ERROR: 403: Not Authorized to access this resource/api - forbidden

2,658 views
Skip to first unread message

Zoeb Bharmal

unread,
Jun 6, 2016, 8:39:45 AM6/6/16
to Google Apps Manager
Hi,

I am using GAM v3.65 but am experiencing the following error:

"ERROR: 403: Not Authorized to access this resource/api - forbidden"

This is when I run the following command: "python gam.py print users creationtime lastlogintime ou suspended groups >info.csv"

My authorised account is a super admin of the domain and this error occurs when gathering group membership for users. I have also tried re-installing GAM including new authorisation etc but still get the same error.. Earlier in the morning I run a command of "python gam.py print users creationtime ou suspended >users.csv" with no issues.

I last run the command which I'm now having problems with on Thursday morning and nothing has changed since then with account access or auth that should cause me problems..

Any help would be greatly appreciated.

Thanks,
Zoeb.

Jay Lee

unread,
Jun 6, 2016, 8:43:29 AM6/6/16
to Google Apps Manager

What does:

gam oauth info

Show? Make sure it's showing your super admin user and the proper directory.user scopes.

Jay


--
You received this message because you are subscribed to the Google Groups "Google Apps Manager" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To post to this group, send email to google-ap...@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/adc848e9-efa8-49e9-aa51-6b8f1d1332a8%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
--

Jay

Jay Lee

unread,
Jun 6, 2016, 8:46:04 AM6/6/16
to Google Apps Manager

Actually, the command working without groups argument and failing with it implies groups scope is not authorized. Run:

gam oauth revoke

And then rerun the command with groups and keep default scopes selected making sure you authorize as a super admin user.

Jay

--

Jay

Zoeb Bharmal

unread,
Jun 6, 2016, 8:46:42 AM6/6/16
to Google Apps Manager
Hi Jay,

Here's the output of the scopes:

https://www.googleapis.com/auth/userinfo.email

  https://www.googleapis.com/auth/admin.directory.group

  https://www.googleapis.com/auth/admin.directory.orgunit

  https://www.googleapis.com/auth/admin.directory.user

  https://www.googleapis.com/auth/admin.directory.device.chromeos

  https://www.googleapis.com/auth/admin.directory.device.mobile

  https://apps-apis.google.com/a/feeds/emailsettings/2.0/

  https://www.googleapis.com/auth/admin.directory.resource.calendar

  https://apps-apis.google.com/a/feeds/compliance/audit/

  https://apps-apis.google.com/a/feeds/domain/

  https://www.googleapis.com/auth/apps.groups.settings

  https://www.googleapis.com/auth/calendar

  https://www.googleapis.com/auth/admin.reports.audit.readonly

  https://www.googleapis.com/auth/admin.reports.usage.readonly

  https://www.googleapis.com/auth/drive.file

  https://www.googleapis.com/auth/apps.licensing

  https://www.googleapis.com/auth/admin.directory.user.security

  https://www.googleapis.com/auth/siteverification

  https://mail.google.com/

  https://www.googleapis.com/auth/admin.directory.userschema

  https://www.googleapis.com/auth/classroom.rosters

  https://www.googleapis.com/auth/classroom.courses

  https://www.googleapis.com/auth/classroom.profile.emails

  https://www.googleapis.com/auth/classroom.profile.photos

  https://www.googleapis.com/auth/cloudprint

  https://www.googleapis.com/auth/admin.datatransfer

  https://www.googleapis.com/auth/admin.directory.customer

  https://www.googleapis.com/auth/admin.directory.domain

  https://www.googleapis.com/auth/admin.directory.rolemanagement

  https://www.googleapis.com/auth/plus.me


It does show the correct super admin account in use as well.


Thanks,

Zoeb.


On Monday, 6 June 2016 13:43:29 UTC+1, Jay Lee wrote:

What does:

gam oauth info

Show? Make sure it's showing your super admin user and the proper directory.user scopes.

Jay


On Mon, Jun 6, 2016, 8:39 AM Zoeb Bharmal <zoeb.b...@whitestratus.com> wrote:
Hi,

I am using GAM v3.65 but am experiencing the following error:

"ERROR: 403: Not Authorized to access this resource/api - forbidden"

This is when I run the following command: "python gam.py print users creationtime lastlogintime ou suspended groups >info.csv"

My authorised account is a super admin of the domain and this error occurs when gathering group membership for users. I have also tried re-installing GAM including new authorisation etc but still get the same error.. Earlier in the morning I run a command of "python gam.py print users creationtime ou suspended >users.csv" with no issues.

I last run the command which I'm now having problems with on Thursday morning and nothing has changed since then with account access or auth that should cause me problems..

Any help would be greatly appreciated.

Thanks,
Zoeb.

--
You received this message because you are subscribed to the Google Groups "Google Apps Manager" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsub...@googlegroups.com.
--

Jay

Zoeb Bharmal

unread,
Jun 6, 2016, 9:22:33 AM6/6/16
to Google Apps Manager
Hi Jay,

I tried that as well and it's still causing the same error. Interestingly though it's not erroring on the first attempt, like it will process a few thousands users and then fail with the error!

Thanks,
Zoeb.

On Monday, 6 June 2016 13:46:04 UTC+1, Jay Lee wrote:

Actually, the command working without groups argument and failing with it implies groups scope is not authorized. Run:

gam oauth revoke

And then rerun the command with groups and keep default scopes selected making sure you authorize as a super admin user.

Jay


On Mon, Jun 6, 2016, 8:43 AM Jay Lee <jay...@gmail.com> wrote:

What does:

gam oauth info

Show? Make sure it's showing your super admin user and the proper directory.user scopes.

Jay


On Mon, Jun 6, 2016, 8:39 AM Zoeb Bharmal <zoeb.b...@whitestratus.com> wrote:
Hi,

I am using GAM v3.65 but am experiencing the following error:

"ERROR: 403: Not Authorized to access this resource/api - forbidden"

This is when I run the following command: "python gam.py print users creationtime lastlogintime ou suspended groups >info.csv"

My authorised account is a super admin of the domain and this error occurs when gathering group membership for users. I have also tried re-installing GAM including new authorisation etc but still get the same error.. Earlier in the morning I run a command of "python gam.py print users creationtime ou suspended >users.csv" with no issues.

I last run the command which I'm now having problems with on Thursday morning and nothing has changed since then with account access or auth that should cause me problems..

Any help would be greatly appreciated.

Thanks,
Zoeb.

--
You received this message because you are subscribed to the Google Groups "Google Apps Manager" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsub...@googlegroups.com.
--

Jay

--

Jay

Jay Lee

unread,
Jun 6, 2016, 9:35:07 AM6/6/16
to Google Apps Manager
Try creating a file called debug.gam in the same folder as gam.exe / gam.py and re-run the command, it should give more information about what user is erroring out.

Jay

To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To post to this group, send email to google-ap...@googlegroups.com.
--

Jay

--

Jay

--
You received this message because you are subscribed to the Google Groups "Google Apps Manager" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.

To post to this group, send email to google-ap...@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/9d5d5149-dced-4ae0-872a-cac963f7b025%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.
--

Jay

Zoeb Bharmal

unread,
Jun 7, 2016, 11:49:43 AM6/7/16
to Google Apps Manager
Hi Jay,

Sorry for my delay in replying. So I did create that file as suggested and funny enough the command completed successfully without erroring, which is really odd! The only thing I removed from the command was the instruction to pipe info to csv.

Thanks,
Zoeb.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsub...@googlegroups.com.
To post to this group, send email to google-ap...@googlegroups.com.
--

Jay

--

Jay

--
You received this message because you are subscribed to the Google Groups "Google Apps Manager" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsub...@googlegroups.com.
--

Jay

Richard Gilbert

unread,
Jun 8, 2016, 5:15:22 AM6/8/16
to Google Apps Manager
This error has started to appear for me very intermittently.  It has been returned for two password change commands and an account creation in the previous two days.  The creation request was resubmitted and completed.  Since the first occurrence there have been > 80 successful password changes.  (I am still using v3.51 in my production environment.)

Richard

Zoeb Bharmal

unread,
Jul 8, 2016, 7:47:52 AM7/8/16
to Google Apps Manager
Hi Jay,

This is still an ongoing issue I'm afraid. Having to run this report again and now been getting the error "

ERROR: 403: Not Authorized to access this resource/api - forbidden"


Gam command I'm running is "python gam.py print users creationtime lastlogintime ou suspended groups".


Thanks,

Zoeb.


On Monday, 6 June 2016 13:39:45 UTC+1, Zoeb Bharmal wrote:

Dharmik Raithatha

unread,
Sep 8, 2017, 3:58:33 AM9/8/17
to GAM for G Suite
Hello Guys,

We are also facing the same issue and receiving the error while updating the query of account wipe.
Reply all
Reply to author
Forward
0 new messages