The new Cloud Identity Groups API is great - now our customers can pick from their groups without needing admin roles.
However they need to know the customer ID, which afaik can only be found in the control panel.
The Admin SDK allows us to use "...the alias my_customer to represent your account's customerId..."
https://developers.google.com/admin-sdk/directory/v1/reference/users
Please can we have the same for the new API?
You can find the customer ID using the organizations.list API without needing admin roles. It's the directoryCustomerId field.
Related
I'm developing integration with Google Ads API using their Ruby gem library.
I have an approved oAuth2 account for the Ads scope with an approved developer token that allows any external user to connect with our API.
I have a Google Ads account that manages our own Ads account and two other accounts.
When I authenticate with the API and approve it, I then grab the account with
graph = get_accounts_graph()
Apps::GoogleAds::Account.get_accounts_map(graph)
This surprisingly returns just ONE Ads account, and one that belongs to a client that we manage. Our own two Ads accounts are missing.
So I tried to compare between our client's account and our own.
Under https://ads.google.com/aw/accountaccess I can clearly see we have admin rights to our two ad accounts, just like we do to the client account.
Am I missing some setting somewhere? Has anyone experienced this before?
I ran into this issue at the beginning. The sample in the API client libraries (which I'm going to assume you are using here), calls the customer service
customer_service.list_accessible_customers()
There's actually two different services for retrieving customer account IDs. The customer service only allows access to accounts that are added as direct admins on each account. This is an important distinction as manager accounts don't fall into this category.
What you need to call is the regular GoogleAdsService (not the customer service!) and put your request in the query itself..
query = "SELECT customer_client_link.client_customer FROM customer_client_link"
This will give you a list of account IDs as resource names, not accessible accounts. And you can iterate over them as usual.
Hope that helps.
I know that using the Google Cloud User Accounts API (https://developers.google.com/apis-explorer/#p/clouduseraccounts/beta/) it should be possible to enter a Project ID and obtain a list of user accounts associated with this.
Is there a GCP/Google API which does the opposite however and you can supply it with user (ID, email etc.) and it will list projects associated with this user?
I am not too familiar with GCP APIs so trial and error so far...
Thanks
The cloudresourcemanager.projects.list should be the API you're looking for: https://cloud.google.com/resource-manager/reference/rest/v1beta1/projects/list
API Explorer: https://developers.google.com/apis-explorer/#search/Resource/cloudresourcemanager/v1/cloudresourcemanager.projects.list
I've looked all over the admin console, but can't find where to add other users so that they can edit our listing. Can you please provide a URL/link to where I should navigate?
You may want to check this support page. You can:
assign pre-built roles for performing common business tasks
assign custom roles you create for your organization
assign more than one role to a user to grant all privileges in those roles
Be noted that you must be signed in as a super administrator for this task.
The user typically gets their new privileges within a few minutes. However, it can take up to 24 hours. When they sign in to their account, they arrive at the Admin console dashboard. Here they see the controls allowed by their privileges.
Hope this helps!
I think you want to navigate to this URL while logged in as the app project owner:
https://console.cloud.google.com/iam-admin/iam/project?project=(add your project ID)
And assign roles to different users or groups.
you can use group publishing on the gsuite marketplace:
Set up Group Publishing
You can share ownership of your items in Google Chrome Web Store with other developers by setting up group publishing. With group publishing, you can add developers to a Google Group, who can then act on your behalf. They'll have access to all the items you own and can make any changes to them that you can make.
https://developer.chrome.com/webstore/publish#set-up-group-publishing
(each member of the group should pay the 5$ developer fee though.)
You can configure the group from your webstore dashboard.
https://chrome.google.com/webstore/developer/dashboard
I'm trying to create a service account to use Google API's for gmail. However, I cannot find the client ID to provide domain wide access, as mentioned in https://developers.google.com/identity/protocols/OAuth2ServiceAccount .
There is a Service Account ID , but no client ID. Also, while creating a service account, it gives 2 default accounts - App engine and compute engine and there is no mention in documentation if I should be using that.
It also asks to give a service account name, unlike earlier where it used to generate the Service Account Name. Looks like documentation has not been updated to capture these changes.
Any help is appreciated.
Not sure if this is possible or if anyone has managed to do this. I have user with super admin access, with which I can create a new user for my domain. However I also want to add a couple of calenders to the created user's calendar list. When I create a user I authenticate using my super admin, but then I can't add a calendar to the user's calendar list since I am not logged in as the user. Is it possible to do this as the super admin, or do I have to logout and authenticate as the created user in order to add calendars to their list? This is the base url to which the post request is made:
https://www.googleapis.com/calendar/v3/users/me/calendarList
in the place of me could I pass in the id of the user? I couldn't find any parameter in the documentation with which I can specify the user to whose list I want to add a calender.
Thanks
Two options:
Each user much login to google calendar and share thier calendar to a single user. You can then use this account to update their calendars. Note that google has limitations to how many calendars and request you are allowed before the account goes to read-only mode.
Buy a google apps domain (5$per user per month) and create a service account at console.developers.google.com. Create a project and give it domain wide delgation at admin.google.com. In Apps engine you should be able to give access for admin to modify all users calendars.
No matter what case you choose, you also need to enable CalendarAPI at dev console site. Now with private key created from website request OAuth2 access token, where sub field is set for the users that you want to change calendar for. With returned access token use CalendarAPI to modify calendar.
Sry for bad english and short description, i'm in a hurry. /conner ;)