【发布时间】：2021-05-13 23:49:01
【问题描述】：
我目前正在为 google 组织的每个用户设置一个自动签名系统，但我没有成功。我遵循this 指南，但出现以下错误：Service_.getAccessToken @ Service.gs:454。问题是：我无权访问文件Service.gs，当我用谷歌搜索我的错误时，没有答案，无论是在谷歌的 github 还是堆栈溢出的网站上都非常适合我。
这是代码（来自指南，我当然更改了身份验证值）：
var accountsToIgnore = [
'ignore-me@example.com',
'noreply@example.com'
];
var auth = {
"private_key": "-----BEGIN PRIVATE KEY-----\nABCDE\n-----END PRIVATE KEY-----\n",
"client_email": "name@project-id-XXX.iam.gserviceaccount.com",
"client_id": "INSERT_CLIENT_ID_HERE"
};
function go() {
var pageToken;
var page;
do {
page = AdminDirectory.Users.list({
domain: 'example.com',
orderBy: 'familyName',
maxResults: 250,
pageToken: pageToken,
projection: 'full',
// query: "email=your.email@example.com"
});
if (page.users) {
page.users.forEach( function (user){
if (accountsToIgnore.indexOf(user.primaryEmail) == -1) {
var service = getOAuthService(user.primaryEmail);
// Pull in the signatire template file contents into this variable
var signatureTemplate = HtmlService.createHtmlOutputFromFile("signature").getContent();
// Set up a userData variable, with some blank defaults as backups
var userData = {
email: user.primaryEmail,
firstName: user.name.givenName,
lastName: user.name.familyName,
jobTitle: "",
showJobTitle: true,
workingHours: "",
directPhone: ""
};
if (typeof user.customSchemas !== 'undefined') { // Email sig settings are set
if (typeof user.customSchemas.Email_signature !== 'undefined') {
if (typeof user.customSchemas.Email_signature.Show_job_title_in_signature !== 'undefined' && user.customSchemas.Email_signature.Show_job_title_in_signature == false) {
userData.showJobTitle = false;
}
if (typeof user.customSchemas.Email_signature.Working_Hours_Description !== 'undefined' && user.customSchemas.Email_signature.Working_Hours_Description != "") {
userData.workingHours = "<br /><br /><i>"+user.customSchemas.Email_signature.Working_Hours_Description+"</i><br />";
}
}
}
if (user.hasOwnProperty('organizations') && user.organizations[0].hasOwnProperty('title') && typeof user.organizations[0].title !== "undefined" && userData.showJobTitle == true) {
userData.jobTitle = user.organizations[0].title+"<br />";
}
if (user.hasOwnProperty('phones') && Array.isArray(user.phones) && user.phones.length >0) {
for (var p = 0; p < user.phones.length; p++) {
if (user.phones[p].customType == "Google Voice") {
// Depending on where in the world you are, you may need to adjust this formatting for your own needs... This replaces the +44 UK country code with a local "0" and adds a space after the local area code for formatting.
userData.directPhone = "<br />D: " + user.phones[p].value.replace('+44', '0').replace('1158', '1158 ');
}
}
}
// Replace the placeholders as seen in the signature.html file with the actual data from the userData variable set up earlier.
var userSig = signatureTemplate
.replace(/(\r\n|\n|\r)/gm, "")
.replace(/{email}/g, userData.email)
.replace(/{firstName}/g, userData.firstName)
.replace(/{lastName}/g, userData.lastName)
.replace(/{jobTitle}/g, userData.jobTitle)
.replace(/{workingHours}/g, userData.workingHours)
.replace(/{directNumber}/g, userData.directPhone);
var sigAPIUrl = Utilities.formatString('https://www.googleapis.com/gmail/v1/users/%s/settings/sendAs/%s',userData.email, userData.email);
var response = UrlFetchApp.fetch(sigAPIUrl, {
method: "PUT",
muteHttpExceptions: true,
contentType: "application/json",
headers: {
Authorization: 'Bearer ' + service.getAccessToken()
},
payload: JSON.stringify({
'signature': userSig
})
});
if (response.getResponseCode() !== 200) {
Logger.log('There was an error: ' + response.getContentText());
} else {
Logger.log("Signature updated for "+user.primaryEmail);
}
}
});
} else {
Logger.log('No users found.');
}
pageToken = page.nextPageToken;
} while (pageToken);
}
function getOAuthService(userId) {
return OAuth2.createService("Signature Setter "+userId)
.setTokenUrl('https://accounts.google.com/o/oauth2/token')
.setAuthorizationBaseUrl('https://accounts.google.com/o/oauth2/auth') // Added thanks to research
.setClientId(auth.client_id) // same
.setCallbackFunction('authCallback') // same
.setPrivateKey(auth.private_key)
.setIssuer(auth.client_email)
.setPropertyStore(PropertiesService.getScriptProperties())
.setSubject(userId)
.setParam('access_type', 'offline')
.setScope('https://www.googleapis.com/auth/gmail.settings.basic https://www.googleapis.com/auth/gmail.settings.sharing');
}
问题来自 GMAIL API（谷歌的 API 页面上 100% 错误）或谷歌的 OAuth2。
这是我发现的一些与我的问题相关的页面：
来自 apps.google 的完整错误代码：Error: Access not granted or expired. Service_.getAccessToken @ Service.gs:454
凭证 API（警告标志表示它是自动创建的）： https://prnt.sc/yy8kg5
我在谷歌应用脚本编辑器上的文件和服务：https://prnt.sc/yy9dyw
感谢您的帮助。
【问题讨论】：
-
1) 你从哪里得到这个代码？ - 换句话说，将不同的授权方法混合在一起是一团糟 2) 您不能反对来自用户 ID (getOAuthService) 的凭据。 3）您需要实施域范围的授权并正确设置服务帐户以进行授权。然后服务帐户假定用户的身份。要非常小心地保护该服务帐户。 4) 你标记了
gmail。您使用的是 Gmail 还是 Google Workspace？只有后者支持委托。 developers.google.com/admin-sdk/directory/v1/guides/delegation -
访问未授予或过期
-
我的评论部分错误。您需要域范围委派，但您不需要假设每个用户的身份。服务帐户确实需要委派来管理 Workspace 域并将签名添加到每个帐户。
标签： javascript google-cloud-platform oauth-2.0 gmail-api