授權錯誤 403：Android Management API 中的訪問被拒絕，不使用 Google Cloud 項目帳戶憑據

Question

當我使用 Google Cloud Project Account Credentials 登錄時，一切都像（創建新企業，應用政策，查看注冊的設備......）。 我可以輕松實現，但是當嘗試通過這些企業使用 Google_Cloud_Project_Account 創建的企業登錄時，我無法執行上述任何操作，因為我收到“403 訪問被拒絕錯誤”。

例如：我們有 Google Cloud 項目帳戶，名稱為：xyz@gmail.com 我們創建了兩個企業，如 abc@gmail.com 和 pqr@gmail.com

但是，當我們嘗試在任一企業（abc@gmail.com 或 pqr@gmail.com）中應用策略時，我們會收到如下錯誤： 錯誤 403：access_denied 開發人員未授予您訪問此應用程序的權限。 它目前正在測試中，尚未經過 Google 驗證。 如果您認為您應該有權訪問，請聯系開發人員 (xyz@gmail.com)。

因此，我可以使用 xyz@gmail.com 執行任何操作，但無法使用 xyz@gmail.com 的子企業（abc@gmail.com 或 pqr@gmail.com）執行任何操作。

為了清楚起見，我分享了我的代碼。 請讓我知道我需要更改的地方或我需要做什么。

企業發帖方式：

 [GoogleScopedAuthorize(AndroidManagementService.ScopeConstants.Androidmanagement)] [HttpPost] public async Task<IActionResult> CreateEnterprise([FromServices] IGoogleAuthProvider auth) { try { EnterpriseDto enterpriseModel = new(); #region OAuthFlow // Check if the required scopes have been granted. if (await auth.RequireScopesAsync(AndroidManagementService.ScopeConstants.Androidmanagement) is IActionResult authResult) { return authResult; } //The required scopes have now been granted. GoogleCredential cred = await auth.GetCredentialAsync(); var service = new AndroidManagementService(new BaseClientService.Initializer { HttpClientInitializer = cred.CreateScoped(AndroidManagementService.Scope.Androidmanagement), ApplicationName = "BluProductsApp" }); //Fetch client information from GCP dynamic name = ""; dynamic email = ""; if (User.Identity is ClaimsIdentity claimsIdentity) { var listk = claimsIdentity.Claims.Select(x => new { x.Type, x.Value }).ToList(); name = listk[3].Value; email = User.FindFirstValue(ClaimTypes.Email); } //var enterpriseRes = _iEmmMapper.GetEnterprises().Where(x=> x.ClientEmail == email); //if(enterpriseRes!= null) //{ // TempData["MsgSignupFailed"] = "There is already an Enterprise exist. Please try with a different mail to add a new Enterprise."; // return View(enterpriseModel); //} #endregion dynamic response = ""; string enterpriseToken = Convert.ToString(TempData["EnterpriseToken"]) ?? null; if (string.IsNullOrEmpty(enterpriseToken)) { //create signup url var signupData = service.SignupUrls.Create(); signupData.AccessToken = cred.UnderlyingCredential.GetAccessTokenForRequestAsync().Result; signupData.ProjectId = ProjectId; signupData.CallbackUrl = _iConfiguration.GetValue<string>("AppSetting:CallBackURL"); response = signupData.Execute(); //assign signup data to vmodel enterpriseModel.SignupUrlName = response.Name; enterpriseModel.SignupUrlURL = response.Url; //store signupurl name in session HttpContext.Session.SetString("SignupUrlName", Convert.ToString(enterpriseModel.SignupUrlName)); //assign client info to model enterpriseModel.ClientName = name; enterpriseModel.ClientEmail = email; //insert data into database var result = _iEmmMapper.CreateUpdateEnterprise(enterpriseModel); } else { //create enterprise var enterpriseData = service.Enterprises.Create(new Enterprise()); enterpriseData.AccessToken = cred.UnderlyingCredential.GetAccessTokenForRequestAsync().Result; enterpriseData.ProjectId = ProjectId; enterpriseData.SignupUrlName = HttpContext.Session.GetString("SignupUrlName"); enterpriseData.EnterpriseToken = Convert.ToString(TempData["EnterpriseToken"]) ?? null; var enterpriseResponse = enterpriseData.Execute(); enterpriseModel.Name = enterpriseResponse.Name; enterpriseModel.EnterpriseToken = enterpriseData.EnterpriseToken; //assign client info to vmodel enterpriseModel.ClientName = name; enterpriseModel.ClientEmail = email; //fetch enterprise from db var resultEnterprise = _iEmmMapper.GetEnterprises(); if (resultEnterprise != null) { foreach (var enterprise in resultEnterprise) { //create default policies for [fixed enterprise] string policyName = enterpriseModel.Name + "/policies/" + PolicyId; //set a default policy with all latest changes var appliedPolicyData = service.Enterprises.Policies.Patch(DefaultPolicies(commonPolicies), policyName).Execute(); enterpriseModel.PolicyName = policyName; //create User var user = new User { AccountIdentifier = Guid.NewGuid().ToString() }; //create enrollmentToken with a with policy name & assign created user EnrollmentToken token = new DemoEnrollmentToken().SetPolicyName(PolicyId).SetUser(user.AccountIdentifier).SetDuration("2592000s"); var tokenResponse = service.Enterprises.EnrollmentTokens.Create(token, enterpriseModel.Name).Execute(); var eToken = tokenResponse.Value; enterpriseModel.EnrollmentToken = eToken; } } //insert/update data into database var result = _iEmmMapper.CreateUpdateEnterprise(enterpriseModel); } return View(enterpriseModel); } catch (Google.GoogleApiException gex) { string msgErr = "Error in " + this.GetType().ToString(); _loggerManager.LogError($"{msgErr}{gex.Message}"); TempData["Failure"] = "There is some technical issue. Please try again."; return View(new EnterpriseDto()); } catch (Exception ex) { string msgErr = "Error in " + this.GetType().ToString(); _loggerManager.LogError($"{msgErr}{ex.Message}"); return View(new EnterpriseDto()); } }

企業獲取方法：

 [HttpGet] public IActionResult CreateEnterprise(EnterpriseDto enterpriseDto, string enterpriseToken) { try { TempData["EnterpriseToken"] = string.Empty; if (!string.IsNullOrEmpty(enterpriseToken)) { TempData["EnterpriseToken"] = Convert.ToString(HttpContext.Request.Query["enterpriseToken"]); TempData["MsgEnterpriseToken"] = "Google Play signup successful."; } // var result = _iEmmMapper.GetEnterprises(); if (result != null) { foreach (var enterprise in result) { enterpriseDto.Name = enterprise.Name; enterpriseDto.EnrollmentToken = enterprise.EnrollmentToken; enterpriseDto.EnrollmentTokenExpiryDate = enterprise.ModifiedDate.AddMonths(1).ToShortDateString(); } } // return View(enterpriseDto); } catch (Exception ex) { _loggerManager.LogError($"Something went wrong inside CreateEnterprise get action: {ex.Message}"); return View(enterpriseDto); } }

CreateEnterprise.cshtml 頁面：

 <form id='fCreateEnterprise' asp-action="CreateEnterprise"> <div asp-validation-summary="ModelOnly" class="text-danger"></div> @if (Model != null) { <div class="row" style="display:none;"> <div class="col-md-6"> <label asp-for=@Model.SignupUrlName class="control-label mt-2"></label> <input asp-for=@Model.SignupUrlName class="form-control" readonly="readonly" /> </div> <div class="col-md-6"> <label asp-for=@Model.SignupUrlURL class="control-label mt-2"></label> <input asp-for=@Model.SignupUrlURL class="form-control" readonly="readonly" /> </div> </div> } <div class="col-md-4 mt-4 offset-4"> <input type="submit" id="btnVerify" value="Verify" class="btn btn-success text-center" /> @*<input type="button" id="btnVerification" value="Verification" class="btn btn-success text-center" />*@ @if (Model.SignupUrlURL != null) { <a href="@Model.SignupUrlURL" target="_blank" class="btn btn-secondary text-center">Complete Signup</a> } else { <a href="#" target="_blank" class="btn btn-secondary text-center">Complete Signup</a> } <input type="submit" value="Create Enterprise" class="btn btn-primary text-center" /> </div> </form>

Answer 1

在 AM API 上創建的企業只能由通過 Cloud IAM 在您的 Cloud 項目中注冊的唯一服務帳戶進行管理。 對於現有的 EMM 合作伙伴，這是推薦的身份驗證方法。 正如您提到的擁有多個企業，請注意您可以使用此身份驗證方法管理多個企業。

或者，您也可以考慮使用客戶管理的企業。 快速入門指南也可作為注冊企業、創建策略和配置設備的參考。