Google Directory API 在调用 groups().list().execute() 时返回 access_denied

Question

• 库：google-api-services-admin-directory_v1-rev11-1.16.0-rc.jar
• API 控制台：服务帐户
• 域第 3 方 OAuth 客户端访问设置 https://www.googleapis.com/auth/admin.directory.group https://www.googleapis.com/auth/admin.directory.user

获取用户列表可行，但组列表返回错误 (access_denied)

来源

scopeList.add(DirectoryScopes.ADMIN_DIRECTORY_USER);
scopeList.add(DirectoryScopes.ADMIN_DIRECTORY_GROUP);
scopeList.add(DirectoryScopes.ADMIN_DIRECTORY_GROUP_MEMBER);

credential = new GoogleCredential.Builder()
    .setTransport(httpTransport)
    .setJsonFactory(jsonFactory)
    .setServiceAccountId("xxxxx@developer.gserviceaccount.com")
    .setServiceAccountScopes(scopeList)
    .setServiceAccountPrivateKeyFromP12File(new java.io.File("xxxxx-privatekey.p12"))
    .setServiceAccountUser("admin@test.com")
    .build();

Directory admin = new Directory.Builder(httpTransport, jsonFactory, credential)
    .setApplicationName("Test")
    .setHttpRequestInitializer(credential).build();


admin.users().list().setDomain("test.com").execute();
admin.groups().list().setDomain("test.com").execute();

错误

com.google.api.client.auth.oauth2.TokenResponseException: 400 Bad Request
{
  "error" : "access_denied"
}
    at com.google.api.client.auth.oauth2.TokenResponseException.from(TokenResponseException.java:105)
    at com.google.api.client.auth.oauth2.TokenRequest.executeUnparsed(TokenRequest.java:332)
    at com.google.api.client.auth.oauth2.TokenRequest.execute(TokenRequest.java:352)
    at com.google.api.client.googleapis.auth.oauth2.GoogleCredential.executeRefreshToken(GoogleCredential.java:269)
    at com.google.api.client.auth.oauth2.Credential.refreshToken(Credential.java:454)
    at com.google.api.client.auth.oauth2.Credential.intercept(Credential.java:215)
    at com.google.api.client.http.HttpRequest.execute(HttpRequest.java:854)
    at com.google.api.client.googleapis.services.AbstractGoogleClientRequest.executeUnparsed(AbstractGoogleClientRequest.java:410)
    at com.google.api.client.googleapis.services.AbstractGoogleClientRequest.executeUnparsed(AbstractGoogleClientRequest.java:343)
    at com.google.api.client.googleapis.services.AbstractGoogleClientRequest.execute(AbstractGoogleClientRequest.java:460)

Answer 1

• 服务帐户是否被授予访问组 API 范围的权限？ （https://www.googleapis.com/auth/admin.directory.group 或 https://www.googleapis.com/auth/admin.directory.group.readonly）。有关如何执行此操作的详细信息，请参阅Google Drive docs）

• ServiceAccountUser 是超级管理员还是被授予通过 API 管理群组的权限的委托管理员？