cloudworkz / grafana-gsuite-sync Goto Github PK

Before I dive in to this issue I would like to say: Thanks for building this really useful tool. It's small succinct and appears to be exactly what I'm looking for it I could just get beyond this hurdle.

Now my hurdle...

There is no documentation here (or anywhere else) about which permissions are required, or how to set up a service account that can be used when running this tool.

I have been trying to work out the correct workflow and permissions, but without success.

This is what I have got so far:

1. Create Service Account with Project View permission
   • Open the Service accounts page, If prompted, select a project.
   • Click Create service account
   • In the Create service account window, type a name for the service account and click Create
   • Add the Project > Viewer role and click Continue
   • Click Create Key, select Key type JSON and click Create to download the key
   • This is the google credentials file to be passed to grafana-gsuite-sync.
2. Enable G Suite Domain-wide Delegation
   • Open the Service accounts page, If prompted, select a project.
   • Click the newly created service account
   • Click Edit
   • Expand the Show Domain-Wide Delegation section.
   • Check the * Enable G Suite Domain-wide Delegation* checkbox
   • Click Save
   • Copy the Client ID to grant API client access over your domain
3. Grant API client access
   • Go to your G Suite domain's Admin Console
   • Select Security from the list of controls. If you don't see Security listed, select More controls from the grey bar at the bottom of the page, then select Security from the list of controls.
   • Select Advanced settings from the list of options.
   • Select Manage API client access from the Authentication section.
   • In the Client name field enter the service account's Client ID.
   • In the One or More API Scopes field enter the list of scopes that your application should be granted access to (see image below). For example if you need domain-wide access to Users and Groups enter: https://www.googleapis.com/auth/admin.directory.user, https://www.googleapis.com/auth/admin.directory.group
   • Click the Authorize button.

When running this tool after following this process I get this error:

[2019-01-23T17:16:52.621Z] ERROR (49472 on EmergencyBacon.local): Not Authorized to access this resource/api
    Error: Not Authorized to access this resource/api
        at createError (/Users/uatec/Development/google-cloud-tools/grafana-gsuite-sync/node_modules/axios/lib/core/createError.js:16:15)
        at settle (/Users/uatec/Development/google-cloud-tools/grafana-gsuite-sync/node_modules/axios/lib/core/settle.js:18:12)
        at Unzip.handleStreamEnd (/Users/uatec/Development/google-cloud-tools/grafana-gsuite-sync/node_modules/axios/lib/adapters/http.js:201:11)
        at Unzip.emit (events.js:187:15)
        at endReadableNT (_stream_readable.js:1094:12)
        at process._tickCallback (internal/process/next_tick.js:63:19)

If you can give me a few pointers I can raise a PR to document this process.

This script currently requires that Grafana have basic http authentication enabled, but some teams prefer to disable it in favor of oauth2 or other federated logins. Grafana does have a method for bearer token auth with API keys, and it would be nice if this script could use it: http://docs.grafana.org/http_api/auth/