Bootstrap first access error about loaner HOT 20 CLOSED

Hello,

Was anybody able to fix this issue? Thanks and regards!

from loaner.

This usually means that the proper permission was not assigned in order for the directory api to manage users in your domain. Please make sure that you've done all of the steps in step 2 of https://github.com/google/loaner/blob/master/docs/setup_guide.md and double check that the correct scopes have been added for step 2v.

from loaner.

@antoine-castex did you get this resolved yet? I'm running into the same issue and double checked my work.

from loaner.

This usually means that the proper permission was not assigned in order for the directory api to manage users in your domain. Please make sure that you've done all of the steps in step 2 of https://github.com/google/loaner/blob/master/docs/setup_guide.md and double check that the correct scopes have been added for step 2v.

I have check with my team

the scope are

admin.directory.device.chromeos
admin.directory.group.member.readonly
admin.directory.orgunit
admin.directory.user.readonly

is that good ?

from loaner.

@antoine-castex did you get this resolved yet? I'm running into the same issue and double checked my work.

problem still here :(

from loaner.

I can see the cron job in error for the same reason

Forbidden (/base/alloc/tmpfs/dynamic_runtimes/python27g/3b44e98ed7fbb86b/python27/python27_lib/versions/third_party/webapp2-2.5.2/webapp2.py:1552)
Traceback (most recent call last):
File "/base/alloc/tmpfs/dynamic_runtimes/python27g/3b44e98ed7fbb86b/python27/python27_lib/versions/third_party/webapp2-2.5.2/webapp2.py", line 1535, in call
rv = self.handle_exception(request, response, e)
File "/base/alloc/tmpfs/dynamic_runtimes/python27g/3b44e98ed7fbb86b/python27/python27_lib/versions/third_party/webapp2-2.5.2/webapp2.py", line 1529, in call
rv = self.router.dispatch(request, response)
File "/base/alloc/tmpfs/dynamic_runtimes/python27g/3b44e98ed7fbb86b/python27/python27_lib/versions/third_party/webapp2-2.5.2/webapp2.py", line 1278, in default_dispatcher
return route.handler_adapter(request, response)
File "/base/alloc/tmpfs/dynamic_runtimes/python27g/3b44e98ed7fbb86b/python27/python27_lib/versions/third_party/webapp2-2.5.2/webapp2.py", line 1102, in call
return handler.dispatch()
File "/base/alloc/tmpfs/dynamic_runtimes/python27g/3b44e98ed7fbb86b/python27/python27_lib/versions/third_party/webapp2-2.5.2/webapp2.py", line 572, in dispatch
return self.handle_exception(e, self.app.debug)
File "/base/alloc/tmpfs/dynamic_runtimes/python27g/3b44e98ed7fbb86b/python27/python27_lib/versions/third_party/webapp2-2.5.2/webapp2.py", line 570, in dispatch
return method(*args, **kwargs)
File "/base/data/home/apps/sgbl-ist-ve-grabngo/deploy-first.414093468639346751/loaner/web_app/backend/handlers/cron/sync_user_roles.py", line 31, in get
sync_users.sync_user_roles()
File "/base/data/home/apps/sgbl-ist-ve-grabngo/deploy-first.414093468639346751/loaner/web_app/backend/lib/sync_users.py", line 36, in sync_user_roles
constants.SUPERADMINS_GROUP)
File "/base/data/home/apps/sgbl-ist-ve-grabngo/deploy-first.414093468639346751/loaner/web_app/backend/clients/directory.py", line 337, in get_all_users_in_group
response = self._users_in_group(group_email)
File "/base/data/home/apps/sgbl-ist-ve-grabngo/deploy-first.414093468639346751/loaner/web_app/backend/clients/directory.py", line 379, in _users_in_group
raise DirectoryRPCError(err.resp.reason)
DirectoryRPCError: Forbidden

from loaner.

my grab n go gsuite account is owner the google group created

how can i have miss for permissions ?

from loaner.

Hello,
Is there any update here?
We are also stuck at this step. You can click on the other sections of the application, but seems like we are missing a step somewhere...

from loaner.

Sorry for the delay. Have you created a custom GSuite role to provide access to the Directory of GSuite? This is done with admin roles at the role account level.

https://support.google.com/a/answer/2406043?hl=en

Additionally, if you haven't yet, we recommend pulling from head as many bugs have been fixed since this issue was opened.

from loaner.

Hello,
The we used a service account called svc-loaner-role@ that we created. It does not have the super admin role, but it has elevated access.
Groups Admin
User Managment
Services Admin
A new Custom role that I created that gives the ability to create OUs and modify them.
I can send a screen shot if needed, but this user has the ability to create/delete, and take all actions against users.

What do you mean when you say pull from "head" ?
I'm using Alpha-0.7
git clone -b Alpha-(0.7) https://github.com/google/loaner.git

Also I noticed in the release notes:
"Known issues
You must manually create the GSuite Chrome organizational units as the app cannot yet create them."
I have created the OUs that will be needed, and even created the Prod, QA, and Dev.

Thanks,

from loaner.

For the missing permissions, you're likely missing access to the GSuite Directory within the Admin API privileges (https://admin.google.com/AdminHome#DomainSettings/notab=1&subtab=roles). I believe the permissions in the screenshot below are accurate. You could also try temporarily providing super admin to the role-account to see if that remediates the issue to confirm the root cause of the issue.

As for pulling from HEAD, that's by using "git clone https://github.com/google/loaner.git" without the branch specification (will pull the latest changes).

from loaner.

Hi,
Here's some screen shots of the Admin roles this account currently has, as well as the permissions of the custom admin role(This is just the OU part of the admin role, not the other permissions(This account is very close to being super admin)).


Here's the screen shot of the error that we are getting:

The OUs have been created exactly as the docs have explained. We have Grab n Go, then Prod, then Default and Guest Enabled.
Thanks,

from loaner.

@gyoshi02 can you confirm the OU structure that you have and what you configured for the OU settings in the constants.py and config_defaults.yaml file?

from loaner.

@ helfrichmichael
Here's the OU Structure that we have in place:

Here's the constants.py entries:

So my config_defaults.yaml is default settings, as I thought we didn't have to update this yet.
" (Optional) Customize GnG Settings " I must have assumed it wasn't required.
Should I update the OU setting here and try again?

from loaner.

So I updated the config_defaults.yaml to reflect some of the OU values and the technician email address. Does the Org unit prefix (if I'm using root) = /Grab n Go/Prod/ ?

Or is this value just "/" because we have created the /Grab n Go" OU right off of our Root within the domain?
Also still getting that error as before.

thanks,

from loaner.

@gyoshi02 what are the errors in the Log Viewer on Google Cloud Platform for this error? Can you confirm that this is targeting PROD and not DEV/QA?

from loaner.

@helfrichmichael

Here's a screen shot of something I found in the logs.

I'm guessing this means I need to create all of the OUs, for Dev and QA(even though I'm not using them yet).
I'll try to re-deploy again, now that I've create these new OUs.
Is there anything else that I should be looking for within these errors?
Thanks,

from loaner.

@gyoshi02 my major concern is that the app looks like it is targeting the dev version and not the prod version. This means the matcher isn't able to match the project ID to the instance you're running.

https://github.com/google/loaner/blob/master/loaner/web_app/constants.py#L75 is where we detect which version of the application you are running for the web app. Make sure that has the correct project name and that the settings are properly defined.

from loaner.

@helfrichmichael
I missed your updated, and went ahead and created all of the additional OUs.
We currently only have a project ID for Prod.
I assumed that since we were not using QA and DEV, we shouldn't need to create them.
I've got 4 green check marks now.

We can begin testing enrollments and other parts of this project.
Thanks for your assistance.

from loaner.

I'm going to close this as we've addressed the culprit in this thread. If this reappears, please re-open.

from loaner.