1
service_account_mail = 'xxxxxx@developer.gserviceaccount.com'
service_account_client_id = 'xxxxxx.apps.googleusercontent.com'

with open("private_key.p12") as f:
    private_key = f.read()

gapps_scope=[
    'https://www.googleapis.com/auth/drive',
    'https://apps-apis.google.com/a/feeds/emailsettings/2.0/',
]

credentials = SignedJwtAssertionCredentials(service_account_mail, private_key, gapps_scope)

print credentials.access_token
None

credentials.get_access_token()

credentials.access_token
Now I get something useful

headers = {
    'Authorization': 'Bearer ' + credentials.access_token,
    'Content-type': 'application/atom+xml'
}

url_tpl = """https://apps-apis.google.com/a/feeds/emailsettings/2.0/mydomain.com/%s/%s"""

url = url_tpl % (myusername, 'label')
r = requests.get(url, headers=headers)
403 - 'You are not authorized to access this API.'

body_tpl = """<?xml version="1.0" encoding="utf-8"?>
<atom:entry xmlns:atom="http://www.w3.org/2005/Atom" xmlns:apps="http://schemas.google.com/apps/2006">
    <apps:property name="signature" value="%s" />
</atom:entry>"""

url = url_tpl % (myusername, 'signature')

payload = body_tpl % 'Test'
r = requests.put(url, headers=headers, data=payload)
403 - 'You are not authorized to access this API.'

r = requests.get(url, headers=headers)
403 - 'You are not authorized to access this API.'

drive_url = "https://www.googleapis.com/drive/v2/files"
headers = {  'Authorization': 'Bearer ' + credentials.access_token, }
r = requests.get(drive_url, headers=headers)
200 - 'OK'

Also tried : EmailSettingsClient + AuthSubToken, EmailSettingsClient + client.auth_token override, EmailSettingsClient + HttpRequest(headers=additional_headers), EmailSettingsClient + OAuth2TokenFromCredentials(credentials).authorize

When I use the credential.access_token of my service account directly in the OAuth 2.0 Playground in step 2, I do get the same results. That is it works for Drive but not for EmailSettings.

Could someone else confirm it works (by actually trying, please) and maybe explain what I'm doing wrong here ?

Many thanks.

ldng
  • 11
  • 1
  • You should do domain wide delegation to your service account. check this link https://developers.google.com/admin-sdk/directory/v1/guides/delegation#instantiate_an_admin_sdk_directory_service_object. – SGC Jul 30 '15 at 16:54
  • The domain wide delegation to our service account is already set. Drive would not work otherwise... – ldng Jul 31 '15 at 14:06
  • While making request, is it the admin making request or delegated admin? For email settings API only admin can make the request. – SGC Jul 31 '15 at 17:02

0 Answers0