GAM - critical issue - cannot set FWD address - ERROR: 400: Invalid forwarding address - failedPreco

2,130 views
Skip to first unread message

Jan Jurčík

unread,
Jun 9, 2017, 3:54:16 PM6/9/17
to GAM for G Suite
Hello,
during setting FWD address in one Google Suite domain for another Google Suite domain,
we used these 2 GAM commands:

gam user us...@domain1.com add forwardingaddress us...@domain2.com
gam user us...@domain1.com forward on us...@domain2.com delete

First command went OK, but the second ended with error:
ERROR: 400: Invalid forwarding address - failedPrecondition


Unfortunately, downloading new GAM (gam-4.22-windows-x64.zip), + configuring it via the setup (configured properly), did not help to solve this issue.
 Scope: https://mail.google.com/                                     PASS
 Scope: https://www.googleapis.com/auth/activity                     PASS
 Scope: https://www.googleapis.com/auth/calendar                     PASS
 Scope: https://www.googleapis.com/auth/drive                        PASS
 Scope: https://www.googleapis.com/auth/plus.me                      PASS

I especially checked in Security Advanced settings this API:
https://www.googleapis.com/auth/gmail.settings.sharing - it is allowed.

We also tried to use older GAM (GAM 3.21), but it ended with this, although some time ago is was working properly (was properly authenticated):

Select the authorized scopes for this token. Include a 'r' to grant read-only
access or an 'a' to grant action-only access.

[*]  0)  Group Directory API (supports read-only)
[*]  1)  Organizational Unit Directory API (supports read-only)
[*]  2)  User Directory API (supports read-only)
[*]  3)  Chrome OS Device Directory API (supports read-only)
[*]  4)  Mobile Device Directory API (supports read-only and action)
[*]  5)  User Email Settings API
[*]  6)  Calendar Resources API
[*]  7)  Audit Monitors, Activity and Mailbox Exports API
[*]  8)  Admin Settings API
[*]  9)  Groups Settings API
[*] 10)  Calendar Data API (supports read-only)
[*] 11)  Audit Reports API
[*] 12)  Usage Reports API
[*] 13)  Drive API (create report documents for admin user only)
[*] 14)  License Manager API
[*] 15)  User Security Directory API
[*] 16)  Notifications Directory API
[*] 17)  Site Verification API
(*) 18)  IMAP/SMTP Access (send notifications to admin)

     19)  Select all scopes
     20)  Unselect all scopes
     21)  Continue
21
Traceback (most recent call last):
  File "gam.py", line 7080, in <module>
  File "gam.py", line 5125, in doGetDomainInfo
  File "gam.py", line 513, in buildGAPIObject
  File "gam.py", line 6935, in doRequestOAuth
  File "oauth2client\util.pyo", line 132, in positional_wrapper
  File "oauth2client\tools.pyo", line 191, in run_flow
  File "oauth2client\util.pyo", line 132, in positional_wrapper
  File "apiclient\http.pyo", line 723, in execute
apiclient.errors.HttpError: <HttpError 403 when requesting https://www.googleapis.com/urlshortener/v1/url?alt=json retur
ned "Daily Limit for Unauthenticated Use Exceeded. Continued use requires signup.">

Please could anyone of you give me an advice, how to get FWD setting working properly? It is related to a migration project which is now stopped
just because of this problem. Thank you!

//BR Jan Jurcik

Michel Fasen

unread,
Jun 9, 2017, 4:38:42 PM6/9/17
to GAM for G Suite
You cannot add a forwarding address that's outside your own Google environment. See the GAM wiki for more specific info, especially the link to this blog post.

Michel

Michel Fasen

unread,
Jun 9, 2017, 4:46:30 PM6/9/17
to GAM for G Suite
In addition, if you're migrating to another system then a split (or dual delivery) setup probably makes more sense: https://support.google.com/a/answer/2685650?hl=en. You can do this on OU level to limit it to a number of people.

Michel

On Friday, 9 June 2017 20:54:16 UTC+1, Jan Jurčík wrote:

Ian Crew

unread,
Jun 9, 2017, 4:47:28 PM6/9/17
to 'Jordan Tinsley' via GAM for G Suite
Hi Michel:

Actually, as of last July, the Gmail API does allow you to set forwards to external addresses--see https://gsuite-developers.googleblog.com/2016/07/gmail-api-new-endpoints-for-settings.html for details. Note that the owner of the destination address will need to confirm the forwarding before it takes effect, though.

The specifics about how it works are in the API docs:

As to whether GAM supports it, I'm not sure (I haven't tried), but I imagine it would, as that API change was made a while back.

Cheers,

Ian



--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsub...@googlegroups.com.
To post to this group, send email to google-apps-manager@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/450828a6-e693-4c24-81d3-1be55607eeb5%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.



--
___
Ian Crew

IST-Architecture, Platforms and Integration (API)
Earl Warren Hall, Second Floor
University of California, Berkeley

Ross Scroggs

unread,
Jun 9, 2017, 5:23:07 PM6/9/17
to google-ap...@googlegroups.com
Jan,

1) gam user us...@domain1.com add forwardingaddress user1@domain2.com
2) gam user us...@domain1.com forward on us...@domain2.com delete

Step 2 will fail until us...@domain2.com confirms that he is willing to take the forwarded email.

$ gam user testuser1 show forwardingaddresses

User: test...@domain1.com, Show 3 Forwarding Addresses

  Forwarding Address: test...@domain1.com, Verification Status: accepted (1/3)

  Forwarding Address: test...@domain1.com, Verification Status: accepted (2/3)

  Forwarding Address: test...@domain1.com, Verification Status: accepted (3/3)

$ gam user testuser1 add forwardingaddresses test...@domain2.com

User: test...@domain1.com, Add 1 Forwarding Address

  User: test...@domain1.com, Forwarding Address: test...@domain2.com, Added

$ gam user testuser1 show forwardingaddresses

User: test...@domain1.com, Show 4 Forwarding Addresses

  Forwarding Address: test...@domain2.com, Verification Status: pending (1/4)

  Forwarding Address: test...@domain1.com, Verification Status: accepted (2/4)

  Forwarding Address: test...@domain1.com, Verification Status: accepted (3/4)

  Forwarding Address: test...@domain1.com, Verification Status: accepted (4/4)

$ gam user testuser1 forward on test...@domain2.com keep

User: test...@domain1.com, Forward Enabled: True, Forwarding Address: test...@domain2.com, Action: leaveInInbox (1/1)


ERROR: 400: Invalid forwarding address - failedPrecondition


test...@domain2.com confirms


$ gam user testuser1 show forwardingaddresses

User: test...@domain1.com, Show 4 Forwarding Addresses

  Forwarding Address: test...@domain2.com, Verification Status: accepted (1/4)

  Forwarding Address: test...@domain1.com, Verification Status: accepted (2/4)

  Forwarding Address: test...@domain1.com, Verification Status: accepted (3/4)

  Forwarding Address: test...@domain1.com, Verification Status: accepted (4/4)

$ gam user testuser1 forward on test...@domain2.com keep

User: test...@domain1.com, Forward Enabled: True, Forwarding Address: test...@domain2.com, Action: leaveInInbox (1/1)

$


Ross




To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsubscribe...@googlegroups.com.

To post to this group, send email to google-apps-manager@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.
--
___
Ian Crew

IST-Architecture, Platforms and Integration (API)
Earl Warren Hall, Second Floor
University of California, Berkeley

--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsub...@googlegroups.com.
To post to this group, send email to google-apps-manager@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/CAD2sLFun12%3DTgh-7TrpDkrhDdzh2E32-4Cbx2S7CDQTXosu6cg%40mail.gmail.com.

For more options, visit https://groups.google.com/d/optout.



--

Jan Jurčík

unread,
Jun 9, 2017, 6:14:15 PM6/9/17
to google-ap...@googlegroups.com
Hello Michel, Ian and Ross.
Thank you for your quick replies and useful links!

@Michel:
Unfortunately, split or dual delivery cannot be used in this migration case.

@Ian:
End-user confirmation of the forwarding address is what we must avoid.
This was the reason why we set it via cmdline/GAM.

@Ross:
Thanks for the practical example - I fully understand. However, end-user
confirmation is not what we are allowed to do.

Note: The case is the heavier, that the model is like this:
user...@domain1.com FWD to user...@domain2.com
user...@domain1.eu FWD to user...@domain2.com
etc.

So there is no clear pattern which might be used in Google Routing.
This is also gthe reason why we decided to use particular FWDs.
And I am talking about > 500 such mailboxes.

Anyway, I really appreciate your kind and quick will to help!
Thanks again.

I think we will finally use something like adding missing aliases this
way in domain2.com:

PRIMARY: user...@domain2.com
alias: user...@domain2.com

PRIMARY: user...@domain2.com
alias: user...@domain2.eu

etc.

+ Google Routing in domain1.com for Inbound and Internally received messages
to FWD them to "existing-name"@domain2.com

This should be possible.

Take care guys!

//BR Jan


On 6/9/17, Ross Scroggs <ross.s...@gmail.com> wrote:
> Jan,
>
> *1) gam user us...@domain1.com <us...@domain1.com> add
> forwardingaddress us...@domain2.com <us...@domain2.com>*
> *2) gam user us...@domain1.com <us...@domain1.com> forward
> on us...@domain2.com <us...@domain2.com> delete*
>>> <https://github.com/jay0lee/GAM/wiki/ExamplesEmailSettings#forwarding>
>>> for more specific info, especially the link to this blog post
>>> <https://gsuiteupdates.googleblog.com/2010/05/gmail-now-requires-verification-of.html>
>>> .
>>>
>>> Michel
>>>
>>> On Friday, 9 June 2017 20:54:16 UTC+1, Jan Jurčík wrote:
>>>>
>>>> Hello,
>>>> during setting FWD address in one Google Suite domain for another
>>>> Google
>>>> Suite domain,
>>>> we used these 2 GAM commands:
>>>>
>>>> *gam user us...@domain1.com add forwardingaddress us...@domain2.com*
>>>> *gam user us...@domain1.com forward on us...@domain2.com delete*
>>>>
>>>> First command went OK, but the second ended with error:
>>>> *ERROR: 400: Invalid forwarding address - failedPrecondition*
>>>>
>>>> We Googled the error and found this article:
>>>> *https://stackoverflow.com/questions/29327846/gmail-rest-api-400-bad-request-failed-precondition
>>>> <https://stackoverflow.com/questions/29327846/gmail-rest-api-400-bad-request-failed-precondition>*
>>>>
>>>> Unfortunately, downloading new GAM (gam-4.22-windows-x64.zip), +
>>>> configuring it via the setup (configured properly), did not help to
>>>> solve
>>>> this issue.
>>>> Scope: https://mail.google.com/
>>>> PASS
>>>> Scope: https://www.googleapis.com/auth/activity
>>>> PASS
>>>> Scope: https://www.googleapis.com/auth/calendar
>>>> PASS
>>>> Scope: https://www.googleapis.com/auth/drive
>>>> PASS
>>>> Scope: https://www.googleapis.com/auth/gmail.settings.basic
>>>> PASS
>>>> Scope: https://www.googleapis.com/auth/gmail.settings.sharing
>>>> PASS
>>>> Scope: https://www.googleapis.com/auth/plus.me
>>>> PASS
>>>>
>>>> I especially checked in Security Advanced settings this API:
>>>> https://www.googleapis.com/auth/gmail.settings.sharing - it is allowed.
>>>>
>>>> We also tried to use older GAM (GAM 3.21), but it ended with this,
>>>> although some time ago is was working properly (was properly
>>>> authenticated):
>>>>
>>>> *Select the authorized scopes for this token. Include a 'r' to grant
>>>> read-only*
>>>> *access or an 'a' to grant action-only access.*
>>>>
>>>> *[*] 0) Group Directory API (supports read-only)*
>>>> *[*] 1) Organizational Unit Directory API (supports read-only)*
>>>> *[*] 2) User Directory API (supports read-only)*
>>>> *[*] 3) Chrome OS Device Directory API (supports read-only)*
>>>> *[*] 4) Mobile Device Directory API (supports read-only and action)*
>>>> *[*] 5) User Email Settings API*
>>>> *[*] 6) Calendar Resources API*
>>>> *[*] 7) Audit Monitors, Activity and Mailbox Exports API*
>>>> *[*] 8) Admin Settings API*
>>>> *[*] 9) Groups Settings API*
>>>> *[*] 10) Calendar Data API (supports read-only)*
>>>> *[*] 11) Audit Reports API*
>>>> *[*] 12) Usage Reports API*
>>>> *[*] 13) Drive API (create report documents for admin user only)*
>>>> *[*] 14) License Manager API*
>>>> *[*] 15) User Security Directory API*
>>>> *[*] 16) Notifications Directory API*
>>>> *[*] 17) Site Verification API*
>>>> *(*) 18) IMAP/SMTP Access (send notifications to admin)*
>>>>
>>>> * 19) Select all scopes*
>>>> * 20) Unselect all scopes*
>>>> * 21) Continue*
>>>> *21*
>>>> *Traceback (most recent call last):*
>>>> * File "gam.py", line 7080, in <module>*
>>>> * File "gam.py", line 5125, in doGetDomainInfo*
>>>> * File "gam.py", line 513, in buildGAPIObject*
>>>> * File "gam.py", line 6935, in doRequestOAuth*
>>>> * File "oauth2client\util.pyo", line 132, in positional_wrapper*
>>>> * File "oauth2client\tools.pyo", line 191, in run_flow*
>>>> * File "oauth2client\util.pyo", line 132, in positional_wrapper*
>>>> * File "apiclient\http.pyo", line 723, in execute*
>>>> *apiclient.errors.HttpError: <HttpError 403 when
>>>> requesting https://www.googleapis.com/urlshortener/v1/url?alt=json
>>>> <https://www.googleapis.com/urlshortener/v1/url?alt=json> retur*
>>>> *ned "Daily Limit for Unauthenticated Use Exceeded. Continued use
>>>> requires signup.">*
>>>>
>>>> *Please could anyone of you give me an advice, how to get FWD setting
>>>> working properly? It is related to a migration project which is now
>>>> stopped*
>>>> *just because of this problem. **Thank you!*
>>>>
>>>> *//BR Jan Jurcik*
>>>>
>>> --
>>> You received this message because you are subscribed to the Google
>>> Groups
>>> "GAM for G Suite" group.
>>> To unsubscribe from this group and stop receiving emails from it, send
>>> an
>>> email to google-apps-man...@googlegroups.com.
>>> To post to this group, send email to
>>> google-ap...@googlegroups.com
>>> .
>>> Visit this group at https://groups.google.com/group/google-apps-manager.
>>> To view this discussion on the web visit https://groups.google.com/d/ms
>>> gid/google-apps-manager/450828a6-e693-4c24-81d3-1be55607eeb5
>>> %40googlegroups.com
>>> <https://groups.google.com/d/msgid/google-apps-manager/450828a6-e693-4c24-81d3-1be55607eeb5%40googlegroups.com?utm_medium=email&utm_source=footer>
>>> .
>>>
>>> For more options, visit https://groups.google.com/d/optout.
>>>
>>
>>
>>
>> --
>> ___
>> Ian Crew
>>
>> IST-Architecture, Platforms and Integration (API)
>> Earl Warren Hall, Second Floor
>> University of California, Berkeley
>>
>> --
>> You received this message because you are subscribed to the Google Groups
>> "GAM for G Suite" group.
>> To unsubscribe from this group and stop receiving emails from it, send an
>> email to google-apps-man...@googlegroups.com.
>> To post to this group, send email to
>> google-ap...@googlegroups.com.
>> Visit this group at https://groups.google.com/group/google-apps-manager.
>> To view this discussion on the web visit https://groups.google.com/d/
>> msgid/google-apps-manager/CAD2sLFun12%3DTgh-7TrpDkrhDdzh2E32-
>> 4Cbx2S7CDQTXosu6cg%40mail.gmail.com
>> <https://groups.google.com/d/msgid/google-apps-manager/CAD2sLFun12%3DTgh-7TrpDkrhDdzh2E32-4Cbx2S7CDQTXosu6cg%40mail.gmail.com?utm_medium=email&utm_source=footer>
>> .
>>
>> For more options, visit https://groups.google.com/d/optout.
>>
>
>
>
> --
> Ross Scroggs
> ross.s...@gmail.com
>
> --
> You received this message because you are subscribed to a topic in the
> Google Groups "GAM for G Suite" group.
> To unsubscribe from this topic, visit
> https://groups.google.com/d/topic/google-apps-manager/-TnjjFLxEeo/unsubscribe.
> To unsubscribe from this group and all its topics, send an email to
> google-apps-man...@googlegroups.com.
> To post to this group, send email to google-ap...@googlegroups.com.
> Visit this group at https://groups.google.com/group/google-apps-manager.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/google-apps-manager/CAJkvRS_ZdVr73%3D_rDajo%3Dvk6%3D6Q0OcBWSW%3D4pHXH8JUhUjQyXg%40mail.gmail.com.

k.melillo

unread,
Jun 12, 2017, 8:28:11 AM6/12/17
to GAM for G Suite
Good morning,
If you need forwarding for one domain to another domain there are Google Partners that have this service in place.  Basically, for the length of the migration project you would change your MX records to point domainA.com to the server specified by the Google partner.  Any email coming into use...@domainA.com could be redirected to use...@domainB.com or use...@domainB.com.  Once all the migrations are completed, and users are live in the new domain, you could deprovision the old domain (to move as a secondary under the new instance) or just leave it as is. 

If you would like more information on a Google Partner that supports this functionality, reach out, and I can put you in touch.

Thanks.

Austin Showalter

unread,
Oct 15, 2018, 2:20:43 PM10/15/18
to GAM for G Suite
Ross,
Is this scenario also the case when setting forwarding for two users in the same domain?

In the web UI I'm able to setup forwarding for two users in the same domain without verification.  However when using GAM I reproduce the exact same scenario that you did here (pending until verification is accepted), the only difference being that my two users are in the same domain.  I'd like to be able to set forwarding via GAM without verification, is this possible?


On Friday, June 9, 2017 at 5:23:07 PM UTC-4, Ross Scroggs wrote:
Jan,

1) gam user us...@domain1.com add forwardingaddress us...@domain2.com
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsub...@googlegroups.com.
To post to this group, send email to google-ap...@googlegroups.com.
--
___
Ian Crew

IST-Architecture, Platforms and Integration (API)
Earl Warren Hall, Second Floor
University of California, Berkeley

--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsub...@googlegroups.com.
To post to this group, send email to google-ap...@googlegroups.com.



--

Austin Showalter

unread,
Oct 19, 2018, 10:58:53 AM10/19/18
to GAM for G Suite
It appears that my issue was related to propagation.  My OUs had been created for a number of days but the users I was testing with were created within minutes.  I just had another scenario where email delegation wasn't working for a few recently created users.  Google support suggested a propagation issue, and it turns out they were right.  I tried again in a few hours and the issue was resolved.
Reply all
Reply to author
Forward
0 new messages