Google Directory API - 使用服务帐户时出现错误 400

Question

我正在使用 Directory API 的最新 Beta 版，在尝试获取用户列表时，我得到以下信息：

“远程服务器返回错误：(400) Bad Request。”

我能够从 API Explorer (https://developers.google.com/apis-explorer/#p/admin/directory_v1/directory.users.list) 执行此功能，并且我拥有所有适当的权限和范围集。

C#代码如下：

            X509Certificate2 certificate = new X509Certificate2(
                SERVICE_ACCOUNT_PKCS12_FILE_PATH,
                "KEY_PASSWORD", X509KeyStorageFlags.Exportable);

            var provider = new AssertionFlowClient(GoogleAuthenticationServer.Description, certificate)

            var provider = new AssertionFlowClient(GoogleAuthenticationServer.Description, certificate)
            {
                ServiceAccountId = SERVICE_ACCOUNT_EMAIL,
                Scope = Utilities.GetStringValue(
                    DirectoryService.Scopes.AdminDirectoryUser),
                ServiceAccountUser = SERVICE_ACCOUNT_USER,
            };
            var auth = new OAuth2Authenticator<AssertionFlowClient>(provider, AssertionFlowClient.GetState);

            var service = new DirectoryService(new BaseClientService.Initializer()
            {
                Authenticator = auth,
                ApplicationName = "API Project Name",                
            });

            var usersList = service.Users.List();
            usersList.Domain = "mydomain";

            Users results = usersList.Execute();

Answer 1

尝试按照Perform domain wide delegation of authority 中的步骤操作。这些说明特定于 Drive SDK，但可以很容易地适用于 Admin SDK。特别关注the delegation step，经常错过。