GAM7 | Reauthentication is needed, please run gam oauth create

[Jonathan Nguyen]

Hello,

some team members and I are experiencing this error when running gam commands all of the sudden. After running the oauth create command and allowing the permissions, running a gam command loops back to this error:

ERROR: Not Authorized to access this resource/api

ERROR: Reauthentication is needed, please run

gam oauth create

gam.cfg file contained customer_id = my_customer and this traditionally worked. Is the value my_customer dynamically retrieved somehow? If so, this hasn't been working for some folks and myself as of this morning. I've since updated my_customer with the actual customer_id found in google admin > accounts and now i can run commands successfully. Wondering if anyone has experienced this or knows how to fix this to allow my_customer to be retrieved successfully. 

Thank you!

Jonathan

[Jay Lee]

My edu-guess is that:

1) you are selecting the Cloud Storage API scope, either because you are downloading Vault exports or because you're just selecting all/most scopes).

2) Someone recently turned on Google Cloud Session Length for you: https://support.google.com/a/answer/9368756?hl=en

Please check those and report back.

Jay

Jay Lee

--
You received this message because you are subscribed to the Google Groups "GAM for Google Workspace" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/google-apps-manager/70f5641d-f41d-4fed-a2b6-5f7f28695aefn%40googlegroups.com.

[Jonathan Nguyen]

Thank you. Will check report back. 

[Ross Scroggs]

See: https://github.com/GAM-team/GAM/wiki/Authorization

Scroll down to:

Based on your domain policies, you may have to mark GAM as a trusted app. These steps are performed after a project is created.

Verify whether the super admin you'll be using is in an OU where reauthentication is required.

Ross

----

Ross Scroggs

Ross.S...@gmail.com

To view this discussion visit https://groups.google.com/d/msgid/google-apps-manager/63154c37-50a5-471c-a70d-95b1a194c2c7n%40googlegroups.com.

[Jonathan Nguyen]

Thanks, Ross. Will have to ask our super admins. I don't have permissions to view this section. Will report back. 

Hi Jay, Cloud Storage API is not selected. Sesh length is enabled and is set for 14 days for reauth, but the issue is that when I do reauth, it just loops back after authenticating. If I add my customer_id = XXXXXXX instead of my_customer, i can run the commands just fine. 

[Jay Lee]

Got it. Delegated admins need permission to retrieve customer ID, they don't have it by default. I haven't tested in awhile but there's a customer view permission that I believe would do it.

Having said that, just put the real customer ID in gam.cfg since you have it, it saves Google the trouble of doing the lookup and solves your issue.

Jay

To view this discussion visit https://groups.google.com/d/msgid/google-apps-manager/ae893281-56d0-4358-910d-027679ace54cn%40googlegroups.com.

[Jonathan Nguyen]

Thanks Jay. That's what I did, but was trying to understand why this happened. If we don't know, all good. I'll instruct the team to go about it this way going forward.