Email Audit API - 403 Forbidden

问题

I am trying to download a user's mailbox using the Email Audit API. I am getting a 403 Forbidden response to this code (the error occurs on the last line, the call to the UploadPublicKey method):

    var certificate = new X509Certificate2(System.Web.HttpRuntime.AppDomainAppPath + "key.p12", "notasecret", X509KeyStorageFlags.Exportable);

    ServiceAccountCredential credential = new ServiceAccountCredential(
       new ServiceAccountCredential.Initializer(serviceAccountEmail)
       {
           Scopes = new[] { "https://apps-apis.google.com/a/feeds/compliance/audit/" }
       }.FromCertificate(certificate));

    credential.RequestAccessTokenAsync(System.Threading.CancellationToken.None).Wait();
    DebugLabel.Text = credential.Token.AccessToken;

    var requestFactory = new GDataRequestFactory("My App User Agent");
    requestFactory.CustomHeaders.Add(string.Format("Authorization: Bearer {0}", credential.Token.AccessToken));

    AuditService aserv = new AuditService(strOurDomain, "GoogleMailAudit");
    aserv.RequestFactory = requestFactory;
    aserv.UploadPublicKey(strPublicKey);

I have created the service account in the Developers Console and granted the Client ID access to https://apps-apis.google.com/a/feeds/compliance/audit/ in the Admin console.

Seems to me like the account should have all the permissions it needs, yet it doesn't. Any idea what I am missing?

回答1:

OK, so I gave up on trying to make it work with a service account even though that is what Google's documentation would lead you to believe is the correct way to do it. After emailing Google support, I learned I could just use OAuth2 for the super user account that created the application on the developer's console.

So then I worked on getting an access token for offline access (a refresh token) by following the process outlined here: Youtube API single-user scenario with OAuth (uploading videos) and then taking that refresh token and using it with this code:

public static GOAuth2RequestFactory RefreshAuthenticate(){
OAuth2Parameters parameters = new OAuth2Parameters(){
    RefreshToken = "<YourRefreshToken>",
    AccessToken = "<AnyOfYourPreviousAccessTokens>",
    ClientId = "<YourClientID>",
    ClientSecret = "<YourClientSecret>",
    Scope = "https://apps-apis.google.com/a/feeds/compliance/audit/",
    AccessType = "offline",
    TokenType = "refresh"
};
OAuthUtil.RefreshAccessToken(parameters);
return new GOAuth2RequestFactory(null, "<YourApplicationName>", parameters);
}

which is code from here https://stackoverflow.com/a/23528629/5215904 (Except I changed the second to last line... for whatever reason the code shared did not work until I made that change).

So there I was finally able to get myself an access token that would allow me access to the Email Audit API. From there everything was a breeze once I stopped trying to mess around with a service account.

来源：https://stackoverflow.com/questions/31946873/email-audit-api-403-forbidden

标签

google-admin-sdk