How can I use a service account to get the email of a user in a Google Apps domain, without already knowing an email from that domain? -

I am trying to use a service account to access data from a domain that is my app Google Apps Marketplace is installed)

But to get the list of users or the list of admins for any domain, it is necessary to call the Google Admin SDK API That you know the email address of a user in the domain.

  http transport http transport = new net HTTPS transport (); Jacksonfactor jasonfactor = new jacksonfactor (); GoogleCredential credentials = new GoogleCredential.Builder () .setTransport (httpTransport) .setJsonFactory (jsonFactory) .setServiceAccountId (SERVICE_ACCOUNT_EMAIL) .setServiceAccountScopes (DirectoryScopes.ADMIN_DIRECTORY_USERS) .setServiceAccountUser (USEREMAIL) .setServiceAccountPrivateKeyFromP12File (new java.io.File (SERVICE_ACCOUNT_PKCS12_FILE_PATH)). Construction (); Directory Service = New Directory. Builder (httpTransport, jsonfactory, null) .setHttpRequestInitializer (Credential) .build (); Directory.Users.List Request = service.users () .list (). SetDomain (domain);  

The above works, but for this you are called the setServiceAccountUser (userEmail) method on Builder. Without this, when you execute the request, you will get 403 "not authorized for this resource / API error". It is documented by many current questions, such as

But how do you know a userEmail for the first time? You can not already get a list of emails in the domain without knowing an email in the domain. You can archive an email from administrator, which first installs the app - but it looks unfair and insufficient. What if the administrator's account was deleted or the email address changed?

Administrative accounts can not be given to the domain of service accounts; They need to impersonate a Domain Administrator, so an email address is required. Recommended Approach is an archive of the email that you have installed, or a configuration screen where they can set up an email for the administrator account to use. . As you have said, this approach may be a bit delicate, if the admin account has been removed or this email is changed, make sure that you handle that case, by disabling the app and warning the user that the administrator has Have to configure.