Group as Owner or Manager Fails with 400 error

Question

When attempting to update a group as manager or owner of another group, I receive a request error:

Google.GoogleApiException: Google.Apis.Requests.RequestError
Invalid Input: memberKey [400]
Errors [
    Message[Invalid Input: memberKey] Location[ - ] Reason[invalid] Domain[global]
]

This might be a service issue as indicated at https://code.google.com/a/google.com/p/apps-api-issues/issues/detail?id=3791

Can I get an official word from Google on this? The Provisioning API definitely supported it and the API documentation suggests it's possible judging by the response in https://developers.google.com/admin-sdk/directory/v1/guides/manage-group-members#json-response_2

---

EDIT: This code demonstrates the error:

        DirectoryService service = AuthenticateService();

        // Create a group which will contain our group as owner
        var containerGroupRequest = service.Groups.Insert(new Group()
        {
            Name = "Stack Overflow Container Group",
            Email = "test_container@" + domain,
            Description = "Test Group, Please Ignore"
        });

        Group containerGroup;
        try
        {
            containerGroup = containerGroupRequest.Execute();
            Console.WriteLine("Container Group Created. Id: {0}", containerGroup.Id);
        }
        catch (Exception ex)
        {
            Console.WriteLine("Error occured creating group. Unable to continue. Exception: {0}", ex.ToString());
            return;
        }



        // Create a group to use as an owner
        var memberGroupRequest = service.Groups.Insert(new Group()
        {
            Name = "Stack Overflow Member Group",
            Email = "test_member@" + domain,
            Description = "Test Member Group, Please Ignore"
        });

        Group memberGroup;
        try
        {
            memberGroup = memberGroupRequest.Execute();
            Console.WriteLine("Member Group Created. Id: {0}", memberGroup.Id);
        }
        catch (Exception ex)
        {
            Console.WriteLine("Error occured creating group. Unable to continue. Exception: {0}", ex.ToString());
            return;
        }

        Thread.Sleep(5000); // Give some time for things to update

        // Add the member group to the container group as a member
        var memberRequest = service.Members.Insert(new Member
        {
            Email = memberGroup.Email,
            Role = "MEMBER"
        }, containerGroup.Id);

        Member member;
        try
        {
            member = memberRequest.Execute();
            Console.WriteLine("Member added to containerGroup. MemberId: {0}", member.Id);
        }
        catch (Exception ex)
        {
            Console.WriteLine("Adding member to container group failed. Error: {0}", ex.ToString());
            return;
        }

        Thread.Sleep(5000); // Give some time for things to update

        // Update the membership so the group is an owner
        member.Role = "OWNER";
        var ownerRequest = service.Members.Update(member, containerGroup.Id, member.Email);

        Member owner;
        try
        {
            owner = ownerRequest.Execute(); // <!-- This is where the 400 error occurs.
            Console.WriteLine("Member updated to be owner. MemberId: {0}", owner.Id);
        }
        catch (Exception ex)
        {
            Console.WriteLine("Updating membership to ownership failed. Error: {0}", ex.ToString());
            return;
        }

It's output:

Container Group Created. Id: 01ci93xb1y7qh7z
Member Group Created. Id: 04i7ojhp23eifv2
Member added to containerGroup. MemberId: 04i7ojhp23eifv2
Updating membership to ownership failed. Error: The service admin has thrown an exception: Google.GoogleApiException: Google.Apis.Requests.RequestError
Invalid Input: memberKey [400]
Errors [
        Message[Invalid Input: memberKey] Location[ - ] Reason[invalid] Domain[global]
]

  at Google.Apis.Requests.ClientServiceRequest`1.Execute() in c:\code\google.com\google-api-dotnet-client\default\Tools\Google.Apis.Release\bin\Debug\test\default\Src\GoogleApis\Apis\Requests\ClientServiceRequest.cs:line 96
  at GOwnerFailTest.Program.GroupTest() in d:\Repo\GSync\GOwnerFailTest\Program.cs:line 103

Answer 1

Even though the Provisioning API explicitly supported groups as other groups, the official word from support on groups as owners of other groups is:

The truth of the matter is that Directory API does not allow to set groups as owners of other groups, Provisioning API has been deprecated, and the admin console has an anomaly that still lets you assign the owner role to a group. Provisioning API did not specify you could or should assign a group as owner of other group either.

There will always be little details not specified within articles. Although, we do a great effort on improving our services and documentation, there is always the human factor.

It is very unfortunate that you depend so much on this anomaly that has been partially fixed.

Even though we have successfully been using Google Groups with over 30 schools for many years now, this change of functionality (intentional or otherwise) has meant the groups service is now unworkable for our requirements. As a result, we're in the process of migrating our mailing groups to Office 365, which does allow you to set member posting permissions through PowerShell at least.

Hopefully Google will bring out an API for configuring individual members posting permissions, which would allow us to properly permission our mailing groups programmatically.