scrthq
commented
5 years ago Hey @Chris4678 - occasionally, new project permissions don't propagate immediately, leading to those erroneous errors. As you discovered, going the Client ID route is intended for non-admins or free Gmail users, so the Admin SDK isn't available that way.
I have seen it take up to a day for a new account + new project to start working correctly. Given that you've set this up successfully multiple times already, I don't doubt that there was any issue on your end with the configuration, just need to give it a little time before Google propagates the changes.
Chris4678
I have used this module successfully for 4 google domains. I have a 5th domain that I am trying to get setup now. All 5 domains have provided me with a super admin account and they are all Google Education domains. Like I said before I have this module working perfectly for 4 out of 5 domains. When I setup my 5th domain I click for click go through the exact same process but cant get authenticated. Error: "Client is unauthorized to retrieve access tokens using this method, or client not authorized for any of the scopes requested." I have full control of the domain and have re done the setup almost 10 times now. I have contacted google and made sure every setting needed is enabled. I am at a loss for what to do moving forward.
I decided to try the second authentication method using OAuth instead of a service account. I created a project with all of the APIs enabled like the first step for super admins, however, instead of creating the service account I started following the steps for using a client ID. I get that working, however, it doesnt allow me to use the Admin SDK which I believe is the API I need to manage user accounts. (my end goal) I enabled all of the scopes in the list. I set the consent screen to internal as well which seemed to fix some warning signs on the page. I still get an error saying: "Insufficient Permission: request had insufficient authentication scopes."
I know this is a long shot but do you have any advice on how to move forward? I have set this tool up with no issue so many times before and I even re setup a known good domain to make sure I wasn't missing a step. It worked fine, however, this new one still wont. Is there some hidden setting I might be missing? Is there some way to make OAuth work for Admin SDK? Any advice would be life saving. I already wrote a 1k+ line script for this domain using my testing domain to build it. Now all of that is useless if I cant get authenticated...