Opérations Groupe exécution avec le SDK administration via Java

Question

J'ai une application qui intègre avec Google Apps pour le domaine de travail et oblige à migrer de oauth 1 à oauth 2.

L'est une application serveur qui nécessite nécessite simplement to:

1. liste tous les groupes du domaine.
2. liste les utilisateurs d'un groupe spécifié.
3. Ajouter des membres à un groupe spécifié.
4. Supprimer des membres d'un groupe spécifié.

Compte tenu de ce qui précède, je crois que cela devrait être fait en utilisant un compte de service. J'ai créé ceci, téléchargé le jeton P12 (quelle est la différence entre P12 et un jeton JSON?) Et activé l'API Admin SDK via la console des développeurs. L'accès API est activé dans le panneau de contrôle du domaine et j'ai activé la portée https://www.googleapis.com/auth/admin.directory.group.member pour l'ID client associé au compte de service.

J'ai essayé quelques opérations aléatoires autour de groupes mais j'ai obtenu une réponse "permissions insuffisantes".

{ 
    "code" : 403, 
    "errors" : [ { 
    "domain" : "global", 
    "message" : "Insufficient Permission", 
    "reason" : "insufficientPermissions" 
    } ], 
    "message" : "Insufficient Permission" 
} 

Quoi qu'il en soit, d'une part, je suis à la recherche d'un peu d'aide avec le code nécessaire pour mettre en œuvre les opérations ci-dessus correctement et verra s'il reste un problème d'autorisations:

import java.io.File; 
import java.io.IOException; 
import java.security.GeneralSecurityException; 
import java.util.Collections; 

import org.apache.commons.httpclient.HttpException; 

import com.google.api.client.googleapis.auth.oauth2.GoogleCredential; 
import com.google.api.client.googleapis.javanet.GoogleNetHttpTransport; 
import com.google.api.client.http.HttpTransport; 
import com.google.api.client.json.JsonFactory; 
import com.google.api.client.json.jackson2.JacksonFactory; 
import com.google.api.services.admin.directory.Directory; 
import com.google.api.services.admin.directory.model.Group; 
import com.google.api.services.admin.directory.model.Groups; 
import com.google.api.services.admin.directory.model.Users; 

public class GoogleAppsService { 

    HttpTransport httpTransport; 
    JsonFactory jsonFactory; 

    public GoogleAppsService() throws GeneralSecurityException, IOException { 
     httpTransport = GoogleNetHttpTransport.newTrustedTransport(); 
     jsonFactory = JacksonFactory.getDefaultInstance(); 
    } 

    public GoogleCredential getCredentials() throws HttpException, IOException, GeneralSecurityException { 

     GoogleCredential credential = new GoogleCredential.Builder() 
       .setTransport(httpTransport) 
       .setJsonFactory(jsonFactory) 
       .setServiceAccountId("179997031769-pf4t5hifo7dmtbqul1dbl9rulneijl7o@developer.gserviceaccount.com") 
       .setServiceAccountScopes(Collections.singleton("https://www.googleapis.com/auth/admin.directory.group.member")) 
       .setServiceAccountPrivateKeyFromP12File(
         new File(this.getClass().getResource("/google_apps/google-apps-key.p12").getPath())).build(); 

     return credential; 
    } 

    public void listGroups() throws Exception{ 
     GoogleCredential credentials = getCredentials(); 

     Directory directory = new Directory.Builder(
       httpTransport, jsonFactory, credentials) 
       .setApplicationName("xyz") 
       .build(); 

     //403 insufficient permissions thrown below is the above correct?? 
     Groups result = directory.groups().list().execute(); 
     System.out.println(result); 

     //iterate and print id/alias of each group 
    } 

    public void listUsers(String groupName) throws Exception { 
     GoogleCredential credentials = getCredentials(); 

     //iterate and print email of each member for specified group 
    } 

    public void addUser(String groupname, String emailAddress)throws Exception { 
     GoogleCredential credentials = getCredentials(); 
    } 

    public void removeUser(String groupName, String emailAddress)throws Exception { 
     GoogleCredential credentials = getCredentials(); 
    } 

    public static void main(String[] args) throws Exception { 
     try { 
      GoogleAppsService service = new GoogleAppsService(); 
      service.listGroups(); 
     } catch (HttpException e) { 
      e.printStackTrace(); 
     } catch (IOException e) { 
      e.printStackTrace(); 
     } 
    } 
} 

Answer 1

Bon, enfin aller dans cette travailler avec la solution complète comme ci-dessous. La clé spécifiait l'utilisateur du compte de service (l'adresse e-mail d'un utilisateur admin sur le compte Google Apps) et appelait setCustomer ("my_customer") lors de l'obtention de la liste des groupes.

public class GoogleAppsService { 

    private static final Logger LOGGER = Logger.getLogger(GoogleAppsService.class); 

    private static final String SERVICE_ACCOUNT_ID = "SERVICE_ACCOUNT_KEY"; 
    private static final String SERVICE_ACCOUNT_USER = "EMAIL_ADDRESS_OF_ADMIN_ACCOUNT_ON_GOOGLE_APPS"; 
    private static final String APPLICATION_NAME = "APP_NAME"; 

    private HttpTransport httpTransport; 
    private JsonFactory jsonFactory; 

    private String googleAppsAllEmailListName; 
    private String googleAppsCommitteeEmailListName; 

    public GoogleAppsService() throws GeneralSecurityException, IOException { 
     httpTransport = GoogleNetHttpTransport.newTrustedTransport(); 
     jsonFactory = JacksonFactory.getDefaultInstance(); 
    } 

    protected Directory getDirectory() throws HttpException, IOException, GeneralSecurityException { 

     InputStream in = this.getClass().getResourceAsStream("/google_apps/google-apps-key.p12"); 
     PrivateKey privateKey = SecurityUtils.loadPrivateKeyFromKeyStore(SecurityUtils.getPkcs12KeyStore(), in, "notasecret", 
       "privatekey", "notasecret"); 

     GoogleCredential credentials = new GoogleCredential.Builder().setTransport(httpTransport).setJsonFactory(jsonFactory) 
       .setServiceAccountId(SERVICE_ACCOUNT_ID) 
       .setServiceAccountScopes(Arrays.asList(DirectoryScopes.ADMIN_DIRECTORY_GROUP)) 
       .setServiceAccountUser(SERVICE_ACCOUNT_USER).setServiceAccountPrivateKey(privateKey).build(); 

     Directory directory = new Directory.Builder(httpTransport, jsonFactory, credentials).setApplicationName(APPLICATION_NAME) 
       .build(); 

     return directory; 
    } 

    protected Groups listGroups(Directory directory) throws Exception { 
     //IF SPECIFYING THE SERVICE_ACCOUNT_USER WHEN CONNECTING YOU CAN USE setCustomer("my_customer") 
     return directory.groups().list().setCustomer("my_customer").execute(); 
    } 

    protected Group getGroup(Directory directory, String emailAddress) throws IOException { 
     Group group = directory.groups().get(emailAddress).execute(); 

     LOGGER.debug("Returning Group: " + group != null ? group.getEmail() + "(" + group.getDirectMembersCount() + " members)" 
       : "! no group loaded"); 

     return group; 
    } 

    protected Members listGroupMembers(Directory directory, Group group) throws Exception { 
     return directory.members().list(group.getEmail()).execute(); 
    } 

    protected boolean isMemberInGroup(Directory directory, Group group, String emailAddress) throws IOException { 
     boolean exists = false; 

     Members memberList = directory.members().list(group.getEmail()).execute(); 
     List<Member> members = memberList.getMembers(); 

     if (members != null) { 
      for (Member member : members) { 
       if (member.getEmail().equals(emailAddress)) { 
        exists = true; 
        break; 
       } 
      } 
     } 

     return exists; 
    } 

    protected void addMemberToGroup(Directory directory, Group group, String emailAddress) throws Exception { 
     Member member = new Member(); 
     member.setEmail(emailAddress); 

     LOGGER.debug("Attempting Insert of Member to Group: " + group != null ? group.getEmail() : "! no group loaded"); 

     directory.members().insert(group.getEmail(), member).execute(); 
    } 

    protected void removeMemberFromGroup(Directory directory, Group group, String emailAddress) throws Exception { 

     LOGGER.debug("Attempting Deletetion of Member to Group: " + group != null ? group.getEmail() : "! no group loaded"); 

     directory.members().delete(group.getEmail(), emailAddress).execute(); 
    } 

    public void addMemberToMembersList(String emailAddress) throws MailingListException { 
     addMemberToList(googleAppsAllEmailListName, emailAddress); 
    } 

    public void addMemberToCommitteeList(String emailAddress) throws MailingListException { 
     addMemberToList(googleAppsCommitteeEmailListName, emailAddress); 
    } 

    protected void addMemberToList(String listAddress, String emailAddress) throws MailingListException { 
     try { 
      Directory directory = getDirectory(); 
      Group group = getGroup(directory, listAddress); 

      if (!isMemberInGroup(directory, group, emailAddress)) { 
       addMemberToGroup(directory, group, emailAddress); 
      } 

     } catch (Exception e) { 
      LOGGER.error("Error adding member (" + emailAddress + ") to mailing list " + listAddress, e); 
      throw new MailingListException(e); 
     } 
    } 

    public void removeMemberFromMembersList(String emailAddress) throws MailingListException { 
     removeMemberFromList(googleAppsAllEmailListName, emailAddress); 
    } 

    public void removeMemberFromCommitteeList(String emailAddress) throws MailingListException { 
     removeMemberFromList(googleAppsCommitteeEmailListName, emailAddress); 
    } 

    protected void removeMemberFromList(String listAddress, String emailAddress) throws MailingListException { 
     try { 
      Directory directory = getDirectory(); 
      Group group = getGroup(directory, listAddress); 

      if (isMemberInGroup(directory, group, emailAddress)) { 
       removeMemberFromGroup(directory, group, emailAddress); 
      } 

     } catch (Exception e) { 
      LOGGER.error("Error removing member (" + emailAddress + ") from mailing list " + listAddress, e); 
      throw new MailingListException(e); 
     } 
    } 

    public void setHttpTransport(HttpTransport httpTransport) { 
     this.httpTransport = httpTransport; 
    } 

    public void setJsonFactory(JsonFactory jsonFactory) { 
     this.jsonFactory = jsonFactory; 
    } 

    public void setGoogleAppsAllEmailListName(String googleAppsAllEmailListName) { 
     this.googleAppsAllEmailListName = googleAppsAllEmailListName; 
    } 

    public void setGoogleAppsCommitteeEmailListName(String googleAppsCommitteeEmailListName) { 
     this.googleAppsCommitteeEmailListName = googleAppsCommitteeEmailListName; 
    } 
}