_mhvxxMy-Br3Cks5tjns6gaJpZM4TCAHY .

-- Lukas Karlsson, Cloud Architect / Developer Advocate http://www.broadinstitute.org/ Broad Institute of MIT and Harvard 75 Ames Street, 11129, Cambridge, Massachusetts 02142 [email protected], +1.6177147142

[Lance752]

hmm I gave it https://www.google.apis.com/auth/admin.directory.user, https://www.google.apis.com/auth/cloud-platform in the G Suite console from your article and double checked DwD was enabled. Am I missing a scope?