hlavki
commented
4 years ago @debrian could please send me anonymized service account json? thanks
Closed debrian closed 4 years ago
hlavki
commented
4 years ago @debrian could please send me anonymized service account json? thanks
dterentev-gridd
commented
4 years ago Thanks for answering. Do you mean file service account?
{
"type": "service_account",
"project_id": "account-manager-",
"private_key_id": "71f26f8882acbdd7bd45399adf101ba1d88753ff",
"private_key": "-----BEGIN PRIVATE KEY-----\n****-----END PRIVATE KEY-----\n",
"client_email": "gsuite-services-client@account-manager-iam.gserviceaccount.com",
"client_id": "10661116777031693677740",
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
"token_uri": "https://oauth2.googleapis.com/token",
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
"client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/gsuite-services-client%40account-manager.iam.gserviceaccount.com"
} thanks for answer, could you please do this steps (hope you have clean installation so you can remove all volumes):
docker-compose down -vupdate docker image version in docker-compose.yml to hlavki/g-suite-identity-sync:0.4.6-SNAPSHOT
And then try again to setup. I added some validation features, so popup window should be more informative when an error occurs. Now you can also reconfigure the service account when the error occurs.
hlavki
commented
4 years ago thanks @dterentev-gridd, can you confirm you did Service account configuration according to installation manual?
debrian
commented
4 years ago Thanks. My mistake. I gave the rights to the API is not a service account, to the account for oauth2. I look further.
hlavki
commented
4 years ago @debrian does it mean, that it works?
debrian
commented
4 years ago Yes. Thanks. There's been some progress. However, only the user whose email was entered in the api is synchronized. While trying to fix it myself.
hlavki
commented
4 years ago Yes, that's basically how it works. It does not synchronize all users, but only those who set LDAP password. Google does not provide API to validate user's password!
debrian
commented
4 years ago Not quite understood. Do I need to create oauth2 and service account separately for each user?
thanks in advance for your reply
hlavki
commented
4 years ago No, of course you don't need to create more than one service account. Now, it should works for every G Suite account. The only thing has to be done by every user is to open web application, login using g suite account and create LDAP password. Best approach is to set same password as in g suite account, so users will have only one password.
User will be instantly synchronized after setting LDAP password.
goneforaburton
commented
4 years ago As of 4th November 2019, you cannot grant access to API's using the "Enable API Access" tick box on the security page. Are you able to give any detail around which API's are individually required to be enabled to get the identity service to work correctly please? This change is detailed in this Google document: https://support.google.com/a/answer/60757?hl=en
hlavki
commented
4 years ago hi @goneforaburton, thanks for info. I need time to handle this. I'll let you know when I update documentation. Do you have any difficulties with this change, because all my installations work.
goneforaburton
commented
4 years ago Hi @hlavki , it's difficult to tell. I can't currently get the g-suite-identity-sync to work, but then I didn't start playing with the project before Google changed their API settings. So this could be I haven't configured things correctly (which is very possible), or it could be down to the change at Google's side. The error I get is exactly as for this issue (i.e. service account not configured correctly), and on working through the possible solutions, I found the Enable API Access feature had been deprecated in favour of granting individual Apps access rights. I believe if access was already granted, Google honour this, but all new API access has to be created individually. Thanks for looking into this.
hlavki
commented
4 years ago @goneforaburton I tried to install app on clean new g-suite and it worked. Enable API Acces checkbox is enabled by default.
goneforaburton
commented
4 years ago @hlavki interesting, on our console, the option is greyed out, and cannot be selected, as for this screenshot.
hlavki
commented
4 years ago yes, that is correct, but I assume it's checked
goneforaburton
commented
4 years ago OK, no worries. I've obviously got another issue somewhere in that case. When I click on the API access link, it takes me through to a page that details the changes Google have made to their API access to make it specific to individual API's. So I assumed this might be part of the issue as I was troubleshooting service account and API permissions.
bartusek27
commented
4 years ago Hello, it seems that I have similar problem as @goneforaburton - I am fairly certain that I've configured service account best I could (since your tutorial should be deprecated since creation of Service Accounts is different now), but I still get Error Occured (401 Unauthorized) when trying to paste JSON into the Setup. @hlavki Can you please verify that your tutorial is up-to-date and is not missing any Scopes or anything that can cause this?
identity-sync_1 | 16:20:36.078 INFO [qtp897245827-104] Service account key is configured
identity-sync_1 | 16:20:36.243 WARN [qtp897245827-104] Service account is not configured properly!
identity-sync_1 | javax.ws.rs.NotAuthorizedException: HTTP 401 Unauthorized
identity-sync_1 | at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
identity-sync_1 | at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source)
identity-sync_1 | at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source)
identity-sync_1 | at java.base/java.lang.reflect.Constructor.newInstance(Unknown Source)
identity-sync_1 | at org.apache.cxf.jaxrs.utils.ExceptionUtils.toWebApplicationException(ExceptionUtils.java:179)
identity-sync_1 | at org.apache.cxf.jaxrs.client.AbstractClient.convertToWebApplicationException(AbstractClient.java:538)
identity-sync_1 | at org.apache.cxf.jaxrs.client.WebClient.doInvoke(WebClient.java:940)
identity-sync_1 | at org.apache.cxf.jaxrs.client.WebClient.doInvoke(WebClient.java:901)
identity-sync_1 | at org.apache.cxf.jaxrs.client.WebClient.invoke(WebClient.java:461)
identity-sync_1 | at org.apache.cxf.jaxrs.client.WebClient.post(WebClient.java:491)@bartusek27, it looks same as https://github.com/hlavki/g-suite-identity-sync/issues/45#issuecomment-534030168 (step 3.)
bartusek27
commented
4 years ago Looks like, but it isn't :)
See for yourself...
And that Enable API access is no longer available in Admin - it was replaced with per-application trustworthiness
bartusek27
commented
4 years ago @hlavki I've checked it and everything should be fine, it's strange :(
hlavki
commented
4 years ago @bartusek27 good to know it works. Anyway one question. Did you remove and then create service account using same name? Because what I know, if you did, GCP behavior can be unpredictable.
bartusek27
commented
4 years ago @hlavki We probably misunderstood - it still doesn't work - I mean from my side of configuring it in GCP. But with that same name problem, I will try to create it from scratch using different name. Will let you know. Thank you!
muhx
commented
4 years ago @bartusek27 Any update about this case, i got exactly same problem with new gsuite interface.
Hi everyone. I'm trying to use your software in Docker to import from Google to LDAP. Everything is done according to the instructions, but it does not work. Couldn't tell you what the problem was?
docker-compose.yaml :
I get an error when entering json file:
in Docker volume all by default
logs: