Grouper Users - Open Discussion List

[John Gasper <>]

There maybe other issues too, but changeLog.consumer.googleapps.serviceImpersonationUser has to be a real account on the domain. This is the account that will be labelled in the logs, etc as the creator/editor.

 

Otherwise I’d double check the grants. needs to be granted admin and group settings api access.

 

-- 

John Gasper
IAM Consultant
Unicon, Inc.
PGP/GPG Key: 0xbafee3ef

 

 

From: <> on behalf of Christopher Sutherin <>
Date: Monday, April 17, 2017 at 10:59 AM
To: <>
Subject: [grouper-users] Troubles with Google provisioning

 

Hi, 

    I’ve been trying test Grouper provisioning to Google.  I’v compile the google-apps-provisioner-1.2.0 and placed it in cust/lib of the Grouper API home.  My grouper-loader.properties has the following entries:

 

# googleapps-grouper-provisioner

 

#This tells Grouper which class to invoke when running the change log consumer. It is required if using the change log consumer functionality.

changeLog.consumer.googleapps.class = edu.internet2.middleware.changelogconsumer.googleapps.GoogleAppsChangeLogConsumer

 

# You may optional override the default time that the Grouper Loader invokes the consumer.

changeLog.consumer.googleapps.quartzCron = 0 * * * * ?

 

# The Google managed domain name. (e.g. example.org)

changeLog.consumer.googleapps.domain = umbc.edu

 

#The service account email address created by Google.

changeLog.consumer.googleapps.serviceAccountEmail =

 

#The path of the PKCS12 file created and downloaded from Google. The OS account running the Grouper Loader process or full sync functionality needs to have read permissions to this file. Access to this file should be limited.

changeLog.consumer.googleapps.serviceAccountPKCS12FilePath = /opt/grouper/conf/umbc-grouper-provisioner-de039f2d97eb.p12

 

#This is the account that all actions will be made by. It needs to exists and will be the creator and modifier account associated with the Google auditing logs.

changeLog.consumer.googleapps.serviceImpersonationUser =

 

 

Our Google Apps admin said he has configured it as stated in the documentation. 

 

I receive the following error:

 

2017-04-17 13:50:59,583: [main] ERROR GoogleAppsFullSync.processMissingGroups(342) -  - Google Apps Consume 'googleapps' Full Sync - Error adding missing group (): 403 Forbidden

{

  "code" : 403,

  "errors" : [ {

    "domain" : "global",

    "message" : "Not Authorized to access this resource/api",

    "reason" : "forbidden"

  } ],

  "message" : "Not Authorized to access this resource/api"

}

 

Thanks for any help,

Chris

 

Chris Sutherin , DB/PS Admin, Business Systems 
Division of Information Technology (DoIT) 
Support Response -   http://www.umbc.edu/oit
Administration 618
Office - 410-455-3327
Email -