Details below. I also opened an issue on the apps-api-issues:
https://code.google.com/a/google.com/p/apps-api-issues/issues/detail?id=4870&colspec=Stars%20Opened%20ID%20Type%20Status%20Summary%20API%20Owner
I successfully switched the app to use 3-legged OAuth vs. service account
OAuth, but still would like to get to the bottom of this, as I'd prefer to
use service account OAuth for testing and maintenance programs that hit
this API, and also for the benefit of others who may be having the problem.
G Suite tech support suggested after setting up DwD you may have to use
credentials.create_delegated('some.real.u...@example.com') -- as mentioned
on this page
<https://developers.google.com/identity/protocols/OAuth2ServiceAccount> (but
without any indication that it's necessary, and very easy to miss). I have
not tried that but will in the next day or two.
On Tuesday, October 25, 2016 at 4:33:25 PM UTC-4, George (Cloud Platform
Support) wrote:
>
> Hello Eric!
> More detail is needed, to investigate your problem:
> - About the client library: language, version (GData, API Client ?).
>
- Python 2.7 App Engine runtime
- google-api-python-client==1.5.3
- oauth2client==4.0.0
>
> - API scopes?
>
https://www.googleapis.com/auth/calendar
<https://www.googleapis.com/auth/calendar'>
- The actual URL posted in your app call.
>
GET
https://www.googleapis.com/calendar/v3/calendars/ert.com_2tg0olqm8t766rjutjjc0hns8o%40group.calendar.google.com/events?orderBy=startTime&timeMax=2016-10-28T00%3A00%3A00Z&fields=nextPageToken%2Citems&singleEvents=true&maxResults=250&alt=json
POST
https://www.googleapis.com/calendar/v3/calendars/ert.com_2tg0olqm8t766rjutjjc0hns8o%40group.calendar.google.com/events?alt=json
> - Code (HTTP Request)?
>
See issue
<https://code.google.com/a/google.com/p/apps-api-issues/issues/detail?id=4870&colspec=Stars%20Opened%20ID%20Type%20Status%20Summary%20API%20Owner>
>
> - Are there other accounts affected, or just one, or few?
>
All the service accounts we set up.
> - In case an account works well, email address and user?
> - Any part of your code you deem significant.
> - Request output.
>
GET:
<https://lh3.googleusercontent.com/-r-HOZ91Nh1E/WBTh1yjyYEI/AAAAAAAAC-0/8u1-gn1JPaMcK_uu4edX-VYM4Dr2zSC9QCLcB/s1600/calendarapiGET.png>
POST:
<https://lh3.googleusercontent.com/-TrhzBL4xx6o/WBTh7qKBFcI/AAAAAAAAC-4/ecbgPgWSrPIrensRlvRCvk9EubNBcNVygCLcB/s1600/calendarapiPOST.png>
>
> - Eventual screenshots of the results, if relevant.
> - If possible, HTTP Request and Response headers, or full HTTP logs.
>
> Waiting for information; let me know if I may help otherwise.
>
> On Monday, October 24, 2016 at 2:46:28 PM UTC-4, Eric G wrote:
>>
>> I have a GAE project (python 2.7 runtime) that uses the Google Calendar
>> API v3. Up until last week, I had been using the default GAE service
>> account to connect to the calendar API, and the service account was given
>> read/write permission to the calendar under calendar sharing settings.
>>
>>
>> Since last Thursday Oct 20, the service account cannot write to the
>> calendar (events.post or events.patch) -- returns a 403 Forbidden -- and
>> reads (events.list) return 200, but no records. Checking the permissions
>> for the account under calendar sharing, it has been changed to "See
>> Free/Busy only".
>>
>>
>> I believe this is related to this announcement from Google about winding
>> down OAuth 1.0 service accounts on Oct 20:
>> https://developers.googleblog.com/2016/04/saying-goodbye-to-oauth-10-2lo.html
>>
>>
>> The recommendation seems to be to grant Domain Wide Delegation to the
>> service account:
>> https://developers.google.com/identity/protocols/OAuth2ServiceAccount#delegatingauthority
>>
>>
>> We have followed the instructions on this page, but it doesn't work using
>> either AppAssertionCredentials or ServiceAccountCredentials.
>>
>> More details at this SO question:
>>
>> http://stackoverflow.com/questions/40223292/google-app-engine-auth-for-google-apis-using-service-account
>>
>> Thanks for any light you can shine on this problem.
>>
>>
>>
>>
--
You received this message because you are subscribed to the Google Groups
"Google App Engine" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to google-appengine+unsubscr...@googlegroups.com.
To post to this group, send email to google-appengine@googlegroups.com.
Visit this group at https://groups.google.com/group/google-appengine.
To view this discussion on the web visit
https://groups.google.com/d/msgid/google-appengine/58b79a43-1b53-4407-9916-01961f31537b%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
