How to get a CustomerId (or other primary key) for a Google Apps account?

Question

When a user logs on to our Marketplace V2 app, we need to know which Google Apps account the user belongs to.

The id_token contains the 'hd' parameter (the domain name), but that's not enough, as a Google Apps account can have multiple domains.

CustomerId seems like a good primary key to match users to the correct Google Apps account. The problem is, it doesn't seem to be included in the id_token. Is there some way to figure out what the CustomerId of a user is.

The Admin SDK would be one option, but in almost all cases, calls to the Admin SDK fail with "Domain cannot use APIs". I read in a previous answer that Google automatically (re-)enables API access when an administrator installs a Marketplace app, but that can't be true because a call to the Admin SDK hardly ever works.

Does anyone have any suggestions on how to get a customerId or other primary key otherwise, or another trick to get the Admin SDK working (without having to instruct people to change their Google Apps Scurity settings, because that pretty much defeats the point of an effortless Marketplace installation).

Thanks!

Answer 1

To make the Admin SDK work after installation of your Google apps marketplace app, you must :

• add the admin SDK to your cloud project

• add the Google Apps marketplace SDK to your cloud project

• go into the configuration of the marketplace app and add the required admin SDK scope

After installation, your service account will have permission to call the Admin SDK on the domain that installed your marketplace app.

The docs state : To retrieve the customerId, use the Retrieve a user operation.

So you will need at least this scope :

• https://www.googleapis.com/auth/admin.directory.user :

  View and manage the provisioning of users on your domain

Additonally, you will need to know the email address of a adminstrator at the domain.

On a side note : I believe you can use "my_customer" as a replacement for the customer ID in API calls, at least for the admin SDK.

update : http://googleappsupdates.blogspot.be/2014/09/new-features-in-admin-sdk-custom-user.html Historically, only admins have been able to access the data in the Admin SDK. Beginning today, any user (not just admins) will now be able to call the Directory API to read the profile of any user on the domain (of course, we will respect ACLing settings and profile sharing settings).