Getting google calendar, “Service accounts cannot invite attendees without Domain-Wide Delegation of Authority.”

Question

I can create events but when add attendees it returns this error i followed google guide and every thing is done but i can't figure out what the problem

My code

<?php

require_once(APP_LIB.'google-api/vendor/autoload.php');

$client = new Google_Client();
//The json file you got after creating the service account
putenv('GOOGLE_APPLICATION_CREDENTIALS=checkup-project-298014-b11ac6f73f7b.json');
$client->useApplicationDefaultCredentials();
$client->setApplicationName("test_calendar");
$client->setScopes(Google_Service_Calendar::CALENDAR);
$client->setAccessType('offline');

$service = new Google_Service_Calendar($client);

$event = new Google_Service_Calendar_Event(array(
    'summary' => 'Test Test',
    'location' => 'Test Test',
    'description' => 'Hello world',
    'start' => array(
        'dateTime' => '2020-12-18T20:00:00+01:00',
        'timeZone' => 'America/Los_Angeles',
    ),
    'end' => array(
        'dateTime' => '2020-12-18T21:20:00+01:00',
        'timeZone' => 'America/Los_Angeles',
    ),
    'attendees' => array(
        array('email' => 'yasenabdelghany2222@gmail.com'),
    ),
));

$calendarId = 'xxxxxxxxx';
$event = $service->events->insert($calendarId, $event);

printf('Event created: %s', $event->htmlLink);

$conference = new Google_Service_Calendar_ConferenceData();
$conferenceRequest = new Google_Service_Calendar_CreateConferenceRequest();
$conferenceRequest->setRequestId('randomString123');
$conference->setCreateRequest($conferenceRequest);
$event->setConferenceData($conference);

// ['conferenceDataVersion' => 1] is required!
$event = $service->events->patch($calendarId, $event->id, $event, ['conferenceDataVersion' => 1]);

printf('<br>Conference created: %s', $event->hangoutLink);


// printf('Event created: %s\n', $createdEvent->htmlLink);

I'm using google-api-php-client

the error:

Google\Service\Exception: { "error": { "errors": [ { "domain": "calendar", "reason": "forbiddenForServiceAccounts", "message": "Service accounts cannot invite attendees without Domain-Wide Delegation of Authority." } ], "code": 403, "message": "Service accounts cannot invite attendees without Domain-Wide Delegation of Authority." } } in C:\wamp\www\bbb.portal.pfhcheckups.com\app\google-api\src\Http\REST.php on line 128

So...does your service account have Domain-Wide Delegation of Authority, or not? — ADyson, Dec 09 '20 at 14:14
@yasen its not set up properly then or you wouldnt be getting this error message — Linda Lawton - DaImTo, Dec 09 '20 at 14:16
i think this is answered[link](https://stackoverflow.com/questions/61074200/google-calendar-with-g-suite-account-insert-get-403) in the following question — Tijo John, Dec 09 '20 at 14:18
@yasen im not seeing setSubject in your code as i mentioned in my answer are you sure you posted the correct code? — Linda Lawton - DaImTo, Dec 09 '20 at 14:20
@yasen _it has Domain-Wide Delegation of Authority_ ...are you sure? Because the API says it doesn't, and I doubt it would be lying, and I doubt it has such an obvious bug. — ADyson, Dec 09 '20 at 14:26
@ADyson yes in front of service account the Domain-Wide Delegation is enabled — yasen, Dec 09 '20 at 14:29
Sorry but there must be an issue with that because the API is clearly telling you it isn't. — ADyson, Dec 09 '20 at 14:33

score 2 · Accepted Answer · answered Dec 09 '20 at 14:14

2

Service accounts cannot invite attendees without Domain-Wide Delegation of Authority

Means exactly that. Only service accounts which have had domain wide delegation set up on the Gsuite (WorkSpace) domain can invite people to events.

Ask your Gsuite admin to set up domain wide delegation to the service account. If you dont have a gsuite domain either get one or use Oauth2 to authenticate a user instead of service accounts.

If you have delegated domain-wide access to the service account and you want to impersonate a user account, specify the email address of the user account using the method setSubject:

$client->setSubject($user_to_impersonate);

answered Dec 09 '20 at 14:14

Linda Lawton - DaImTo

106,405
32
180
449

it returns that this this user don't have writer access to calndar – yasen Dec 09 '20 at 14:20
1

You need to delicate to a user in your domain who has write access to that calendar. the service account is impersonating that user so will be given the access of said user. Who is the user thats going to be managing this calendar its that user that you should be impersonating. – Linda Lawton - DaImTo Dec 09 '20 at 14:21
did you mean service account for example – yasen Dec 09 '20 at 14:24
The service account is just a dummy user, which you can grant permissions to (preauthorize). So that it has access to Pretend that it is someone else. Lets say you have a marketing manager who wants to be able to invite people to meetings. You set up the service account so that it can automatically invite people pretending that it is your marketing manager. The users getting the invites will only see it is the marketing manager. But the marketing manager needs to have write access to the calendar in order to be able to do this. So give the user write access and it should work. – Linda Lawton - DaImTo Dec 09 '20 at 14:27
Service accounts used to be able to invite users and then it would apear that the invite came from somenumberofstuff@sericeaccount.com which people didnt like, so now you can set it up so that it will come from marketingmanager@yourdomain.com – Linda Lawton - DaImTo Dec 09 '20 at 14:29
ok very nice it is working now but not sending emails to attendees do you know why – yasen Dec 09 '20 at 14:36
Did around in the issue forum last i remember that was bugged https://issuetracker.google.com/issues?q=componentid:191627%2B – Linda Lawton - DaImTo Dec 09 '20 at 14:37
can you explain more – yasen Dec 09 '20 at 14:40
There is an error service accounts done send emails with invites. Check the issue forum see if its been fixed before you spend to much time digging into it yourself. – Linda Lawton - DaImTo Dec 09 '20 at 14:52

Getting google calendar, “Service accounts cannot invite attendees without Domain-Wide Delegation of Authority.”

1 Answers1