taers232c / GAMADV-XTD3

Command line tool to manage Google Workspace
691 stars 86 forks source link

"check serviceaccount" fails for specific services #363

Closed sorentorp closed 1 year ago

sorentorp commented 1 year ago

The issue tracker is for reporting product deficiencies. "How do I?" questions should be posted to the discussion forum at https://groups.google.com/group/google-apps-manager. When in doubt, start at the discussion forum and return here only when instructed to do so.

Please confirm the following:

Full steps to reproduce the issue:

  1. gam user specific-domainuser@aaks.dk check serviceaccount

Expected outcome (what are you trying to do?): I'm trying to make full use of GAM - but some services fail to pass.

Actual outcome (what errors or bad behavior do you see instead?):

System time status Your system time differs from admin.googleapis.com by less than 1 second PASS Service Account Private Key Authentication Authentication PASS Service Account Private Key age; Google recommends rotating keys on a routine basis Service Account Private Key age: 545 days WARN Domain-wide Delegation authentication:, User: xxxxx@aaks.dk, Scopes: 29 https://mail.google.com/ PASS (1/29) https://sites.google.com/feeds PASS (2/29) https://www.googleapis.com/auth/analytics.readonly PASS (3/29) https://www.googleapis.com/auth/apps.alerts FAIL (4/29) https://www.googleapis.com/auth/calendar PASS (5/29) https://www.googleapis.com/auth/classroom.announcements PASS (6/29) https://www.googleapis.com/auth/classroom.coursework.students PASS (7/29) https://www.googleapis.com/auth/classroom.courseworkmaterials PASS (8/29) https://www.googleapis.com/auth/classroom.profile.emails PASS (9/29) https://www.googleapis.com/auth/classroom.rosters PASS (10/29) https://www.googleapis.com/auth/classroom.topics PASS (11/29) https://www.googleapis.com/auth/cloud-identity PASS (12/29) https://www.googleapis.com/auth/cloud-platform PASS (13/29) https://www.googleapis.com/auth/contacts PASS (14/29) https://www.googleapis.com/auth/contacts.other.readonly PASS (15/29) https://www.googleapis.com/auth/datastudio FAIL (16/29) https://www.googleapis.com/auth/directory.readonly PASS (17/29) https://www.googleapis.com/auth/documents PASS (18/29) https://www.googleapis.com/auth/drive PASS (19/29) https://www.googleapis.com/auth/drive.activity PASS (20/29) https://www.googleapis.com/auth/drive.admin.labels PASS (21/29) https://www.googleapis.com/auth/drive.labels FAIL (22/29) https://www.googleapis.com/auth/gmail.modify PASS (23/29) https://www.googleapis.com/auth/gmail.settings.basic PASS (24/29) https://www.googleapis.com/auth/gmail.settings.sharing PASS (25/29) https://www.googleapis.com/auth/keep FAIL (26/29) https://www.googleapis.com/auth/spreadsheets PASS (27/29) https://www.googleapis.com/auth/tasks PASS (28/29) https://www.googleapis.com/auth/userinfo.profile PASS (29/29) Some scopes FAILED! To authorize them, please go to the following link in your browser:

https://admin.google.com/ac/owl/domainwidedelegation?clientScopeToAdd=https://mail.google.com/,https://sites.google.com/feeds,https://www.googleapis.com/auth/analytics.readonly,https://www.googleapis.com/auth/apps.alerts,https://www.googleapis.com/auth/calendar,https://www.googleapis.com/auth/classroom.announcements,https://www.googleapis.com/auth/classroom.coursework.students,https://www.googleapis.com/auth/classroom.courseworkmaterials,https://www.googleapis.com/auth/classroom.profile.emails,https://www.googleapis.com/auth/classroom.rosters,https://www.googleapis.com/auth/classroom.topics,https://www.googleapis.com/auth/cloud-identity,https://www.googleapis.com/auth/cloud-platform,https://www.googleapis.com/auth/contacts,https://www.googleapis.com/auth/contacts.other.readonly,https://www.googleapis.com/auth/datastudio,https://www.googleapis.com/auth/directory.readonly,https://www.googleapis.com/auth/documents,https://www.googleapis.com/auth/drive,https://www.googleapis.com/auth/drive.activity,https://www.googleapis.com/auth/drive.admin.labels,https://www.googleapis.com/auth/drive.labels,https://www.googleapis.com/auth/gmail.modify,https://www.googleapis.com/auth/gmail.settings.basic,https://www.googleapis.com/auth/gmail.settings.sharing,https://www.googleapis.com/auth/keep,https://www.googleapis.com/auth/spreadsheets,https://www.googleapis.com/auth/tasks,https://www.googleapis.com/auth/userinfo.profile,https://www.googleapis.com/auth/userinfo.email&clientIdToAdd=101684278312947898754&overwriteClientId=true&dn=aaks.dk&authuser=me@aaks.dk

You will be directed to the Google Workspace admin console Security > API Controls > Domain-wide Delegation page The "Add a new Client ID" box will open Make sure that "Overwrite existing client ID" is checked Click AUTHORIZE When the box closes you're done After authorizing it may take some time for this test to pass so wait a few moments and then try this command again.

I have tried re-adding the services to the API, but it doesn't fix the issue AND waited multible days. I'm stuck and ran out of possible solutions.. Help please ;-)

taers232c commented 1 year ago

Send me a Meet/Zoom authentication.

Ross

On Tue, May 23, 2023 at 5:41 AM sorentorp @.***> wrote:

The issue tracker is for reporting product deficiencies. "How do I?" questions should be posted to the discussion forum at https://groups.google.com/group/google-apps-manager. When in doubt, start at the discussion forum and return here only when instructed to do so.

Please confirm the following:

Full steps to reproduce the issue:

  1. gam user @.*** check serviceaccount

Expected outcome (what are you trying to do?): I'm trying to make full use of GAM - but some services fail to pass.

Actual outcome (what errors or bad behavior do you see instead?):

System time status Your system time differs from admin.googleapis.com by less than 1 second PASS Service Account Private Key Authentication Authentication PASS Service Account Private Key age; Google recommends rotating keys on a routine basis Service Account Private Key age: 545 days WARN Domain-wide Delegation authentication:, User: @.***, Scopes: 29 https://mail.google.com/ PASS (1/29) https://sites.google.com/feeds PASS (2/29) https://www.googleapis.com/auth/analytics.readonly PASS (3/29) https://www.googleapis.com/auth/apps.alerts FAIL (4/29) https://www.googleapis.com/auth/calendar PASS (5/29) https://www.googleapis.com/auth/classroom.announcements PASS (6/29) https://www.googleapis.com/auth/classroom.coursework.students PASS (7/29) https://www.googleapis.com/auth/classroom.courseworkmaterials PASS (8/29) https://www.googleapis.com/auth/classroom.profile.emails PASS (9/29) https://www.googleapis.com/auth/classroom.rosters PASS (10/29) https://www.googleapis.com/auth/classroom.topics PASS (11/29) https://www.googleapis.com/auth/cloud-identity PASS (12/29) https://www.googleapis.com/auth/cloud-platform PASS (13/29) https://www.googleapis.com/auth/contacts PASS (14/29) https://www.googleapis.com/auth/contacts.other.readonly PASS (15/29) https://www.googleapis.com/auth/datastudio FAIL (16/29) https://www.googleapis.com/auth/directory.readonly PASS (17/29) https://www.googleapis.com/auth/documents PASS (18/29) https://www.googleapis.com/auth/drive PASS (19/29) https://www.googleapis.com/auth/drive.activity PASS (20/29) https://www.googleapis.com/auth/drive.admin.labels PASS (21/29) https://www.googleapis.com/auth/drive.labels FAIL (22/29) https://www.googleapis.com/auth/gmail.modify PASS (23/29) https://www.googleapis.com/auth/gmail.settings.basic PASS (24/29) https://www.googleapis.com/auth/gmail.settings.sharing PASS (25/29) https://www.googleapis.com/auth/keep FAIL (26/29) https://www.googleapis.com/auth/spreadsheets PASS (27/29) https://www.googleapis.com/auth/tasks PASS (28/29) https://www.googleapis.com/auth/userinfo.profile PASS (29/29) Some scopes FAILED! To authorize them, please go to the following link in your browser:

@.***

You will be directed to the Google Workspace admin console Security > API Controls > Domain-wide Delegation page The "Add a new Client ID" box will open Make sure that "Overwrite existing client ID" is checked Click AUTHORIZE When the box closes you're done After authorizing it may take some time for this test to pass so wait a few moments and then try this command again.

I have tried re-adding the services to the API, but it doesn't fix the issue AND waited multible days. I'm stuck and ran out of possible solutions.. Help please ;-)

— Reply to this email directly, view it on GitHub https://github.com/taers232c/GAMADV-XTD3/issues/363, or unsubscribe https://github.com/notifications/unsubscribe-auth/ACCTYL2KG3IADCN5DKNUZU3XHSV73ANCNFSM6AAAAAAYL2VWUQ . You are receiving this because you are subscribed to this thread.Message ID: @.***>

-- Ross Scroggs @.***

sorentorp commented 1 year ago

Fixed it!

Missed a few permissions including "Reporting" and "DLP" + I needed to impersonate a real user, that has these permissions.