Admin SDK API Returning Status Code 403 - Cannot Figure Out Root of Permission Issue

[nic_mscomp]

I am automating employee offboarding (deleting Google Workspace users) by making Http callouts from Salesforce to Google Cloud Admin SDK API using a service account for authentication/authorization. 

For context, this article is essentially the entirety of the Salesforce setup procedure and majority of Google Project setup. (I've confirmed authentication/authorization using the Calendar API like in the article)

The call is made and there seems to be a permission issue on the service account side. 

HTTP Response Error: 

DEBUG | JSON RESPONSE: {
  "error": {
    "code": 403,
    "message": "Not Authorized to access this resource/api",
    "errors": [
      {
        "message": "Not Authorized to access this resource/api",
        "domain": "global",
        "reason": "forbidden"...

I have enabled the Admin SDK API and the service account is listed under credentials. 

Service account role is set to "Owner". 

I even enabled Domain-wide delegation and included the authorization scope of:

• https://www.googleapis.com/auth/admin.directory.user

as listed in the documentation.

What could I be missing here to open up authorization to use Admin SDK APIs?

[LeAnt]

Hi @nic_mscomp 

Welcome to Google Cloud Community!

Check if you have added your service account to an admin role and make sure that you have given the service account user read privileges. You can also review this Google document with instructions on how to delegate domain-wide authority to a service account.

I hope this information is helpful.

If you need further assistance, you can always file a case with our support team.

[nic_mscomp]

Can you be more specific as to which admin role and what user read privileges? When I filter by admin and user in the Grant Access Roles section, I don't find any that are obviously related to Google Workspace users or administration. We do not have access/ability to submit cases as we do not pay for the service. Your assistance here would be greatly appreciated. 

[nic_mscomp]

I created a new service account and key and came up with the same results. Domain-wide delegation does not resolve this either. 

[nic_mscomp · Accepted solution]

I found the root issue. In order to use the Admin SDK API, the service account must impersonate an administrator of the domain. Domain-wide delegation is not enough to interacted with Admin SDK API.

To implement this, you must include the email address of an admin of your domain in the JWT subject, in addition to audience, issuer, and scope. (JSON Claims Set in a JSON Web Token (JWT))

Endpoint:  
https://admin.googleapis.com/admin/directory/v1
 
Issuer:
Google Service account:
xxx@xxx.iam.gserviceaccount.com
 
Audience Claim:
https://www.googleapis.com/oauth2/v4/token
 
Subject:
Domain administrator email address
 
Obviously provide the correct certificate/key produced for service account authorization as well.
 
NOTE: No additional permissions are required to be added to the service account in the GCP console. Simply enable the API. In my case I set the service account role to owner.