GAM Errors when migrating to new server
72 views
Skip to first unread message
Eric Dannewitz
Jul 2, 2026, 12:42:38 AMJul 2
to google-ap...@googlegroups.com
Greetings all,
I'm moving my scripting/gam VM to a new VM and new python, and I'm getting this error
Regional Access Boundary HTTP request failed after retries: response_data={'error': {'code': 403, 'message': 'Permission denied on the service account.', 'status': 'PERMISSION_DENIED'}}, retryable_error=False
When running
stat1 = gam.CallGAMCommand(['gam','ou_and_children','/Students','vacation','off'])
from python 3.14
Running the command from powershell works fine. And when I run
gam user edann...@auhsdschools.org check serviceaccount
I pass all that stuff....
Ideas?
Jay Lee
Jul 2, 2026, 11:54:23 AMJul 2
to google-ap...@googlegroups.com
Where is your new VM running? AWS? GCP? Somewhere else?
Jay Lee
--
You received this message because you are subscribed to the Google Groups "GAM for Google Workspace" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/google-apps-manager/CAG-f%3DMGs4F9RDHrf39%3Dad8obsC00%3D7LM6B-Anx3ndG%3DX3fWT1A%40mail.gmail.com.
Ross Scroggs
Jul 2, 2026, 12:05:34 PMJul 2
to google-ap...@googlegroups.com
I'm getting the same error on my local server.
connect: (iamcredentials.googleapis.com, 443)
send: GET /v1/projects/-/serviceAccounts/gam-project...@gam-project-y5s-6i4-836.iam.gserviceaccount.com/allowedLocations HTTP/1.1
Host: iamcredentials.googleapis.com
authorization: Bearer *****
user-agent: Python-httplib2/0.31.2 (gzip)
accept-encoding: gzip, deflate
reply: 'HTTP/1.1 403 Forbidden\r\n'
header: Vary: Origin
header: Vary: X-Origin
header: Vary: Referer
header: Content-Type: application/json; charset=UTF-8
header: Content-Encoding: gzip
header: Date: Thu, 02 Jul 2026 16:01:49 GMT
header: Server: scaffolding on HTTPServer2
header: X-XSS-Protection: 0
header: X-Frame-Options: SAMEORIGIN
header: X-Content-Type-Options: nosniff
header: Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
header: Transfer-Encoding: chunked
Regional Access Boundary HTTP request failed after retries: response_data={'error': {'code': 403, 'message': 'Permission denied on the service account.', 'status': 'PERMISSION_DENIED'}}, retryable_error=False
Jay Lee
Jul 2, 2026, 12:12:46 PMJul 2
to google-ap...@googlegroups.com
Can someone open a GitHub issue and offer full details of their setup, what they are running, etc?
Jay Lee
To view this discussion visit https://groups.google.com/d/msgid/google-apps-manager/EA0BF3F4-E19C-43C2-B9CA-15AC78C05143%40gmail.com.
Jay Lee
Jul 2, 2026, 12:43:14 PMJul 2
to google-ap...@googlegroups.com
Jay Lee
Jul 2, 2026, 1:21:28 PMJul 2
to google-ap...@googlegroups.com
Try setting:
GOOGLE_AUTH_TRUST_BOUNDARY_ENABLED==False
GOOGLE_AUTH_TRUST_BOUNDARY_ENABLED==False
as an environment variable and see if that hushes the message.
In the meantime, I've also upgraded to a new version of google-auth library which silences the message. Should be released soon.
Jay Lee
Eric Dannewitz
Jul 2, 2026, 3:34:21 PMJul 2
to google-ap...@googlegroups.com
The previous one was running on Hyper-V locally on Windows Server 2019. The new one is running on the same Hyper-V server but running Windows 2025 Server.
Jay Lee
Jul 2, 2026, 7:08:18 PMJul 2
to Eric Dannewitz, google-ap...@googlegroups.com, Ross Scroggs
We can keep this on group so other admin can see solutions also.
You mentioned pip installing GAM but I see from that output you've also installed the binary installer?
In any case for some reason your install still has an old copy of Google Auth, it should be 2.55.1 which is what GAM 7.46.06 binary includes.
Try running:
pip install --upgrade --upgrade-strategy eager gam7
and let's see if that upgrades google-auth.
If not you may just need to uninstall the binary and pip install and start fresh.
Jay
Jay Lee
On Thu, Jul 2, 2026, 7:00 PM Eric Dannewitz <edann...@auhsdschools.org> wrote:
PS C:\users\Public\GitHub\AERIESCanvasGAM> gam version extended
GAM 7.46.06 - https://github.com/GAM-team/GAM - pyinstaller
GAM Team <google-ap...@googlegroups.com>
Python 3.14.6 64-bit final
Windows 2025Server 10.0.26100 SP0 Multiprocessor Free AMD64
Path: C:\GAM7
Config File: C:\GAM7\gam.cfg, Section: DEFAULT, customer_id: my_customer, domain:
Time: 2026-07-02T22:59:00+00:00
Your system time differs from admin.googleapis.com by less than 1 second
OpenSSL 4.0.1 9 Jun 2026
arrow 1.4.0
chardet 7.4.3
cryptography 48.0.1
filelock 3.29.4
google-api-python-client 2.197.0
google-auth-httplib2 0.4.0
google-auth-oauthlib 1.4.0
google-auth 2.54.0
lxml 6.1.1
httplib2 0.31.2
passlib 1.7.4
pathvalidate 3.3.1
pyscard 2.3.1
yubikey-manager 5.9.1
admin.googleapis.com connects using TLSv1.3 TLS_AES_256_GCM_SHA384
PS C:\users\Public\GitHub\AERIESCanvasGAM>
On Thu, Jul 2, 2026 at 3:58 PM Jay Lee <jay...@gmail.com> wrote:What's the output of:gam version extended?Jay LeeOn Thu, Jul 2, 2026, 6:57 PM Eric Dannewitz <edann...@auhsdschools.org> wrote:Same error. Running Gam 7.46.06 and did a pip install gam7
Regional Access Boundary HTTP request failed after retries: response_data={'error': {'code': 403, 'message': 'Permission denied on the service account.', 'status': 'PERMISSION_DENIED'}}, retryable_error=False
User: aaryan....@auhsdschools.org, Vacation Enabled: False (9/4328)
Regional Access Boundary HTTP request failed after retries: response_data={'error': {'code': 403, 'message': 'Permission denied on the service account.', 'status': 'PERMISSION_DENIED'}}, retryable_error=False
User: aasa.s...@auhsdschools.org, Vacation Enabled: False (10/4328)
Regional Access Boundary HTTP request failed after retries: response_data={'error': {'code': 403, 'message': 'Permission denied on the service account.', 'status': 'PERMISSION_DENIED'}}, retryable_error=False
User: abbey.t...@auhsdschools.org, Vacation Enabled: False (11/4328)
Regional Access Boundary HTTP request failed after retries: response_data={'error': {'code': 403, 'message': 'Permission denied on the service account.', 'status': 'PERMISSION_DENIED'}}, retryable_error=False
User: abby.ca...@auhsdschools.org, Vacation Enabled: False (12/4328)
Regional Access Boundary HTTP request failed after retries: response_data={'error': {'code': 403, 'message': 'Permission denied on the service account.', 'status': 'PERMISSION_DENIED'}}, retryable_error=False
Control-C
PS C:\users\Public\GitHub\AERIESCanvasGAM> gam version
GAM 7.46.06 - https://github.com/GAM-team/GAM - pyinstaller
GAM Team <google-ap...@googlegroups.com>
Python 3.14.6 64-bit final
Windows 2025Server 10.0.26100 SP0 Multiprocessor Free AMD64
Path: C:\GAM7
Config File: C:\GAM7\gam.cfg, Section: DEFAULT, customer_id: my_customer, domain:
Time: 2026-07-02T22:55:00+00:00
PS C:\users\Public\GitHub\AERIESCanvasGAM>
On Thu, Jul 2, 2026 at 3:13 PM Ross Scroggs <ross.s...@gmail.com> wrote:pip install gam7
This will update your GAM Pytn libraries
On Jul 2, 2026, at 1:44 PM, Eric Dannewitz <edann...@auhsdschools.org> wrote:Sogam ou_and_children '/Students' vacation offthat works fineIf I call it from python,stat1 = CallGAMCommand(['gam','ou_and_children','/Students','vacation','off'])like I used to do, it gives the message.Python 3.14
On Thu, Jul 2, 2026 at 1:42 PM Eric Dannewitz <edann...@auhsdschools.org> wrote:It's when I run it via Python.GOOGLE_AUTH_TRUST_BOUNDARY_ENABLED==FalseDidn't seem to help anything
On Thu, Jul 2, 2026 at 1:28 PM Eric Dannewitz <edann...@auhsdschools.org> wrote:Still get that errorUser: aaron.v...@auhsdschools.org, Vacation Enabled: False (7/4328)
Regional Access Boundary HTTP request failed after retries: response_data={'error': {'code': 403, 'message': 'Permission denied on the service account.', 'status': 'PERMISSION_DENIED'}}, retryable_error=False
On Thu, Jul 2, 2026 at 1:19 PM Ross Scroggs <ross.s...@gmail.com> wrote:7.46.06 ready
On Jul 2, 2026, at 12:35 PM, Eric Dannewitz <edann...@auhsdschools.org> wrote:To join the video meeting, click this link: https://meet.google.com/jgh-efpa-eiiOtherwise, to join by phone, dial +1 304-918-0809 and enter this PIN: 833 971 907#
To view more phone numbers, click this link: https://tel.meet/jgh-efpa-eii?hs=5
On Thu, Jul 2, 2026 at 8:08 AM Ross Scroggs <ross.s...@gmail.com> wrote:Send me a Meet/Zoom invitation.
Eric Dannewitz
Jul 2, 2026, 7:15:03 PMJul 2
to Jay Lee, google-ap...@googlegroups.com, Ross Scroggs
Ok, that seems to have fixed it. Thanks guys.
PS C:\users\Public\GitHub\AERIESCanvasGAM> gam version extended
GAM 7.46.06 - https://github.com/GAM-team/GAM - pyinstaller
GAM Team <google-ap...@googlegroups.com>
Python 3.14.6 64-bit final
Windows 2025Server 10.0.26100 SP0 Multiprocessor Free AMD64
Path: C:\GAM7
Config File: C:\GAM7\gam.cfg, Section: DEFAULT, customer_id: my_customer, domain:
GAM 7.46.06 - https://github.com/GAM-team/GAM - pyinstaller
GAM Team <google-ap...@googlegroups.com>
Python 3.14.6 64-bit final
Windows 2025Server 10.0.26100 SP0 Multiprocessor Free AMD64
Path: C:\GAM7
Config File: C:\GAM7\gam.cfg, Section: DEFAULT, customer_id: my_customer, domain:
Time: 2026-07-02T23:11:00+00:00
Your system time differs from admin.googleapis.com by less than 1 second
OpenSSL 4.0.1 9 Jun 2026
arrow 1.4.0
chardet 7.4.3
cryptography 48.0.1
filelock 3.29.4
google-api-python-client 2.197.0
google-auth-httplib2 0.4.0
google-auth-oauthlib 1.4.0
google-auth 2.54.0
lxml 6.1.1
httplib2 0.31.2
passlib 1.7.4
pathvalidate 3.3.1
pyscard 2.3.1
yubikey-manager 5.9.1
admin.googleapis.com connects using TLSv1.3 TLS_AES_256_GCM_SHA384
PS C:\users\Public\GitHub\AERIESCanvasGAM> python .\DisableStudentVacationResponder.py
Getting all Users in the Organizational Unit for /Students, may take some time on a large Organizational Unit...
Got 4328 Users in the Organizational Unit for /Students...
Got 4328 Users in the Organizational Unit for /Students
User: aadilah....@auhsdschools.org, Vacation Enabled: False (1/4328)
User: aakash.a...@auhsdschools.org, Vacation Enabled: False (2/4328)
Getting all Users in the Organizational Unit for /Students, may take some time on a large Organizational Unit...
Got 4328 Users in the Organizational Unit for /Students...
Got 4328 Users in the Organizational Unit for /Students
User: aadilah....@auhsdschools.org, Vacation Enabled: False (1/4328)
User: aakash.a...@auhsdschools.org, Vacation Enabled: False (2/4328)
Control-C
PS C:\users\Public\GitHub\AERIESCanvasGAM>
Reply all
Reply to author
Forward
0 new messages