-
Notifications
You must be signed in to change notification settings - Fork 60
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Provider does not work with user credentials, again #264
Comments
Broke in v0.5.0. Appears that when reading default application credentials, it ignores the quota_project_id, so the requests to the backend do not contain x-goog-project-id, so the quota system is broken. In 0.4.1, the code just returned a default diags. Since 0.5.0 its trying to use googleoauth.FindDefaultCredentialsWithParams which is not picking up the project. |
I noticed some weird behavior with scopes. If youre still having issues with this maybe setup your provider to explicitly call out the oauth scope like so: provider "googleworkspace" {
credentials = [...]
customer_id = [...]
impersonated_user_email = [...]
oauth_scopes = [
"https://www.googleapis.com/auth/admin.directory.group"
]
} |
I had to add the "impersonate_user_email" to my provider configuration to import groups or I would receive a 403 error. The "impersonate_user_email" field in the provider documentation states that it is not required for the group API. I am not sure if this is a bug or missing in the documentation. |
I've run into this issue with 0.7.0 provider. |
We've run in to this issue too |
Terraform Version
Affected Resources
googleworkspace_group
Terraform Configuration Files
Debug Output
tf.log
Panic Output
None.
Expected Behavior
googleworkspace_group
resource is imported.Actual Behavior
googleworkspace_group
resource is not imported. A 403 error is returned.Steps to Reproduce
Make sure, the Google Auth Library is listed under configured apps in Google Admin on https://admin.google.com/ac/owl/list?tab=configuredApps.
Make sure, the Directory API in the project is enabled. Run:
gcloud services enable admin.googleapis.com
Make sure Application Default Credentials were issued for correct scopes:
Attempt import the resource. Run:
See an error message:
Full output
Important Factoids
X-Goog-User-Project
header is used, while I am not seeing this header being passed,admin.googleapis.com
is clearly enabled on the project (this project is also used to count API quota again, e.g. for billing).References
The text was updated successfully, but these errors were encountered: