Using Cloud Identity Devices API return error 403 when creating devices.

[sha-testia]

Hello,

I am trying to create a device using the Google Cloud Identity API. I followed all the instructions as provided here:

https://cloud.google.com/identity/docs/how-to/create-devices#python-http

A service account is create and necessay scopes are provided through domain wide delegation.

list users API is working fine but i get a 403 error when i try to create a device.

[Willbin]

Hello @sha-testia,

Welcome to Google Cloud Community!

This is likely due to insufficient permissions for the service account you are using. Check the service account you are using has the necessary permissions to create devices. 

The service account should have the roles/cloudidentity.devices.create role or equivalent permissions.
See this document

Make sure also that domain-wide delegation is correctly set up for the service account. This allows the service account to impersonate users in the domain and perform actions on their behalf. Make sure that the necessary scopes are provided during domain-wide delegation.

If you can provide more details about the error message, such as specific reasons for the 403 error, review them carefully. This can give you insights into what specific permission is missing or what condition is causing the permission denial.

[sha-testia]

Hello,

We have given the service account the permission/role of 'owner'. 

For domain wide delagation we provided the scope of: 

[https://www.googleapis.com/auth/cloud-identity.devices]

As for the specific 403 Error message we get: 

{'error': {'code': 403, 'message': 'The caller does not have permission', 'status': 'PERMISSION_DENIED'}}

[sha-testia]

Another issue to point out is that when setting up the service account role I am unable to see 'cloudidentity' in the list. Other products are visible except cloud identity.

And finally, do we also need to enable billing for the project? 

[sha-testia]

@Willbin Hi do you have any suggestions? We tried looking for the roles you mentioned in the document. But we cannot file any role related to 'cloudidentity' or 'cloud-identity'.

For the domain wide delagation we also provided the scope of:

[https://www.googleapis.com/auth/cloud-identity.devices]

We tried using the client libraries https://cloud.google.com/apis/docs/cloud-client-libraries and also direct HTTP post requests. 

One thing to note is that we are able to read the devices but the issue is only in creating the devices.

[Willbin]

Hello @sha-testia,

Can you confirm if you already added the client ID of the service account from the domain wide delegation to the workspace admin console?