Directory API: delete member API operation fails for non-Google accounts

Question

We are noticing that group members cannot be removed using the new Directory API if they are not Google accounts. We've tested this with both Dito GAM (note I am the author of GAM) and the Google API Explorer.

The operation functions correctly if the member to be removed is a Google account:

C:\gam-64>gam update group group99@jay.powerposters.org remove google-user@jay.powerposters.org
 removing google-user@jay.powerposters.org
connect: (www.googleapis.com, 443)
send: 'DELETE /admin/directory/v1/groups/group99@jay.powerposters.org/members/google-user@jay.powerposters.org?quotaUser=1ee51612c9a0220af0cf5516a990b206e2a619e8&prettyPrint=true
HTTP/1.1
Host: www.googleapis.com
content-length: 0
authorization: Bearer <valid access token>
accept-encoding: gzip, deflate
accept: */*
user-agent: Dito GAM 3.01 / jay@ditoweb.com (Jay Lee) / Python 2.7.5 final / Windows-7-6.1.7601-SP1 AMD64 / google-api-python-client/1.2 (gzip)

reply: 'HTTP/1.1 204 No Content
header: Cache-Control: no-cache, no-store, max-age=0, must-revalidate
header: Pragma: no-cache
header: Expires: Fri, 01 Jan 1990 00:00:00 GMT
header: Date: Wed, 28 Aug 2013 12:57:06 GMT
header: ETag: "cZnI-gy4eI-n1-_cqk7okAteLZk/vyGp6PvFo4RvsFtPoIWeCReyIC8"
header: Server: GSE

this is the expected behavior. However, if the account to be removed is not a Google Account (Google Apps or consumer), an error is returned:

C:\gam-64>gam update group group99@jay.powerposters.org remove not-a-google-account@not-a-google-domain.com
 removing not-a-google-account@not-a-google-domain.com
connect: (www.googleapis.com, 443)
send: 'DELETE /admin/directory/v1/groups/group99@jay.powerposters.org/members/not-a-google-account@not-a-google-domain.com?quotaUser=1ee51612c9a0220af0cf5516a990b206e2a619e8&prettyPrint=true
HTTP/1.1
Host: www.googleapis.com\r\ncontent-length: 0
authorization: Bearer <valid oauth 2.0 token>
accept-encoding: gzip, deflate
accept: */*
user-agent: Dito GAM 3.01 / jay@ditoweb.com (Jay Lee) / Python 2.7.5 final / Windows-7-6.1.7601-SP1 AMD64 / google-api-python-client/1.2 (gzip)
reply: 'HTTP/1.1 400 Bad Request
header: Content-Type: application/json; charset=UTF-8
header: Content-Encoding: gzip
header: Date: Wed, 28 Aug 2013 13:00:02 GMT
header: Expires: Wed, 28 Aug 2013 13:00:02 GMT
header: Cache-Control: private, max-age=0
header: X-Content-Type-Options: nosniff
header: X-Frame-Options: SAMEORIGIN
header: X-XSS-Protection: 1; mode=block
header: Content-Length: 122
header: Server: GSE

body: {
 "error": {
  "errors": [
   {
    "domain": "global",
    "reason": "badRequest",
    "message": "Bad Request"
   }
  ],
  "code": 400,
  "message": "Bad Request"
 }
}

Error 400: Bad Request - badRequest

Note that this same behavior shows in the Google API Explorer also:

http://screencast.com/t/fQZCnMYYs

https://developers.google.com/apis-explorer/#s/admin/directory_v1/directory.members.delete?groupKey=group99%2540jay.powerposters.org&memberKey=not-a-google-account%2540not-a-google-domain.com&_h=1&

It should be possible to remove ANY address from a Google Group via the Directory API

I can reproduce your problem and I've identified a possible cause for it. We are working on fixing it and I'll let you know when the issue is fixed. Thanks! — Silvano, Aug 29 '13 at 23:25

Scott Johnson · Answer 1 · 2013-10-04T18:25:04.933

I spoke with Google Enterprise support about this and they acknowledged this was a bug (as Silvano has here). After speaking with the dev team, they told me that a work around for this is to delete using the ID of the user instead of email address.

A quick example of how you can delete all members using member ids.

Directory directory = 
    new Directory.Builder(httpTransport, jsonFactory, credentials)
                 .setApplicationName(APPLICATION_NAME)
                 .build(); 
Members members = directory.members().list(groupKey).execute();
for(Member member : members.getMembers()) {
    String memberId = member.getId();
    Delete delete = directory.members().delete(groupKey, memberId);
    delete.execute();
}

Hope this helps until they can release a fix.

score 1 · Accepted Answer · answered Dec 16 '13 at 21:26

1

Google has resolved this issue on their end. Removing non-Google email addresses from a Google Group now works without issue.

answered Dec 16 '13 at 21:26

Jay Lee

13,415
3
28
59

score 0 · Answer 3 · answered Oct 14 '13 at 18:46

Here is a working example in PHP with Add and Delete.

function gmail_provision($email, $email_list, $requested_operation) {
  // requested_operation should be either add or delete

  require_once "google-api-php-client/src/Google_Client.php";
  require_once "google-api-php-client/src/contrib/Google_DirectoryService.php";
  require_once "google-api-php-client/src/contrib/Google_Oauth2Service.php";
  session_start();

  $group_scope = 'https://www.googleapis.com/auth/admin.directory.group';
  $service_account_email = '.....@developer.gserviceaccount.com';
  $service_account_pkcs12_file_path = '/path/to/...-privatekey.p12';
  $client_id = '......apps.googleusercontent.com';
  $adminEmail = 'admin-account@email.com;

  $key = file_get_contents($service_account_pkcs12_file_path);
  $auth = new Google_AssertionCredentials($service_account_email, array($group_scope),     $key, 'notasecret',  'http://oauth.net/grant_type/jwt/1.0/bearer', $adminEmail);
  $client = new Google_Client();
  $client->setClientId($client_id); // from API console
  $client->setApplicationName("API Project Name");
  $client->setUseObjects(true);
  $client->setAssertionCredentials($auth);

  try {
    // Adding or removing from specified list
    $sync_status = '';
    $service = new Google_DirectoryService($client);
    switch ($requested_operation) {
      case "add": // Add
        $member = new Google_Member(array('email' => $email,
                                          'kind' => 'admin#directory#member',
                                          'role' => 'MEMBER',
                                          'type' => 'USER'));
        $service->members->insert($email_list, $member);
        break;
      case "remove": // Remove
        // Users must be removed by ID not by email address
        // This is slow and should be changed when
        // Google fixes the bug and allows delete by email.

        // Get a list of email addresses in the list
        $results = $service->members->listMembers($email_list);
        // Push results into an array
        $arrResults = get_object_vars($results);

        // Recursive iterator
        $arrIt = new RecursiveIteratorIterator(new RecursiveArrayIterator($arrResults));

        // Cycle through the array searching for the email address
        foreach ($arrIt as $sub) {
          $subArray = $arrIt->getSubIterator();
          if ($subArray['email'] === $email) {
            // Store an array of the details associated
            // with the email address
            $outputArray[] = iterator_to_array($subArray);
          }
        }
        // Delete by id
        $service->members->delete($email_list, $outputArray[0]['id']);
        break;
    }
  }
  catch (Google_ServiceException $e) {
    // $e->getCode() 
    // $e->getMessage()
  }
  catch (Google_Exception $e) {
    // $e->getCode() 
    // $e->getMessage()
  }
  catch (Zend_Gdata_Gapps_ServiceException $e) {
    // $e->getCode() 
    // $e->getMessage()
  }
}

Directory API: delete member API operation fails for non-Google accounts

3 Answers3

Linked