title: Google authentication with PHP
body: <p>I am an Windows/Active directory architect with 25 years experience working for a small company.  I am trying to develop a way to manage multiple different authentication systems.  One of them is the corporate gmail accounts. I need to be able to both read and write to gmail using Google's admin API.  I am coding this in PHP, and using mySQL for the database backend. My problem is that I cannot get the php script to connect to Google.  It keeps generating the same error:</p>
  
  <pre><code> PHP Fatal error:  Uncaught Google_Service_Exception: {
   "error": {
    "errors": [
     {
      "domain": "global",
      "reason": "forbidden",
      "message": "Not Authorized to access this resource/api"
     }
    ],
    "code": 403,
    "message": "Not Authorized to access this resource/api"
   }
  }
   in D:\Inetpub\WWWRoot\datasync\src\Google\Http\REST.php:118
  Stack trace:
  #0 D:\Inetpub\WWWRoot\datasync\src\Google\Http\REST.php(94): Google_Http_REST::decodeHttpResponse(Object(GuzzleHttp\Psr7\Response), Object(GuzzleHttp\Psr7\Request), 'Google_Service_...')
  #1 D:\Inetpub\WWWRoot\datasync\src\Google\Task\Runner.php(176): Google_Http_REST::doExecute(Object(GuzzleHttp\Client), Object(GuzzleHttp\Psr7\Request), 'Google_Service_...')
  #2 D:\Inetpub\WWWRoot\datasync\src\Google\Http\REST.php(58): Google_Task_Runner-&gt;run()
  #3 D:\Inetpub\WWWRoot\datasync\src\Google\Client.php(798): Google_Http_REST::execute(Object(GuzzleHttp\Client), Object(GuzzleHttp\Psr7\Request), 'Google_Service_...', Array)
  #4 D:\Inetpub\WWWRoot\datasync\src\Google\Service\Resource.ph in D:\Inetpub\WWWRoot\datasync\src\Google\Http\REST.php on line 118
  </code></pre>
  
  <p>The script is using a service account to connect, and a json credential file.  I have insured the service account has access via the admin console/security/Manage API Client Access:</p>
  
  <pre><code>102632896707704106543   View and manage the provisioning of groups on your domain  https://www.googleapis.com/auth/admin.directory.group 
  View and manage the provisioning of users on your domain  https://www.googleapis.com/auth/admin.directory.user
  </code></pre>
  
  <p>I have also insured the service account has been activated with domain wide delegation.  </p>
  
  <p>I have already searched all over the web looking for a solution to this.  </p>
  
  <p>Here is my test script that is generating the errors:</p>
  
  <pre><code>&lt;?php
  require_once __DIR__ . '/vendor/autoload.php';
  
  $credentials_file = './redacted.json';
  
  $client = new \Google_Client();
  $client-&gt;setAuthConfig($credentials_file);
  
  $client-&gt;setApplicationName("webadmin");
  $client-&gt;setSubject("datasync@redacted.iam.gserviceaccount.com");
  $client-&gt;setScopes([
      'https://www.googleapis.com/auth/admin.directory.user',
      'https://www.googleapis.com/auth/admin.directory.user.readonly'
  ]);
  
  $service = new \Google_Service_Directory($client);
  
   echo realpath(dirname(__DIR__)); 
  
  $userKey = 'cperrine@redacted.com';
  
  $results = $service-&gt;users-&gt;get($userKey);
  
  var_dump($results);
  ?&gt;
  </code></pre>
  
  <p>I am missing something, but I don't know what. I have been working on this for a week now and I can't seem to get past it. Any insight would be appreciated. </p>