Google Workspace服务账号委托调用Directory API报Entity Not found问题

问题背景 #

• 测试目标：使用服务账号调用Google Directory API的domains.list接口
• 前置验证：使用域管理员账号登录接口页面「试用」功能可正常获取返回结果，确认传入参数、customer id均有效
• 配置验证：已按官方全域权限委托文档创建服务账号并开启全域委托，分别检查Workspace账号和Google Cloud控制台，确认委托配置已生效，且已将域管理员邮箱设置为委托主体

问题代码 #

namespace Daimto.Sample.WorkspaceAdmin
{
    class Program
    {
        private static readonly string[] Scopes = {DirectoryService.Scope.AdminDirectoryDomain};
        private static readonly string PathToServiceAccountKeyFile = @"C:\YouTube\workspaceserviceaccount-e4823a933ae3.json";
        private static readonly string CustomerId = "C01lp3chxa";
        private static readonly string workspaceAdmin = "xxx@daimto.com";

        static void Main(string[] args)
        {
            Console.WriteLine("Hello World!");

            var credential = LoadGoogleCredentails();
            var service = CreateDirectoryService(credential);
            var request = service.Domains.List(CustomerId);
            var result = request.Execute();
            foreach (var domain in result.Domains)
            {
                Console.WriteLine(domain.DomainName);
            }
        }

        private static DirectoryService CreateDirectoryService(GoogleCredential credential)
        {
            return new (new BaseClientService.Initializer()
                {
                    HttpClientInitializer = credential,
                    ApplicationName = "Daimto Testing Workspace with service account"
                }
            );
        }

        private static GoogleCredential LoadGoogleCredentails()
        {
            return GoogleCredential.FromFile(PathToServiceAccountKeyFile)
                .Impersonate(new ImpersonatedCredential.Initializer(workspaceAdmin))
                .CreateScoped(Scopes);
        }
    }
}

错误表现 #

带模拟身份逻辑时返回404 #

"error": {
    "code": 404,
    "message": "Requested entity was not found.",
    "errors": [
      {
        "message": "Requested entity was not found.",
        "domain": "global",
        "reason": "notFound"
      }

删除模拟身份逻辑时返回403 #

Not Authorized to access this resource/api [403]
Errors [
  Message[Not Authorized to access this resource/api] Location[ - ] Reason[forbidden] Domain[global]
]

问题解答 #

核心错误原因 #

你代码中使用的Impersonate方法是Google Cloud体系下的服务账号模拟逻辑，不适用于Workspace全域委托的身份模拟场景，这是触发404报错的根源。

修复方案 #

将LoadGoogleCredentails方法中的模拟逻辑替换为Workspace全域委托专用的CreateWithUser方法即可，修改后代码如下：

private static GoogleCredential LoadGoogleCredentails()
{
    return GoogleCredential.FromFile(PathToServiceAccountKeyFile)
        .CreateScoped(Scopes)
        .CreateWithUser(workspaceAdmin);
}

相关疑问解释 #

1. 文档提示Only users with access to the Admin APIs can access the Admin SDK Directory API的含义：
   Admin SDK Directory API属于Workspace域管理专属接口，仅允许有对应管理权限的域内用户调用。服务账号本身不属于Workspace域内实体，没有任何域管理权限，所以必须通过全域委托模拟有对应权限的域管理员才能调用接口，这也是你删除模拟逻辑后返回403的直接原因。

2. 额外配置检查项：
   如果修改代码后仍有报错，请确认两个配置：

• Workspace管理后台「安全->访问权限控制->API控件->全域权限委派」页面，已给服务账号的客户端ID授权了https://www.googleapis.com/auth/admin.directory.domain权限
• 你配置的workspaceAdmin账号确实拥有域管理员权限，账号状态正常无封禁、限制等异常

内容的提问来源于stack exchange，提问作者Linda Lawton - DaImTo