Unhandled Exception

[Kyle Vitale]

Hi all, 

I am fairly new to GAM and have run into some trouble when trying to access calendars. When I run gam calendar [anyuser]@[mydomain].org showacl I get the following Traceback error:

Traceback (most recent call last):
  File "gam/__main__.py", line 49, in <module>
  File "gam/__main__.py", line 44, in main
  File "gam/__init__.py", line 11834, in ProcessGAMCommand
  File "gam/gapi/calendar.py", line 45, in printShowACLs
  File "gam/gapi/calendar.py", line 31, in buildCalendarDataGAPIObject
  File "gam/gapi/calendar.py", line 20, in normalizeCalendarId
  File "gam/__init__.py", line 8745, in _getValueFromOAuth
  File "gam/auth/oauth.py", line 420, in get_token_value
  File "gam/auth/oauth.py", line 402, in _fetch_id_token_data
  File "gam/auth/oauth.py", line 474, in refresh
  File "gam/auth/oauth.py", line 482, in _locked_refresh
  File "google/oauth2/credentials.py", line 302, in refresh
  File "google/oauth2/reauth.py", line 347, in refresh_grant
  File "google/oauth2/_client.py", line 62, in _handle_error_response
google.auth.exceptions.RefreshError: ('invalid_grant: Bad Request', {'error': 'invalid_grant', 'error_description': 'Bad Request'})
[70212] Failed to execute script '__main__' due to unhandled exception!

However, I am able to add/remove email delegates without issue (which is my main use for GAM). Any ideas ?

Thanks!

Kyle

[Jay Lee]

What does:

gam user <user> check serviceaccount

Show? Follow any steps it suggests.

Jay

--
You received this message because you are subscribed to the Google Groups "GAM for Google Workspace" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/873d430e-04a8-4052-ae07-174004ae5887n%40googlegroups.com.

[Kyle Vitale]

Everything passed except my key was old. It recommended running gam rotate sakey, which I did. All checks show passed now, but the calendar command still doesn't work:

Computer clock status:
 Your system time differs from admin.googleapis.com by less than 1 second   PASS
Service Account Private Key Authentication:
 Authenticating...                                                          PASS
Checking key age. Google recommends rotating keys on a routine basis...
 Key is -1 days old                                                         PASS
Domain-Wide Delegation authentication as kvi...@ma.org:
 https://mail.google.com/                                                   PASS
 https://www.googleapis.com/auth/apps.alerts                                PASS
 https://www.googleapis.com/auth/calendar                                   PASS
 https://www.googleapis.com/auth/cloud-identity                             PASS
 https://www.googleapis.com/auth/drive                                      PASS
 https://www.googleapis.com/auth/drive.activity                             PASS
 https://www.googleapis.com/auth/gmail.settings.basic                       PASS
 https://www.googleapis.com/auth/gmail.settings.sharing                     PASS
 https://www.googleapis.com/auth/spreadsheets                               PASS

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/CA%2BVVBp_KhADf_3HfXuGNTfhgjd9%3DrQ722_V6RpcCKP69uGtyLw%40mail.gmail.com.

--

Kyle Vitale Director of Technology 415-482-3261 kvi...@ma.org 1600 Mission Ave. San Rafael, CA, 94901 Schedule a meeting with me

[Jay Lee]

Are you sure Google Calendar service is enabled for that user? Try confirming in the Admin console.

Jay

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/CAGNp%2BqAFa%2B5FTQNXCvupXXe-oSekAKi1QeKWX6mjKngRqFpK9A%40mail.gmail.com.

[Kyle Vitale]

Yes, Google Calendar is enabled domain-wide. And that user is my, I'm the Google Admin, and I use Google Calendar everyday!

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/CA%2BVVBp-%3D1vqrM4%2BsD9AQnFwWYUjmJt19TqH_8RtY-vm5oB%3DpcA%40mail.gmail.com.

[Jay Lee]

Is the address you are specifying the user's primary email address? Don't use an alias, use the primary and be sure you are entering the address exactly as it is in the admin console.

Jay

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/CAGNp%2BqDuabmhipKpv2fBKK0Z6OO1F6Hi7q93w8uTysAi2japcg%40mail.gmail.com.

[Jay Lee]

Also, make sure your admin is an OrgUnit where you've explicitly set them to being over 18:

https://support.google.com/a/answer/10651918?hl=en#:~:text=Higher%20education%20institutions%E2%80%94Users%20not,under%20the%20age%20of%2018.