GAM returns ERROR: Service not applicable for this address:

6,667 views
Skip to first unread message

Cristian Lovin

unread,
Oct 19, 2016, 7:25:58 PM10/19/16
to GAM for G Suite

Hello,

I'm using GAM version 3.71 in Windows, and I'm running a simple command to show the calendars a user has listed.

gam user user@...werwer.com show calendars

I get 

ERROR: Service not applicable for this address: user@...werwer.com

The same thing returns for the following cmd:

C:\GAM>gam all users show calendars
Getting all users in Google Apps account (may take some time on a large account)...
Got 39 users...
done getting 36 users.

ERROR: Service not applicable for this address: user@...werwer.com

If I run the command on other users, the others work just fine...

I'm a super admin in the domain.
One domain for this Google Account.
All services are turned ON for this user, and the user is active in domain.

Any thoughts on what might be happening?

Thank you,
C

Ross Scroggs

unread,
Oct 19, 2016, 7:45:26 PM10/19/16
to google-ap...@googlegroups.com
Christian,

Do these work?
gam user user@...werwer.com show gmailprofile
gam user user@...werwer.com show drivesettings

Ross

--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsub...@googlegroups.com.
To post to this group, send email to google-apps-manager@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/11deb632-0c8d-47c1-85ff-ac10773c2bae%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.



--

Cristian Lovin

unread,
Oct 19, 2016, 8:30:33 PM10/19/16
to GAM for G Suite
Ross, nope, they do not work.

for the first one I get
User: us...@domain.com, Service not applicable/Does not exist (1/1)

and for the second one it just says Does not exist
To post to this group, send email to google-ap...@googlegroups.com.



--

Cristian Lovin

unread,
Oct 19, 2016, 8:37:23 PM10/19/16
to GAM for G Suite
correction: 

the command works just fine only on my account
the command does NOT work on the other users either


Ross Scroggs

unread,
Oct 19, 2016, 8:57:42 PM10/19/16
to google-ap...@googlegroups.com
Cristian,

Do those commands work for any user other than yourself?


In the section labelled: Authorize the API scopes for use with GAM in the Admin Console
Verify that step 3 has been performed.

Ross

--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsub...@googlegroups.com.
To post to this group, send email to google-apps-manager@googlegroups.com.

Visit this group at https://groups.google.com/group/google-apps-manager.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/aea51cfa-6ca0-4542-9cdf-0799e4eb5a41%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.



--

Jay Lee

unread,
Oct 19, 2016, 10:10:13 PM10/19/16
to google-ap...@googlegroups.com

How long has Calendar been on for the user. If you just turned it on, give it 24 hours and try again.

Jay


On Wed, Oct 19, 2016, 8:57 PM Ross Scroggs <ross.s...@gmail.com> wrote:
Cristian,

Do those commands work for any user other than yourself?


In the section labelled: Authorize the API scopes for use with GAM in the Admin Console
Verify that step 3 has been performed.

Ross
On Wed, Oct 19, 2016 at 5:37 PM, 'Cristian Lovin' via GAM for G Suite <google-ap...@googlegroups.com> wrote:
correction: 

the command works just fine only on my account
the command does NOT work on the other users either


--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To post to this group, send email to google-ap...@googlegroups.com.

Visit this group at https://groups.google.com/group/google-apps-manager.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/aea51cfa-6ca0-4542-9cdf-0799e4eb5a41%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.



--

--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To post to this group, send email to google-ap...@googlegroups.com.

Visit this group at https://groups.google.com/group/google-apps-manager.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/CAJkvRS8R5DX_JivEwthZfu6k_3d1nwR0ZnkCE%3DB%2BxA_upb6ayw%40mail.gmail.com.

For more options, visit https://groups.google.com/d/optout.
--

Jay

Cristian Lovin

unread,
Oct 26, 2016, 1:58:34 PM10/26/16
to GAM for G Suite
Sorry - I've been out of town for a while

Jay,

Calendar has been ON for all users for a few years.

Ross,

It may have something to do with the service account not being authorized for this particular domain.

Question: Do I need to create projects in dev console for GAM in every single GApps domain I'll use GAM. or since it's registered with one GApps domain and just authenticated in every single domain should it work just fine?

I typically run gam oauth revoke to revoke access in current domain.
Next, if I need to work in another domain, I do gam oauth request, authorize the scopes in browser, and that's it.
I've always done it like this and never had a problem with calendar scripts.

Should the above suffice, or individual projects will have to be created for every domain I am authorizing GAM to work in?

Thanks again,
Cris



On Wednesday, October 19, 2016 at 8:10:13 PM UTC-6, Jay Lee wrote:

How long has Calendar been on for the user. If you just turned it on, give it 24 hours and try again.

Jay


On Wed, Oct 19, 2016, 8:57 PM Ross Scroggs <ross.s...@gmail.com> wrote:
Cristian,

Do those commands work for any user other than yourself?


In the section labelled: Authorize the API scopes for use with GAM in the Admin Console
Verify that step 3 has been performed.

Ross
On Wed, Oct 19, 2016 at 5:37 PM, 'Cristian Lovin' via GAM for G Suite <google-ap...@googlegroups.com> wrote:
correction: 

the command works just fine only on my account
the command does NOT work on the other users either


--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsub...@googlegroups.com.

To post to this group, send email to google-ap...@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.
--

--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsub...@googlegroups.com.
--

Jay

L C Ryan

unread,
Oct 27, 2016, 6:24:17 AM10/27/16
to GAM for G Suite
Hi folks,

I'm experiencing precisely the same problem that Cristian reports. The "show calendars" command will only work for my account, despite the fact that I am an org SA. I am confident that my OAuth tokens and other keys are correct, and all scopes have been assigned as per the GAM CreatingClientSecretsFile instructions.

I'm running this in bash on a Mac, using GAM 3.72.

With regard to the "drivesettings" troubleshooting recommendation, I ran the command and this was returned:

me$ gam user xxxx show drivesettings
Getting Drive settings for xx...@xxxx.com (1/1)
User: xx...@xxxx.com, Does not exist
email

The comma appended to the end of the email address is interesting. It happened regardless of which user's email ID I tried, or whether I passed in the user ID by itself, or the entire email address.

Any advice you'd have for further things to try would be greatly appreciated.

Cheers

Ross Scroggs

unread,
Oct 27, 2016, 8:31:18 AM10/27/16
to google-ap...@googlegroups.com
The problems you're describing are due to Service Account authorization.
Gam operates:
1) directly on objects (create/update/delete users for instance)
2) on objects that belong to a particular user (drive/calendar/email)
Your Client Account (oauth2.txt) is used for 1 and your Service Account (oauth2service.json) is used for 2.
Basically, any command that starts: gam user xxx ... is going to use your Service Account.
You create an oauth2.txt for each domain.
You create one oauth2service.json and then authorize it for each domain in the admin console.
(The comma is separating clauses in the error message, it is not relevant.)

Re-verify your Service Account authorization, that's where the problem lies.

Ross
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.

To post to this group, send email to google-ap...@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.

L C Ryan

unread,
Oct 27, 2016, 8:30:05 PM10/27/16
to GAM for G Suite
Hi Ross,

Thanks for the advice.

The service account I am using appears to be authorised, because commands like "gam user xxxx show delegates" returns correct and complete information for anyone in the org. After your suggestions, I went back and double-checked my settings, and also reauthorised the service account (I ran "gam oauth delete" and "gam oauth create" against a new service account key which I had generated) and the behaviour was the same as previously reported.

What else can I try?

Ross Scroggs

unread,
Oct 27, 2016, 10:28:58 PM10/27/16
to google-ap...@googlegroups.com
L C,

gam oauth delete and gam oauth create have nothing to do with service accounts; they deal with clients. gam user xxx show delegates uses the client account, not the service account.
You have to focus on oauth2service.json, that is where the problem lies.
Look at your oauth2service.json file, it should look something like this:
{
  "type": "service_account",
  "project_id": "gam-access",
  "private_key_id": "not so long string of stuff",
  "private_key": "-----BEGIN PRIVATE KEY-----\nvery long strong of stuff\n-----END PRIVATE KEY-----\n",
  "client_email": "<digits>-<digits and letters>@developer.gserviceaccount.com",
  "client_id": "<digits>-<digits and letters>.apps.googleusercontent.com",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
}

Does yours look like this?
At https://github.com/jay0lee/GAM/wiki/CreatingClientSecretsFile in the section labelled "Authorize the API scopes for use with GAM in the Admin Console",
step 3 authorized the Servce Account using the value for client_id above. Verify these steps.

Ross

To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.

To post to this group, send email to google-ap...@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.

Lilly Ryan

unread,
Oct 27, 2016, 11:45:16 PM10/27/16
to google-ap...@googlegroups.com
Hi Ross,

Thanks again. My oauth2service.json file looks identical to that, except for the client_id line.

The client_id value in my JSON file is just the 21-digit service account client ID. I tried modifying the file to contain the longer ID you mentioned should be there instead, and received the same response to the service account commands.

I have double-checked the scope settings and run it again just to be sure, but the behaviour remains the same.

Is there anything more you would recommend?

To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsubscri...@googlegroups.com.

To post to this group, send email to google-ap...@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.
-- 

-- 
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsubscri...@googlegroups.com.
-- 

Jay


-- 
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsubscri...@googlegroups.com.

--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsub...@googlegroups.com.
To post to this group, send email to google-apps-manager@googlegroups.com.

--
You received this message because you are subscribed to a topic in the Google Groups "GAM for G Suite" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/google-apps-manager/9o4FJWKoAiA/unsubscribe.
To unsubscribe from this group and all its topics, send an email to google-apps-manager+unsub...@googlegroups.com.
To post to this group, send email to google-apps-manager@googlegroups.com.

Visit this group at https://groups.google.com/group/google-apps-manager.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/E277C14C-78BD-41DA-87FE-6A178FA3BEC6%40gmail.com.

For more options, visit https://groups.google.com/d/optout.



--
Lilly Ryan
Technology Consultant

ThoughtWorks Australia

Ross Scroggs

unread,
Oct 28, 2016, 12:51:36 AM10/28/16
to google-ap...@googlegroups.com
Lilly,

Most people I've dealt with who have the all digits client-id seem to have trouble; you can't edit it, so put it back to all digits. Is the 21-digit key authorized in the admin console?
At https://github.com/jay0lee/GAM/wiki/CreatingClientSecretsFile in the section labelled "Authorize the API scopes for use with GAM in the Admin Console",
step 3 authorized the Servce Account using the value for client_id above. Verify these steps.

Does the following sentence refer to doing step 3 above?

I have double-checked the scope settings and run it again just to be sure, but the behaviour remains the same.

To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.

To post to this group, send email to google-ap...@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.

James Fehr

unread,
Oct 28, 2016, 11:09:47 AM10/28/16
to GAM for G Suite
thanks, I followed these instructions and everything worked, I had gotten the wrong permissions not reading the instructions through the first time. 



CLÁUSULA DE CONFIDENCIALIDAD Este mensaje y sus anexos pueden contener información confidencial, por lo que se informa de que su uso no autorizado está prohibido por la ley. Si Vd. considera que no es el destinatario pretendido por el remitente, por favor póngalo en su conocimiento por esta misma vía o por cualquier otro medio y elimine esta comunicación y los anexos de su sistema, sin copiar, remitir o revelar los contenidos del mismo a cualquier otra persona. Cualquier información, opinión, conclusión, recomendación, etc. contenida en el presente mensaje no relacionada con la actividad empresarial de UNION MISIONERA EVANGELICA y/o emitida por persona sin capacidad para ello, deberá considerarse como no proporcionada ni aprobada por el UNION MISIONERA EVANGELICA. UNION MISIONERA EVANGELICA pone los medios a su alcance para garantizar la seguridad y ausencia de errores en la correspondencia electrónica, pero no puede asegurar la inexistencia de virus o la no alteración de los documentos transmitidos electrónicamente, por lo que declina cualquier responsabilidad a este respecto.

Cristian Lovin

unread,
Nov 3, 2016, 2:58:54 PM11/3/16
to GAM for G Suite
Ross, thanks again for your help in troubleshooting this.

Everything seems to be working fine now.

Thanks again, and have a great weekend,
Cris
Reply all
Reply to author
Forward
0 new messages