Error: 403: Not Authorized to access this resource/api - forbidden when creating or updating group

1,420 views
Skip to first unread message

David Reid

unread,
Jul 13, 2017, 4:25:21 PM7/13/17
to GAM for G Suite
Hey All,

I get "Error: 403: Not Authorized to access this resource/api - forbidden" when creating or updating a group. I've googled for a solution and tried deleting and recreating my oauth.txt file. This is for my secondary domain for which I run GAM in a separate folder from the primary domain install of GAM.  I can create and delete users with GAM. I've tried adding debug.txt file to my folder to no avail.

Thanks In Advance,


Ross Scroggs

unread,
Jul 13, 2017, 4:33:44 PM7/13/17
to google-ap...@googlegroups.com
David,

Is the same admin user for both domains? Can your create or update a group in your primary domain?
In both folders, do: gam oauth info

Ross

--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsub...@googlegroups.com.
To post to this group, send email to google-apps-manager@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/46012ead-cb13-4a23-af5a-2b1a25be603b%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.



--

David Reid

unread,
Jul 14, 2017, 11:57:17 AM7/14/17
to GAM for G Suite
Hey Ross,

I can create groups in the primary domain. I ran gam oauth info on both domains and both are using a file called oauth2.txt-nccumc.org, which would be what I'd expect for the primary domain. Yesterday, I tried deleting and recreating the oauth file for nccumc.net, which didn't help. Today I looked inside the oauth file for the secondary domain, but couldn't find anything domain specific. I tried renaming the file to oauth2.txt-nccumc.net, but that didn't work either. I think I'm doing something wrong during the gam create oauth step. I'm logged in as super admin for nccumc.net, but that doesn't seem to matter. Any other ideas?


On Thursday, July 13, 2017 at 4:33:44 PM UTC-4, Ross Scroggs wrote:
David,

Is the same admin user for both domains? Can your create or update a group in your primary domain?
In both folders, do: gam oauth info

Ross
On Thu, Jul 13, 2017 at 1:06 PM, David Reid <da...@nccumc.net> wrote:
Hey All,

I get "Error: 403: Not Authorized to access this resource/api - forbidden" when creating or updating a group. I've googled for a solution and tried deleting and recreating my oauth.txt file. This is for my secondary domain for which I run GAM in a separate folder from the primary domain install of GAM.  I can create and delete users with GAM. I've tried adding debug.txt file to my folder to no avail.

Thanks In Advance,


--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsub...@googlegroups.com.
To post to this group, send email to google-ap...@googlegroups.com.



--

✉ Kevin Melillo

unread,
Jul 14, 2017, 12:41:24 PM7/14/17
to google-ap...@googlegroups.com
Quick note:  Once you have GAM working properly for your primary domain, you should not need separate set-up for secondary domains.

On Fri, Jul 14, 2017 at 11:57 AM, David Reid <da...@nccumc.net> wrote:
Hey Ross,

I can create groups in the primary domain. I ran gam oauth info on both domains and both are using a file called oauth2.txt-nccumc.org, which would be what I'd expect for the primary domain. Yesterday, I tried deleting and recreating the oauth file for nccumc.net, which didn't help. Today I looked inside the oauth file for the secondary domain, but couldn't find anything domain specific. I tried renaming the file to oauth2.txt-nccumc.net, but that didn't work either. I think I'm doing something wrong during the gam create oauth step. I'm logged in as super admin for nccumc.net, but that doesn't seem to matter. Any other ideas?

On Thursday, July 13, 2017 at 4:33:44 PM UTC-4, Ross Scroggs wrote:
David,

Is the same admin user for both domains? Can your create or update a group in your primary domain?
In both folders, do: gam oauth info

Ross
On Thu, Jul 13, 2017 at 1:06 PM, David Reid <da...@nccumc.net> wrote:
Hey All,

I get "Error: 403: Not Authorized to access this resource/api - forbidden" when creating or updating a group. I've googled for a solution and tried deleting and recreating my oauth.txt file. This is for my secondary domain for which I run GAM in a separate folder from the primary domain install of GAM.  I can create and delete users with GAM. I've tried adding debug.txt file to my folder to no avail.

Thanks In Advance,


--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsubscribe...@googlegroups.com.



--

--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsub...@googlegroups.com.
To post to this group, send email to google-apps-manager@googlegroups.com.

Visit this group at https://groups.google.com/group/google-apps-manager.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/e8359c3a-c4da-4142-bcae-9b4cae9d9da4%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.



--
Kevin Melillo
Electronic Communications Analyst
Information Technology
445 Hoes Lane
Piscataway, NJ 08854

Phone:732-465-6609 | Mobile: 732-609-4331

drreid

unread,
Jul 14, 2017, 2:33:39 PM7/14/17
to GAM for G Suite
Thanks, but I tried creating a group for my secondary domain with the GAM install for my primary domain and got the same error.


On Friday, 14 July 2017 12:41:24 UTC-4, k.melillo wrote:
Quick note:  Once you have GAM working properly for your primary domain, you should not need separate set-up for secondary domains.
On Fri, Jul 14, 2017 at 11:57 AM, David Reid <da...@nccumc.net> wrote:
Hey Ross,

I can create groups in the primary domain. I ran gam oauth info on both domains and both are using a file called oauth2.txt-nccumc.org, which would be what I'd expect for the primary domain. Yesterday, I tried deleting and recreating the oauth file for nccumc.net, which didn't help. Today I looked inside the oauth file for the secondary domain, but couldn't find anything domain specific. I tried renaming the file to oauth2.txt-nccumc.net, but that didn't work either. I think I'm doing something wrong during the gam create oauth step. I'm logged in as super admin for nccumc.net, but that doesn't seem to matter. Any other ideas?

On Thursday, July 13, 2017 at 4:33:44 PM UTC-4, Ross Scroggs wrote:
David,

Is the same admin user for both domains? Can your create or update a group in your primary domain?
In both folders, do: gam oauth info

Ross
On Thu, Jul 13, 2017 at 1:06 PM, David Reid <da...@nccumc.net> wrote:
Hey All,

I get "Error: 403: Not Authorized to access this resource/api - forbidden" when creating or updating a group. I've googled for a solution and tried deleting and recreating my oauth.txt file. This is for my secondary domain for which I run GAM in a separate folder from the primary domain install of GAM.  I can create and delete users with GAM. I've tried adding debug.txt file to my folder to no avail.

Thanks In Advance,


--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsub...@googlegroups.com.



--

--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsub...@googlegroups.com.
To post to this group, send email to google-ap...@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.

+KimNilsson

unread,
Jul 16, 2017, 11:52:09 AM7/16/17
to GAM for G Suite
There's something wrong on your end.

I just created a group in one of our many subdomains without a problem.
I only have a single setup for that domain, and I also use GAM (with separate JSONs) for many other domains, without any issues.

drreid

unread,
Jul 17, 2017, 1:59:41 PM7/17/17
to GAM for G Suite
Hey Ross,

Thanks for your help on the phone this morning and correcting my terminology. While I described my domains as primary and secondary, you more correctly described them as 2 separate primary domains. 

Thanks Again,


On Thursday, 13 July 2017 16:33:44 UTC-4, Ross Scroggs wrote:
David,

Is the same admin user for both domains? Can your create or update a group in your primary domain?
In both folders, do: gam oauth info

Ross
On Thu, Jul 13, 2017 at 1:06 PM, David Reid <da...@nccumc.net> wrote:
Hey All,

I get "Error: 403: Not Authorized to access this resource/api - forbidden" when creating or updating a group. I've googled for a solution and tried deleting and recreating my oauth.txt file. This is for my secondary domain for which I run GAM in a separate folder from the primary domain install of GAM.  I can create and delete users with GAM. I've tried adding debug.txt file to my folder to no avail.

Thanks In Advance,


--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsub...@googlegroups.com.
To post to this group, send email to google-ap...@googlegroups.com.



--

+KimNilsson

unread,
Jul 18, 2017, 7:22:47 AM7/18/17
to GAM for G Suite, drr...@nccumc.org
Alright, so you're good now?
You've authorised your GAM to work with your second domain?

+KimNilsson

unread,
Jul 18, 2017, 9:21:22 AM7/18/17
to GAM for G Suite, drr...@nccumc.org
(Posting here so others know what's going on.)

Ok, remove your oauth2.txt files, then start here in the guide and make sure you do it for both your domains.


I'm assuming you have two separate GAM dirs with the same (or separate) pair of .json files.


On 18 July 2017 at 15:00, David Reid wrote:
Unfortunately not. I'm still getting the same error (the 403 error) when creating or updating groups for both of my domains. Other commands seem to work correctly though. 

David Reid
System Administrator
NC Methodist Conference

drreid

unread,
Jul 21, 2017, 10:26:33 AM7/21/17
to GAM for G Suite, drr...@nccumc.org
Sorry if this is confusing, but I couldn't reply without rejoining the group with a different userid. Ross correctly diagnosed my issue as not having my path environment variable set. Now that it's set for both of my gam instances my group create commands work.

Thanks Again,
Reply all
Reply to author
Forward
0 new messages