I've created several GAE applications but failed to retrieve "Service Account Name" - there is no gserviceaccount mail on a 'Application Settings' page. My goal is to add service accounts of those applications to a list of members of the main application with edit permissions.I've tried to add account to a list of members of main project just by following pattern <appId>#appspot.gserviceaccount.com but it failed with following error "The email account you invited is not a valid Google account".My second idea was to create service account member on non-main project first following same pattern it didn't lead to an error but it has a following status "Invitation sent. Waiting for response".Have no idea how to fix it. I would greatly appreciate any help.Just for your notice: main application has billing enabled and has generated service account. Non-main applications have default version deployed and marked as "running".
Services account are always created by default when you create a new project in the Google Cloud Platform.
So there's no need for you to add them or re-create them in your project.
You may find them in the Permissions page under the main project section in the Developers' Console.
Or by using the URL https://console.developers.google.com/project/YOUR_PROJECT_NAME/permissions and using your real project name.
Older apps/projects didn't create service accounts.
Add the service account by
Going to https://console.developers.google.com/project/YOUR_PROJECT_NAME/permissions
Press Add Member
Add this email YOUR_PROJECT_NAME#appspot.gserviceaccount.com
Related
My company owns several (verified) facilities and using my company's email i can see those locations (business.google.com).
Now, my company would like to fetch the reviews in each location and present it in our company website. Before we're using the Google Place API but since it only returns the latest 5 reviews we opt to using Google My Business API to retrieve a location's complete reviews. We'd like our backend (PHP) to retrieve the reviews so using the same email I created a service account (console.developers.google.com/apis/credentials) because we don't need the end user to allow/interact anything when browsing our website.
Using postman (with my signed JWT) I have managed to get a valid access token
...that I use to retrieve the lists of accounts (mybusinessaccountmanagement.googleapis.com/v1/accounts) I could see the service account itself alone in the response.
Now, I tried calling the account locations api (mybusiness.googleapis.com/v4/accounts/{MY_ACCOUNT_ID_HERE}/locations) but it only returns and empty object response.
Can someone help me resolve this issue. Why my service account can't see the verified locations under my company's email. Is this even possible? Thank you.
Even that this is an older question - I run into the same issue calling the new Google My Business Information v1 API (getting empty results) using a service account.
It seems, that it is not recommended to use Service Accounts, I found this support article on Google: https://support.google.com/business/thread/8281160/cannot-get-access-to-gmb-locations-with-service-account-with-nodejs?hl=en
The "official" recommendation is to use OAuth.
But we finally made it using Service Account. The following steps are necessary to resolve it (at least for us it is working now):
Add a project in Google Cloud Platform
Add and enable the Account Management and Business Information API's.
Add the service account and generate a key (https://developers.google.com/identity/protocols/oauth2/service-account#creatinganaccount)
Make the Business Profile API request (you need the approval made by Google to be able to make requests against the two API's; otherwise you may run into quota exceeds as "Request per minute" is set to 0 by default). Important: It may take up to 2 weeks until, but we received the approval within about 5 days
Enable domain-wide delegation for the service account using the scope "https://www.googleapis.com/auth/business.manage". More about domain-wide-delegation: https://developers.google.com/identity/protocols/oauth2/service-account#delegatingauthority)
Add a user identity in GCP. This user also needs to be added in Google My Business for editing locations. When creating your ServiceAccountCredential object, impersonate this user.
Security concerns:
Domain-wide-delegation enables that everyone knowing/having the credentials of the service account could impersonate any person (identity) from withing GCP. At least in this case only for Business Profile API, but anyway, keep this in mind.
Also using private keys for authenticating the service account is not recommended, you should be aware to regularly change / create a new private key or there would be a solution with Identity Workload.
Hope this helps everyone facing the challenge with GMB / GCP / service accounts :-)
I'm currently trying to integrate with Azure AD using the admin consent flow.
I've set up an app in our domain, set a few permissions on it and am then navigating to the following link:
https://login.microsoftonline.com/mytestdomain.onmicrosoft.com/oauth2/authorize?client_id=12345678-1234-1234-1234-123456789012&response_type=code&redirect_uri=http://example.com/responsehandler&resource=12345678-1234-1234-1234-123456789012&prompt=admin_consent&state=12345
(Some of the values here have been swapped out for "example" values)
When I navigate there I get asked to sign in, which I do using a different test domain into which I want to import the app.
After signing in I'm shown a list of all the permissions that the app needs (which appear to be correct), I click accept but then I get the following error:
AADSTS90002: Requested tenant identifier '00000000-0000-0000-0000-000000000000' is not valid. Tenant identifiers may not be an empty GUID.
I'm not sure where this empty GUID is coming from and after some searching I can't find any reference to what might be causing it.
Daniel Camargo's comment above seems to have done the trick.
When I navigated to the login.microsoftonline.com link I was logging in with the user that created the domain.
If I log in with a test admin user that I created it works as I'd want.
I am not convinced that we had exactly the same problem, given that my case was involving a Cordova application, but I will share my scenario anyway:
I created a trial account for my proof of concept and for that I used my personal Microsoft account that I will call mypersonalaccount#outlook.com.
Thus, mypersonalaccount#outlook.com is now part of 2 directories: the outlook.com and my recently created mypersonalaccount.onmicrosoft.com.
When I was trying to authenticate in my Oauth2 application using mypersonalaccount#outlook.com I got that error. My humble guess is that the error is related to some sort of collision between the 2 accounts.
I later created a user1#mypersonalaccount.onmicrosoft.com and a guest account using my gmail account. Everything worked fine with these ones.
Was having the same problem, and the same after 1 week of work by the azure team, was solved.
My problem was being trying to log in to VSTS with AAD accounts.
I'm creating an app using ionic/angularjs using Backand as the backend service. I have it setup to use a MySQL database.
1) When I create a user through the SDK (version 1.8.2 from the CDN), the user shows up in Registered Users area but does not get a row in the 'users' table. Someone mentioned that I should have Anonymous Access set to User as they said this is a permissions issue but that did not solve the issue for me.
2) I can manually add a user through the Backand GUI and the user gets a row in the 'users' table as I would expect.
3) I can not manually delete users or rows in the 'users' table through the Backand GUI. I get an error stating that the "Delete My App User" failed to perform. You can't specify target table 'users' for update in FROM clause. I haven't modified the Security Actions at all. They're all default. Updating a user receives a similar error.
4) I created a blank app in Backand and updated my app with the new tokens and app name. I was able to login to that app using login credentials that were created on the original app but were not a part of this app. Does this mean users can access any Backand once registered with one app on the system?
Am I just really missing how 'users' registration and logins are suppose to work in Backand?
Any guidance would be appreciated. Thank you in advance.
You can read more on the Back& security concept here.
User can only access to the app he was registred into. In your case I believe the second app has anonymus access, so you have signed in to the first app and got access token, and using the anonymus header you accessed the second app.
Please use incognito window mode for the second app and then you could debug two apps.
You can also review Back& User example to play around with the security.
I was trying to create a new app instance that would be used for the admin site of a site I'm building. When I entered "myappadmin" in the Application Identifier field on the Create an Application page and clicked Check Availability, I received a "Sorry, 'myappadmin' is invalid." message. Is that a bug or a limitation? Or am I just doing something wrong?
admin is not a restricted word for AppEngine Application Identifiers. I've just tried admin-a and it worked. Just try to use a name with -.
According to this old Google Group thread, App Engine IDs share a namespace with Gmail accounts. That would explain why so many IDs cannot be used.
appids must be globally unique within google including existing appids but also email addresses. If it's not available then there is an account/appid that matches what you are trying.
I am trying to use the Google Prediction API for the first time.
I am just following the steps given in the article https://developers.google.com/appengine/articles/prediction_service_accounts.
I am getting a strange problem while executing step 2.4 in the above mentioned article.
I have followed the steps as below.
1) I have an application created in say xyz.com domain, and I have service account name of my application as "myapp#appspot.gserviceaccount.com".
2) Then I went to "Team" tab on the Google API Console, and tried to add the service account name of my application, to the project in which I have activated Prediction API and Google Cloud Storage.
While adding the serivce account to the project it gives me an error saying that
"Only users in domain xyz.com may be added to the project".
The same kind of message is also displayed on the bottom of the "Team" tab.
xyz.com is the domain in wich my application is deployed.
Could any one please help me understand why this kind of message is comming?
Are there any domain level admin settings required to add the service account to the Google Console API project?
Regards,
Nirzari
Currently, if you created a project with your Apps account, you can only add members of that same domain.
What you'll have to do is create a new project from something like xxx#gmail.com account (NOT your Apps domain account). You can then add both #appspot.gserviceaccount.com and yourself#xyz.com.
I think you can even remove xxx#gmail.com later on, once you've added yourself#xyz.com. Even activate billing for yourself#xyz.com, not xxx#gmail.com, if you need to.
Take from https://developers.google.com/appengine/docs/python/googlestorage/overview
You can modify the ACL of the bucket manually:
An alternate way to grant app access to a bucket is manually edit and set the bucket ACL and the default object ACL, using the gsutil utility:
Get the ACL for the bucket and save it to a file for editing: gsutil getacl gs://mybucket > myAcl.txt
Add the following Entry to the ACL file you just retrieved:
<Entry>
<Scope type="UserByEmail">
<EmailAddress>
your-application-id#appspot.gserviceaccount.com
</EmailAddress>
</Scope>
<Permission>
WRITE
</Permission>
</Entry>
If you are adding multiple apps to the ACL, repeat the above entry
for each app, changing only the email address to reflect each app's
service name.
Set the modified ACL on your bucket: gsutil setacl myAcl.txt gs://mybucket