I need to retrieve a list of all users present in my Oracle Cloud environment via REST API or Go SDK.
Looking at the REST API docs, the Go SDK docs, and the OCI CLI docs, nowhere seems to provide an option to supply Identity Domain as an argument.
oci iam user list returns only the set of users present in the "Default" domain, even when I authenticate as a user in another domain.
Is there a way to fetch users from other Identity Domains?
Here is the REST API doc to list all users in the identity domain:
https://docs.oracle.com/en/cloud/paas/iam-domains-rest-api/op-admin-v1-users-get.html
Also, please use the domain URL for the API endpoint? Something like this: https://{domainUrl}/admin/v1/Users).
Unfortunately, we have Go SDK (or other SDKs and CLI) support only for IAM resources but not for Identity Domains (IDCS).
Thanks.
Related
We are developing an application, in that we need to get all the files of all users in the domain. We have enabled service account with domain-wide delegation already, but whenever we tried to access all user's drive, it is required to get each user access token separately after setting each user id using google credential object method (e.g. googleCredentialBuilder.setServiceAccountUser({email_id})). We are using Drive API client library for Java and admin SDK for getting all the users in the domain.
So, our concern is to get all users to drive files using a super admin access token. Is there any alternate way to get all users to drive files using domain/admin-level access token. Kindly help me in this regard.
To obtain all the Drive files in the domain, you have to use delegation as follows:
Use the Directory API users.list() API call to determine all users in the Google Apps domain.
For each user obtained in step 1, do:
2.1. Call files.list with the parameter q set to "me" in owners to get a list of all files the user owns.
To do all of this you don't necessarily need a superadmin account. You just need to set up credentials with domain-wide delegation enabled. You can read more about how to do it here.
I have an enpoint in my MERN app which I would like to expose to developers.
I came across APIM and would like to use it.
After going to the documentation I would like to know how do I can use APIM for my specific enpoint and where I allow users to generate API's in my client side react app.
I am also going through the API management API. but don't know how to generate user specific API keys...
You could simply mimic what the Developer Portal does using APIMs REST API.
If you are using the Consumption Tier of APIM, you can just create a standalone subscription using the Create or Update Subscription API. Yon don't have to set properties.ownerId in the request payload here.
On the other tiers, standalone subscriptions are not supported yet (but will be as mentioned in the official announcement blog under New Features), so you will have to create a user first using the Create or Update User API and then create a new subscription mentioning this user under properties.ownerId as /users/{userId}.
Since these REST APIs call the Azure Management API, you shouldn't be making these requests from the client and instead should be calling this from your backend.
I am trying to get the policies for all the resources so I can view the roles and members associated with them. Any method of getting all the policies through the API would work for me.
I am currently trying to list the organizations (resources) so that I can then get the policies for each resource with a command like GetIamPolicy. However, the organizations.list command returns null. Let me know if any of you have had success getting any policy.
I am using the C# API with a service key to connect to my Google Cloud account.
If I understand correctly, you're trying to get the list of all of your GCP Organization resources so that you can cycle through the list to get the IAM policy bindings for each organization.
Get organizations from Cloud Resource Manager API:
To accomplish this, you would first use organizations.search (with no filter) to get a list of all of your organizations.
Try it here with the API Explorer.
Get organization IAM policy from the Cloud Resource Manager API.
Then, for each organization, you would use the organization name to call organizations.getIamPolicy in order to get the IAM Policy for that organization.
Try it here with the API Explorer (update the resource to reflect your organization name).
Note: IAM Policy is how you control access to resources in GCP. There are various levels at which you can manage IAM Policies, including organizations, folders and projects. There is a entirely separate concept called Org Policy, which allows you to control which API services can be enabled in each of your projects.
I have developed a few small apps that connect to our google domain. However each time I have to authorize one of these apps I need to add a different
Authorized API client by using it's "Client Name". Is there a way to set this client name to something of my choosing? It would make it much easier to quickly understand what apps are OK to remove from the list later on.
Thanks!
...edit...
I may not have been specific enough, here is an image of where I want to change the value. This is from the google admin console for google apps under Security -> Show More -> Advanced Settings -> Manage API Client Access
CLient Name Field
For all the apps I've developed so far my Client Name(which I pull from the google developers console) is either a seemingly random string of only numbers or a random string of numbers and letters follow by "apps.googleusercontent.com". Yet I've seen other apps that somehow have their company name listed there. How can I choose my own Client Name as I've seen in other apps?
You can set client name and the scope by goinog on the Manage client API access page. Register your client in the Authorize a new API client settings.
Enter the client name provided by the third-party vendor and specify the scope. Add a new client by entering the client name (OAuth consumer key) and API scope and clicking "Authorize". You should verify that the client is known to you and that they have an appropriately small scope of access.
For each client, you can specify multiple APIs, separated by commas. For example, to allow access to both the Contacts and Documents List APIs: "http://www.google.com/m8/feeds/, http://www.google.com/feeds/". The list of clients is unique, and cannot have two entries in the list for one OAuth client. You can use any of the Google APIs that currently support two-legged OAuth for Google Apps domains
Authorized API Clients
Add your APIs from the list of approved clients and their scope.
After the client has been added, you can remove a client that has a specified API scope by clicking the "Remove" link. If the client is the OAuth consumer key for your Google Apps domain, you'll see the link, "Manage". Clicking this link takes you to the Manage OAuth key and secret for this domain page where you can edit the client (for example, turn off global API scope access).
For more information about OAuth, please follow this link: https://developers.google.com/identity/protocols/OAuth2ServiceAccount#delegatingauthority
In case you meant how to set the application name when you connect with the php api client, you can use:
$client->setApplicationName('App Name Here');
I'm trying to write some code - just a console app - that will have access to all users' drive files.
With Document List v3 this is easy - just replace the list query's "default" with the user name, and you're away (using client login and admin credentials).
What is the Drive api's way of doing this? How do I retrieve a particular user's files?
There's a java version of this question (I think), but I can't find anything matching in the .Net api OAuth Google API for Java unable to impersonate user