Google API PHP - 列出用户的组

Question

我正在与 google API 作斗争。我正在创建一个网站，我想在其中读取经过身份验证的用户所属的组。

我已经阅读了有关该主题的所有内容，但许多示例都非常古老，与此同时情况发生了变化。

这是我正在测试的代码：

<?php

  require 'lib/google-api/vendor/autoload.php';

  // Creating new google client instance
  $client = new Google_Client();

  // Enter your Client ID
  $client->setClientId('***.apps.googleusercontent.com');
  // Enter your Client Secrect
  $client->setClientSecret('***');
  // Enter the Redirect URL
  $client->setRedirectUri('***');

  $client->setApplicationName("Test");
  // Adding those scopes which we want to get (email & profile Information)
  $client->addScope("email");
  $client->addScope("profile");
  $client->addScope("https://www.googleapis.com/auth/admin.directory.group.readonly");
  $client->addScope("https://www.googleapis.com/auth/admin.directory.group.member.readonly");

  if(isset($_GET['code'])){

      $token = $client->fetchAccessTokenWithAuthCode($_GET['code']);

      if(!isset($token["error"])){

          $client->setAccessToken($token['access_token']);

          // getting profile information
          $google_oauth = new Google_Service_Oauth2($client);
          $google_account_info = $google_oauth->userinfo->get();

          // Storing data into database
          $email = $google_account_info->email;
          $full_name = $google_account_info->name;

          echo $email . "<br>";

          // this is needed only if you need to perform
          // domain-wide admin actions, and this must be
          // an admin account on the domain; it is not
          // necessary in your example but provided for others
          $client->setSubject('***');

          // set the authorization configuration using the 2.0 style
          $client->setAuthConfig("***.json");

          $adminService = new Google_Service_Directory($client);

          $googleGroups = $adminService->groups->listGroups(array('domain'=>'mydomain.com'));
          $groups = $googleGroups->getGroups();

      }
}

?>

我收到以下错误

Uncaught Google_Service_Exception: {
  "error": "unauthorized_client",
  "error_description": "Client is unauthorized to retrieve access tokens using this method, or client not authorized for any of the scopes requested."
}

我已经完成了 Google Workspace 域范围的授权 (https://developers.google.com/admin-sdk/directory/v1/guides/delegation)，并且我创建了一个用户来模拟对组和用户的读取权限。

我哪里做错了？谢谢！

Answer 1

经过一些测试，我让它工作了...

首先，我需要为服务帐户授予权限，而不仅仅是要模拟的帐户。

 $client = new Google_Client();
    // Client ID
    $client->setClientId(***);
    // Client Secrect
    $client->setClientSecret(***);
    // Redirect URL
    $client->setRedirectUri('https://www.mywebsite.com');
    $client->setApplicationName('App name');
    // Scopes for group reading, profile and email info
    $client->addScope('https://www.googleapis.com/auth/admin.directory.group.readonly');
    $client->addScope('https://www.googleapis.com/auth/userinfo.email');
    $client->addScope('https://www.googleapis.com/auth/userinfo.profile');
   if(isset($_GET['code'])){

        $token = $client->fetchAccessTokenWithAuthCode($_GET['code']);

        if(!isset($token["error"])){

            $client->setAccessToken($token['access_token']);

            $google_oauth = new Google_Service_Oauth2($client);
            // User info
            $google_account_info = $google_oauth->userinfo->get();
            $email = $google_account_info->email;

            // Service account info
            $client->setAuthConfig('***.json');
            // Who i want to impersonate
            $client->setSubject('admin@website.com');

            $service = new Google_Service_Directory($client);
            // Search groups of the logged user
            $optParams = array(
              'domain' => 'mywebsite.com',
              'userKey' => $email
            );
            $googleGroups = $service->groups->listGroups($optParams);
            $groups = $googleGroups->getGroups();

就这些了:)

Google API PHP - 列出用户的组

Google API PHP - listing groups of an user

php

google-api