Google Account Creation Failing

Question

Hi all,

Having issues creating a GSuite (Apps for Education) account for my users during a new user creation process.

• Logic location: Business Rules > After User Creation > If Operation Succeeded > Run PowerShell Script...
  Script: https://www.adaxes.com/script-repositor ... t-s363.htm

I set up GAM and the user passes all API tests successfully

However, I receive the following error in the Adaxes web GUI when creating the user:

"An error occurred while creating a Google account. Error: ERROR: 403: Not Authorized to access this resource/api - forbidden"

As stated, no user is created. Any idea how I can go about troubleshooting this?

Comments

Hello,

We recommend you to re-authorize the user. Make sure that the account used is the Adaxes service account (specified during Adaxes installation). The following forum post should be helpful: https://github.com/jay0lee/GAM/issues/461.

Answer 1

I have located the problem, posting in case it helps anyone else who is in a unique situation.

Because we are education, we split our domain for staff (O365: site.com) and students (GAFE: student.site.com); these cannot use the same domain and retain mail functionality. The non-descriptive error was referring to the domain presented with the %userPrincipalName% variable.

By using %saMAccountName% in lieu of %userPrincipalName%, I was able to pass the data through.

For testing only, a quick/dirty/insecure way to test without error checking was (in case someone needs to troubleshoot GAM):

$firstName = "%firstname%"
$lastName = "%lastname%"
$unicodePwd = %unicodePwd%"
$userName = "%saMAccountName%"

C:\Gam\gam.exe create user $userName firstname $firstName lastname $lastName password $unicodePwd

For production, I suggest modifying line 16 of the Adaxes-provided script to reflect %saMAccountName% instead of %userPrincipalName%

For reference, the account that establishes OAuth does not need to be tied to Adaxes in any way. It just needs to be a service account on GAFE with Super Admin permissions to grant API access.