search

SCRT-HQ / PSGSuite

Powershell module for Google / G Suite API calls wrapped in handy functions. Authentication is established using a service account via P12 key to negate the consent popup and allow for greater handsoff automation capabilities
https://psgsuite.io/
Apache License 2.0
234 stars 67 forks source link

Setup instructions need updating on API/Scopes #310

Open jgmachine opened 3 years ago

jgmachine commented 3 years ago

Describe the bug https://www.googleapis.com/auth/admin.directory is an invalid scope and I think the page where scopes are entered has changed.

To Reproduce Steps to reproduce the behavior:

  1. try to add "https://www.googleapis.com/auth/admin.directory" to scopes and it will come up as invalid.

Expected behavior Copy and paste scopes from setup instructions and they should all get added.

Additional context I think instructions also need to be updated to go to Security > API Controls > Domain-wide Delegation to enter these scopes. It took me a minute to realize there was an invalid scope, as when you try to authorize the scopes it wasn't very clear that there was an error.

AmmarIjaz commented 3 years ago

Were you able to find an alternate scope for that? I'm still pretty new to API/OATH stuff and couldn't find that scope listed here, so I can't figure out what a comparable scope might be: https://developers.google.com/identity/protocols/oauth2/scopes

Looks like I'm able to do everything except manage users, which is the main thing I was hoping to use this module for. Get-GSUserList fails with this error: Get-GSUser: Exception calling "Execute" with "0" argument(s): "Error:"disabled_client", Description:"The OAuth client was disabled.", Uri:"""

serenetangerine commented 3 years ago

I ended up having to put all the sub-scopes from https://www.googleapis.com/auth/admin.directory individually. Namely

That said I'm not sure why Google changed being able to hit them all with just https://www.googleapis.com/auth/admin.directory/. I guess it is best practice to only scope the permissions you're actually planning on using though.