Import_projects.py authentication

[Lance752]

Hi Lukas,
Thanks for creating and sharing this script and all of your gcp-tools it is very much appreciated. I'm getting the error below despite the client id for the service account having been granted the needed 2lo scopes in the G Suite console.

Retrieving users from Google Admin SDK Directory API...
Traceback (most recent call last):
File "C:\gcp-tools\import_projects.py", line 315, in
main()
File "C:\gcp-tools\import_projects.py", line 273, in main
users = get_domain_users(admin)
File "C:\gcp-tools\import_projects.py", line 109, in get_domain_users
users = admin.get_users()
File "C:\gcp-tools\lib\google.py", line 488, in get_users
users_list = request.execute()
File "C:\Python27\lib\site-packages\oauth2client_helpers.py", line 133, in positional_wrapper
return wrapped(*args, **kwargs)
File "C:\Python27\lib\site-packages\googleapiclient\http.py", line 836, in execute
method=str(self.method), body=self.body, headers=self.headers)
File "C:\Python27\lib\site-packages\googleapiclient\http.py", line 167, in _retry_request
resp, content = http.request(uri, method, *args, **kwargs)
File "C:\Python27\lib\site-packages\oauth2client\transport.py", line 159, in new_request
credentials._refresh(orig_request_method)
File "C:\Python27\lib\site-packages\oauth2client\client.py", line 749, in _refresh
self._do_refresh_request(http)
File "C:\Python27\lib\site-packages\oauth2client\client.py", line 819, in _do_refresh_request
raise HttpAccessTokenRefreshError(error_msg, status=resp.status)
oauth2client.client.HttpAccessTokenRefreshError: unauthorized_client: Client is unauthorized to retrieve access tokens using this method.

[lukwam]

It sounds like the service account you are using doesn't have the users scope that it needs in the G Suite domain in order to sub as a domain user. /l

…

On Fri, Mar 30, 2018 at 2:36 PM, Lance752 ***@***.***> wrote: Hi Lukas, Thanks for creating and sharing this script and all of your gcp-tools it is very much appreciated. I'm getting the error below despite the client id for the service account having been granted the needed 2lo scopes in the G Suite console. Retrieving users from Google Admin SDK Directory API... Traceback (most recent call last): File "C:\gcp-tools\import_projects.py", line 315, in main() File "C:\gcp-tools\import_projects.py", line 273, in main users = get_domain_users(admin) File "C:\gcp-tools\import_projects.py", line 109, in get_domain_users users = admin.get_users() File "C:\gcp-tools\lib\google.py", line 488, in get_users users_list = request.execute() File "C:\Python27\lib\site-packages\oauth2client_helpers.py", line 133, in positional_wrapper return wrapped(*args, **kwargs) File "C:\Python27\lib\site-packages\googleapiclient\http.py", line 836, in execute method=str(self.method), body=self.body, headers=self.headers) File "C:\Python27\lib\site-packages\googleapiclient\http.py", line 167, in _retry_request resp, content = http.request(uri, method, *args, **kwargs) File "C:\Python27\lib\site-packages\oauth2client\transport.py", line 159, in new_request credentials._refresh(orig_request_method) File "C:\Python27\lib\site-packages\oauth2client\client.py", line 749, in _refresh self._do_refresh_request(http) File "C:\Python27\lib\site-packages\oauth2client\client.py", line 819, in _do_refresh_request raise HttpAccessTokenRefreshError(error_msg, status=resp.status) oauth2client.client.HttpAccessTokenRefreshError: unauthorized_client: Client is unauthorized to retrieve access tokens using this method. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#3>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABrwKoBC1wmWMQI8kTb_mhvxxMy-Br3Cks5tjns6gaJpZM4TCAHY> .

-- *Lukas Karlsson, Cloud Architect / Developer Advocate* <http://www.broadinstitute.org/> Broad Institute of MIT and Harvard 75 Ames Street, 11129, Cambridge, Massachusetts 02142 [email protected], +1.6177147142

[Lance752]

hmm I gave it https://www.google.apis.com/auth/admin.directory.user, https://www.google.apis.com/auth/cloud-platform in the G Suite console from your article and double checked DwD was enabled. Am I missing a scope?