Identifying the owner of a secondary calendar?

107 views
Skip to first unread message

Mike Brudenell

unread,
Aug 16, 2017, 12:13:44 PM8/16/17
to GAM
Hi, all -

I might be missing something blindingly obvious, but how do I use GAM to find out the owner (or ideally the ACL) of a calendar from its Calendar ID Address: the thing that looks like an email address, usually seen in the Calendar Details tab of its settings?

I thought it would be

gam calendar <calendar email> showacl

and indeed that does work for primary calendars — eg, for me the <calendar email> would be my email address, ending with our "york.ac.uk" domain name.

However the calendar I'm trying to find out the owner and/or ACL of is a secondary calendar, created by a person and shared with others. When I use the above (working) command but change the <calendar email> to that of the secondary calendar I get this output from GAM:


ERROR: Service not applicable for this address: unknown@unknown. Please make sure service is enabled for user and run

gam user <user> check serviceaccount

for further instructions

(Apologies: I've obfuscated part of the <calendar email> in that output.)
I've checked the service account and it's fine.

I did eventually managed to find the owner by subscribing to the <calendar email> in my G Suite admin account and checking the Share this calendar tab there.

But is there a way to get the information directly using GAM?

With many thanks,
Mike B-)

--
Systems Administrator & Change Manager
IT Services, University of York, Heslington, York YO10 5DD, UK

Mike Brudenell

unread,
Aug 16, 2017, 12:28:52 PM8/16/17
to GAM
Bingo! (Sort of.)
To help others… I've found I can do this with Advanced GAM but not (so far) with regular GAM:


I'd still be interested to learn if it's possible in regular GAM; we have a few users on our helpdesk with the regular flavour, whereas I have both.

Cheers,
Mike B-)

On 16 August 2017 at 17:12, Mike Brudenell <mike.br...@york.ac.uk> wrote:
Hi, all -

I might be missing something blindingly obvious, but how do I use GAM to find out the owner (or ideally the ACL) of a calendar from its Calendar ID Address: the thing that looks like an email address, usually seen in the Calendar Details tab of its settings?

I thought it would be

gam calendar <calendar email> showacl

and indeed that does work for primary calendars — eg, for me the <calendar email> would be my email address, ending with our "york.ac.uk" domain name.

However the calendar I'm trying to find out the owner and/or ACL of is a secondary calendar, created by a person and shared with others. When I use the above (working) command but change the <calendar email> to that of the secondary calendar I get this output from GAM:


ERROR: Service not applicable for this address: unknown@unknown. Please make sure service is enabled for user and run

gam user <user> check serviceaccount

for further instructions

(Apologies: I've obfuscated part of the <calendar email> in that output.)
I've checked the service account and it's fine.

I did eventually managed to find the owner by subscribing to the <calendar email> in my G Suite admin account and checking the Share this calendar tab there.

But is there a way to get the information directly using GAM?

With many thanks,
Mike B-)

--
Systems Administrator & Change Manager
IT Services, University of York, Heslington, York YO10 5DD, UK

✉ Kevin Melillo

unread,
Aug 16, 2017, 12:29:44 PM8/16/17
to google-ap...@googlegroups.com
I just created a secondary calendar and was able to use the command successfully.  I did this with Standard GAM.  

On Wed, Aug 16, 2017 at 12:12 PM, Mike Brudenell <mike.br...@york.ac.uk> wrote:
Hi, all -

I might be missing something blindingly obvious, but how do I use GAM to find out the owner (or ideally the ACL) of a calendar from its Calendar ID Address: the thing that looks like an email address, usually seen in the Calendar Details tab of its settings?

I thought it would be

gam calendar <calendar email> showacl

and indeed that does work for primary calendars — eg, for me the <calendar email> would be my email address, ending with our "york.ac.uk" domain name.

However the calendar I'm trying to find out the owner and/or ACL of is a secondary calendar, created by a person and shared with others. When I use the above (working) command but change the <calendar email> to that of the secondary calendar I get this output from GAM:


ERROR: Service not applicable for this address: unknown@unknown. Please make sure service is enabled for user and run

gam user <user> check serviceaccount

for further instructions

(Apologies: I've obfuscated part of the <calendar email> in that output.)
I've checked the service account and it's fine.

I did eventually managed to find the owner by subscribing to the <calendar email> in my G Suite admin account and checking the Share this calendar tab there.

But is there a way to get the information directly using GAM?

With many thanks,
Mike B-)

--
Systems Administrator & Change Manager
IT Services, University of York, Heslington, York YO10 5DD, UK

--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsub...@googlegroups.com.
To post to this group, send email to google-apps-manager@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/CAPXCWasktemB_bzGAUZcXETRzquiojEEs9H79Q-YTNXuKLTBDA%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.



--
Kevin Melillo
Electronic Communications Analyst
Information Technology
445 Hoes Lane
Piscataway, NJ 08854

Phone:732-465-6609 | Mobile: 732-609-4331

Ross Scroggs

unread,
Aug 16, 2017, 12:39:31 PM8/16/17
to google-ap...@googlegroups.com
Mike,

What standard Gam version are you running?

Ross

To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsubscribe...@googlegroups.com.
--
Kevin Melillo
Electronic Communications Analyst
Information Technology
445 Hoes Lane
Piscataway, NJ 08854

Phone:732-465-6609 | Mobile: 732-609-4331

--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsub...@googlegroups.com.
To post to this group, send email to google-apps-manager@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/CAKM%3DboZaNe0orULd-o%3DGArhWXTG1UVvY52FF-Vz%2BEv%3D5_KZJQw%40mail.gmail.com.

For more options, visit https://groups.google.com/d/optout.



--

MikeB

unread,
Aug 17, 2017, 8:12:37 AM8/17/17
to GAM for G Suite
Hi, Ross -

Regular GAM is version 4.30

% gam version
Jay Lee <redacted@gmail.com>
Python 2.7.10 64-bit final
google-api-python-client 1.6.2
oauth2client 4.1.2
Darwin-16.7.0-x86_64-i386-64bit x86_64
Path: /Users/pmb1/Repositories/external/GAM/src


ERROR: Service not applicable for this address: unknown@unknown. Please make sure service is enabled for user and run
gam user <user> check serviceaccount
for further instructions

Replacing the Calendar ID Address with the email addresses of various colleagues I do get to see their ACLs. (I've tried this for primary calendars that I do have some form of access to — eg, free/busy only to our domain — and ones to which I have no personal access; in both cases I get to see the ACLs using regular GAM. It just doesn't work for secondary calendars.)


Advanced GAM is version 4.47.06

% gamadv-x version
Ross Scroggs <redacted@gmail.com>
Python 2.7.10 64-bit final
google-api-python-client 1.6.2
oauth2client 4.1.2
Darwin-16.7.0-x86_64-i386-64bit x86_64
Path: /Users/pmb1/Repositories/external/GAMADV-X/src

% gamadv-x calendar york.ac.uk_long...@group.calendar.google.com show acls

…produces the ACL listing all the readers, writers and owners of the calendar…

Cheers,
Mike B-)

MikeB

unread,
Aug 17, 2017, 8:31:25 AM8/17/17
to GAM for G Suite
In case it helps any… I'm using the same Service Account Client name for both regular and advanced GAM so both should have the same set of access rights.

====================================

% gam user redactedemail@york.ac.uk check serviceaccount
User: redactedemail@york.ac.uk
 Scope: https://mail.google.com/                                     PASS
 Scope: https://www.googleapis.com/auth/activity                     PASS
 Scope: https://www.googleapis.com/auth/calendar                     PASS
 Scope: https://www.googleapis.com/auth/drive                        PASS
 Scope: https://www.googleapis.com/auth/plus.me                      PASS

All scopes passed!
Service account 1124…9403 is fully authorized.

====================================

% gamadv-x user redactedemail@york.ac.uk check serviceaccount
User: redactedemail@york.ac.uk, Check 12 Scopes
  Scope: https://mail.google.com/                                    , Checked: PASS (1/12)
  Scope: https://sites.google.com/feeds                              , Checked: PASS (2/12)
  Scope: https://www.google.com/m8/feeds                             , Checked: PASS (3/12)
  Scope: https://www.googleapis.com/auth/activity                    , Checked: PASS (4/12)
  Scope: https://www.googleapis.com/auth/calendar                    , Checked: PASS (5/12)
  Scope: https://www.googleapis.com/auth/drive                       , Checked: PASS (6/12)
  Scope: https://www.googleapis.com/auth/gmail.settings.basic        , Checked: PASS (7/12)
  Scope: https://www.googleapis.com/auth/gmail.settings.sharing      , Checked: PASS (8/12)
  Scope: https://www.googleapis.com/auth/plus.login                  , Checked: PASS (9/12)
  Scope: https://www.googleapis.com/auth/plus.me                     , Checked: PASS (10/12)
  Scope: https://www.googleapis.com/auth/userinfo.email              , Checked: PASS (11/12)
  Scope: https://www.googleapis.com/auth/userinfo.profile            , Checked: PASS (12/12)

All scopes passed!
Service Account Client name 1124…9403 is fully authorized.

====================================

Cheers,
Mike B-)

Ross Scroggs

unread,
Aug 17, 2017, 10:58:30 AM8/17/17
to google-ap...@googlegroups.com
Mike,

My understanding is that there are two types of calendars:

Calendars not owned by users: accessed with client account (admin)

Calendars owned by users: accessed with service account


Calendar commands come in two flavors:

gam calendar <CalendarEntity> ...

gam <UserTypeEntity> <operation> calendar|calendaracl|event ...


GAM 4.30 tries to perform both types of calendar commands with service account access.

If service account access fails, it tries to revert to client access; it's the reversion that's failing in your case.

To revert to client access, GAM 4.30 tries to get the admin email address from oauth2.txt.

ERROR: Service not applicable for this address: unknown@unknown. Please make sure service is enabled for user and run

It's the unknown@unknown that shows that GAM is not successfully accessing oauth2.txt in this case.
What does gam oauth info show for GAM 4.30?


GAM 4.47.0x uses client access for commands that look like: gam calendar <CalendarEntity> ...

GAM 4.47.0x uses service account access for commands that look like: gam <UserTypeEntity> <operation> calendar|calendaracl|event ...


Ross

--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsub...@googlegroups.com.
To post to this group, send email to google-apps-manager@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/5b32b516-b9c0-43d8-a608-5600b669495b%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.



--

MikeB

unread,
Aug 17, 2017, 12:13:48 PM8/17/17
to GAM for G Suite
Many, many thanks to Ross for working with me off-list…

A "gam oauth info" revealed my oauth2.txt file didn't have my G Suite Admin email address in it, effectively making it unauthenticated. In contrast GAMADV-X did have it in.

It might have happened when I had to re-authenticate GAM after an incident messed up most/all of the clients registered in our Admin Control Panel. I likely did the "gam oauth create", entered my admin email address, to then have GAM tell me I'd already authenticated (because its old oauth2.txt file still existed) and I assumed I didn't have to do anything further.

The solution was to move the oauth2.txt file out of the way and run "gam oauth2 create" to re-authenticate. Having done that everything now works, including being able to use "gam calendar <calendarid> showacl" to see the ACL with readers, writers and owners I was stuck trying to get hold of yesterday.

Many thanks to all, and especially to Ross for his help!

Cheers,
Mike B-)

✉ Kevin Melillo

unread,
Aug 17, 2017, 12:16:21 PM8/17/17
to google-ap...@googlegroups.com
+1 for Ross!  

--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsub...@googlegroups.com.
To post to this group, send email to google-apps-manager@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/d02b116a-09db-4597-80bd-f12f2754bd60%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.



--
Reply all
Reply to author
Forward
0 new messages