[Bug] Google Classroom function bug collection

[scrthq]

Current bugs with Google Classroom specific functions and their status:

• 1. Intermittent Service Creation issue: New-GoogleService : Cannot find an overload for "ClassroomService" and the argument count: "1"
• 2. Get-GSCourse: Get-GSCourse : Exception calling "Execute" with "0" argument(s): "Object reference not set to an instance of an object."
  • Deployed in v2.14.1
• 3. Get-GSCourseParticipant: Add-Member : Cannot add a member with the name "CourseId" because a member with that name already exists. To overwrite the member anyway, add the Force parameter to your command.
  • Deployed in v2.14.1
• 4. Get-GSCourseParticipant & Get-GSClassroomUserProfile do not return the EmailAddress property in the profile object. WIP

[scrthq]

@IronKane2 - Tracking issues here

[scrthq]

For item 2, it looks like the Classroom API balks when trying to submit the request to list Courses in all of the valid CourseStates, which is why it was failing; default value is set to request all CourseStates, that has been removed in Dev. Also tested different combinations of CourseStates and here are the following that work:

• ACTIVE,DECLINED (either together or by themselves)
• ARCHIVED (by itself)
• PROVISIONED (by itself)
• SUSPENDED (by itself)
• COURSESTATEUNSPECIFIED (by itself)

---

For item 3, the calls to Add-Member have been removed from Get-GSCourseParticipant in Dev. Shouldn't have that issue once 2.14.1 comes out shortly.

[scrthq]

@IronKane2 - PSGSuite v2.14.1 is available now on the Gallery with fixes for items 2 and 3. Please take note in my previous comment about CourseState clashes.

https://www.powershellgallery.com/packages/PSGSuite/2.14.1

[IronKane2]

I tried creating a new GSCourse and received an error about permission. Should there be a param for domain? I am our Google domain SA. I tested the account permissions by creating a new student.

PS C:\Users> New-GSCourse -Name "Steve Test Class" -OwnerId srcampbell@ourdomain.net -Section s01 -Room "Secret Lab" -CourseState ACTIVE

New-GSCourse : Exception calling "Execute" with "0" argument(s): "Google.Apis.Requests.RequestError
The caller does not have permission [403]
Errors [
Message[The caller does not have permission] Location[ - ] Reason[forbidden] Domain[global]
]
"
At line:1 char:2

• New-GSCourse -Name "Steve Test Class" -OwnerId srcampbell@ourdomain.net ...

•  + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
   + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,New-GSCourse
  

[scrthq]

Checking the scopes out on the function to make sure they're correct. Just to confirm, you updated the API Client access per the Initial Setup doc and included the bottom, separate section that includes the Classroom specific scopes? Usually 403's like that happen because either the method being used is accompanied by an incorrect scope or the exact scope being used hasn't been specified for API Client Access. [image: image.png]

…

On Wed, Oct 3, 2018 at 10:03 AM IronKane2 ***@***.***> wrote: I tried creating a new GSCourse and received an error about permission. Should there be a param for domain? I am our Google domain SA. I tested the account permissions by creating a new student. PS C:\Users> New-GSCourse -Name "Steve Test Class" -OwnerId ***@***.*** -Section s01 -Room "Secret Lab" -CourseState ACTIVE New-GSCourse : Exception calling "Execute" with "0" argument(s): "Google.Apis.Requests.RequestError The caller does not have permission [403] Errors [ Message[The caller does not have permission] Location[ - ] Reason[forbidden] Domain[global] ] " At line:1 char:2 - New-GSCourse -Name "Steve Test Class" -OwnerId ***@***.*** ... - + CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,New-GSCourse — You are receiving this because you were assigned. Reply to this email directly, view it on GitHub <#87 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AMIo3aPXAP6OrSVdtl1IGSrIQPjJXhmbks5uhO3dgaJpZM4XDIQe> .

[IronKane2]

Yes I did. I double checked before posting. Then created a user to make sure I had a good session going.

[scrthq]

Gotcha! Diving in! Thanks for continuing to pass these bumps along!

[scrthq]

@IronKane2 - Just checked the scope for Get-GSCourse and it's correct. Are you managing multiple domains within your account and if so, is your AdminEmail within the same domain as the Classroom domain? Could you also try specifying a teacher's email for the -User parameter and see if that yields any different results?

[scrthq]

also, confirmed that the scope for New-GSCourse appears to be correct as well.

Let me know if any of the Get-* Classroom functions work for you or if they're all returning 403's

Other things to confirm:

• Your Admin account is in an OU with Classroom enabled: https://support.google.com/edu/classroom/answer/6023715
• Classroom API access is enabled for the SuperAdmin role (assuming it should be by default, but worth confirming): https://support.google.com/edu/classroom/answer/6250906

[IronKane2]

Students are in a child domain, but it wasn't referenced in the New-GSCourse cmd I executed. I've been using the Get-GSCourse with no issues. I looked at the API Client Access again and it looks good.

I was reading your 2nd link and my Admin Console has "Users can authorize apps to access their Google Classroom data." checked. Should that be unchecked?

[scrthq]

Gotcha! I think my takeaway from this is to add the User parameter to the remainder of the Classroom functions for cases where your admin account may not have the ability to do certain things like creating courses so you can impersonate a user with the required level of access. Glad to hear the Get-* commands are working without issue! That specific setting shouldn't matter IMHO, but even so, I think leaving it checked would be the better option anyway.

…

On Thu, Oct 4, 2018 at 11:20 AM IronKane2 ***@***.***> wrote: Students are in a child domain, but it wasn't referenced in the New-GSCourse cmd I executed. I've been using the Get-GSCourse with no issues. I looked at the API Client Access again and it looks good. I was reading your 2nd link and my Admin Console has "Users can authorize apps to access their Google Classroom data." checked. Should that be unchecked? — You are receiving this because you were assigned. Reply to this email directly, view it on GitHub <#87 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AMIo3YbuxGCa0GKb_KU3XjcKUAqwo7YFks5uhjVbgaJpZM4XDIQe> .

[scrthq]

@IronKane2 - v2.15.1 deploying now with the additional -User parameter for all of the relevant classroom functions. Try it out with New-GSCourse by passing an admin user's email there for the Classroom domain. If there aren't any admins specific to that domain, I believe a teacher's email would suffice. Let me know if this gets you going!

[IronKane2]

I finally got it to work. Not sure what I did. I was trading emails with one of the helpful staff at AmplifiedIT and added my account to the classroom_teachers group. That might be what fixed it. It wasn't immediate and I just happened to try one more time. Thanks again for your hard work on this.

[scrthq]

That's awesome to hear, @IronKane2! Any other issues that you've run into so far for the Classroom functions?

[IronKane2]

Add-GSCourseParticipant : Cannot convert argument "body", with value: "student@uni.edu", for "Create" to type "Google.Apis.Classroom.v1.Data.Student": "Cannot convert the "student@uni.edu" value of type 
"System.String" to type "Google.Apis.Classroom.v1.Data.Student"."
At line:1 char:1
+ Add-GSCourseParticipant -CourseId 19487328166 -Student student@uni. ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Add-GSCourseParticipant

[IronKane2]

Looking at https://developers.google.com/classroom/guides/manage-users
It seems that it might want a student object and not a email string.

[scrthq]

@IronKane2 - You are correct, I was just about to respond as well. I'm on it! Keeping sending any over as you run across them 👍

[scrthq]

Found the issue! It's creating the Student object, but it's passing the email as the body parameter to the Create() method instead of the Student object. Fix coming up shortly!

[IronKane2]

I don't know if this is a bug, but Get-GSClassroomParticipants returns a Profile object with a email field that comes up blank.

[scrthq]

Get-GSClassroomParticipants doesn't exist in the latest version (I believe that was only during the initial development). Check the version of PSGSuite you're running and update to 2.15.2 if you can; the function you're looking for is Get-GSCourseParticipant, I believe. Let me know if you have the same results there, checking into specifying Fields as well.

If you're still having issues on the latest version, can you send one of the resulting objects over so I can see what's being returned? The email/ID of the participant should be in the top-level UserId property of the returned object. If the object has Google.Apis.Classroom.v1.Data.UserProfile for the Profile property's value, you'll need to expand the Profile property to see the underlying values since it's another object.

[IronKane2]

sorry, I mis-typed.

PS C:\> Get-GSCourseParticipant -CourseId $t.Id

CourseId    Profile                                   UserId                ETag
--------    -------                                   ------                ----
19478966574 Google.Apis.Classroom.v1.Data.UserProfile 11403168604162104091     
19478966574 Google.Apis.Classroom.v1.Data.UserProfile 11824804976777876216     
19478966574 Google.Apis.Classroom.v1.Data.UserProfile 11053514128638965465     
19478966574 Google.Apis.Classroom.v1.Data.UserProfile 10845153571965700717     



PS C:\Users\djusdadmin> (Get-GSCourseParticipant -CourseId $t.Id).profile


EmailAddress    : 
Id              : 1140316860416210409
Name            : Google.Apis.Classroom.v1.Data.Name
Permissions     : {Google.Apis.Classroom.v1.Data.GlobalPermission}
PhotoUrl        : 
VerifiedTeacher : True
ETag            : 

EmailAddress    : 
Id              : 1182480497677787621
Name            : Google.Apis.Classroom.v1.Data.Name
Permissions     : 
PhotoUrl        : 
VerifiedTeacher : 
ETag            : 

EmailAddress    : 
Id              : 1105351412863896546
Name            : Google.Apis.Classroom.v1.Data.Name
Permissions     : 
PhotoUrl        : 
VerifiedTeacher : 
ETag            : 

EmailAddress    : 
Id              : 1084515357196570071
Name            : Google.Apis.Classroom.v1.Data.Name
Permissions     : 
PhotoUrl        : 
VerifiedTeacher : 
ETag            : 

[IronKane2]

I just spoke with my Director of Technology and she concurs about letting teachers remove students as a manual process on their end. Takes the target off of my back ;)

[scrthq]

Makes sense! Worst case scenario, you can use Remove-GSCourseParticipant to automate things later =]

[scrthq]

@IronKane2 - v2.18.0 with the Fields parameter on those 2 functions released! I also included Sync-GSUserCache, which fills the variable $global:GSUserCache with a hashtable containing the following keys by default (you can specify others with the Keys parameter):

• PrimaryEmail
• Id
• All Aliases

Usage:

# Let it store in the global variable only
Sync-GSUserCache
$global:GSUserCache['user@domain.com'] # Gets the user object by primary email
$global:GSUserCache['u@domain.com'].PrimaryEmail # Gets a user's primary email via an alias

# Alternatively, include -PassThru and store it in a local variable as well
$hash = Sync-GSUserCache -PassThru
$hash['user@domain.com'] # Gets the user object by primary email
$hash['u@domain.com'].PrimaryEmail # Gets a user's primary email via an alias

# Supply a filter if you'd like to only sync a subset of users
$hash = Sync-GSUserCache -Filter "IsSuspended -eq '$false'"
$hash.Keys -contains 'activeuser@domain.com' # This would return True
$hash.Keys -contains 'suspendeduser@domain.com' # This would return false, even though it is a valid email in the domain

[scrthq]

For usage on the Fields parameter, Fields for Google APIs usually follow one of the following naming conventions:

• camelCase - -Fields primaryEmail,orgUnitPath
• PascalCase - -Fields PrimaryEmail,OrgUnitPath

They also vary when specifying sub-property fields:

• Dot-separated - -Fields 'profile.id','profile.emailAddress'
• Slash-separated - -Fields 'profile/id','profile/emailAddress'

I would try out something like the following and see what returns, what throws an error, etc:

$t = (Get-GSCourse)[0]

# 1 - camelCase w/ top level fields only
Get-GSCourseParticipant -CourseId $t.Id -Fields id,profile,eTag

# 2 - camelCase w/ wildcard deeper field and slash separator
Get-GSCourseParticipant -CourseId $t.Id -Fields id,profile,'profile/*',eTag

# 3 - camelCase w/ specified deeper field and slash separator
Get-GSCourseParticipant -CourseId $t.Id -Fields id,profile,'profile/emailAddress',eTag

# 4 - camelCase w/ specified deeper field and dot separator
Get-GSCourseParticipant -CourseId $t.Id -Fields id,profile,'profile.emailAddress',eTag

# 5 - camelCase w/ wildcard deeper field and dot separator
Get-GSCourseParticipant -CourseId $t.Id -Fields id,profile,'profile.emailAddress',eTag

# 6 - PascalCase w/ top level fields only
Get-GSCourseParticipant -CourseId $t.Id -Fields Id,Profile,ETag

# 7 - PascalCase w/ wildcard deeper field and slash separator
Get-GSCourseParticipant -CourseId $t.Id -Fields Id,Profile,'Profile/*',ETag

# 8 - PascalCase w/ specified deeper field and slash separator
Get-GSCourseParticipant -CourseId $t.Id -Fields Id,Profile,'Profile/EmailAddress',ETag

# 8 - PascalCase w/ specified deeper field and dot separator
Get-GSCourseParticipant -CourseId $t.Id -Fields Id,Profile,'Profile.EmailAddress',ETag

# 8 - PascalCase w/ wildcard deeper field and dot separator
Get-GSCourseParticipant -CourseId $t.Id -Fields Id,Profile,'Profile.*',ETag

[jdstanberry]

I have a solution for Get-CourseParticipant not returning an email address. In $ServiceParams set the scope as @('https://www.googleapis.com/auth/classroom.rosters', 'https://www.googleapis.com/auth/classroom.profile.emails')

[scrthq]

@jdstanberry - thank you! Going to get this updated and another version pushed out ASAP.

[jdstanberry]

You can get the full profile with: Scope = @('https://www.googleapis.com/auth/classroom.rosters', ' https://www.googleapis.com/auth/classroom.profile.emails', ' https://www.googleapis.com/auth/classroom.profile.photos')

…

On Thu, Nov 8, 2018 at 9:57 AM Nate Ferrell ***@***.***> wrote: @jdstanberry <https://github.com/jdstanberry> - thank you! Going to get this updated and another version pushed out ASAP. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#87 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AnmWpZM4ztIShNCn0dnQUrVsA__u5H8lks5utGJ8gaJpZM4XDIQe> .

-- Justin Stanberry System Administrator Palo Verde ESD 623.327.3690 623.252.1757 (cell)

-- This email sent from Palo Verde Elementary School G Suite for Education.

[scrthq]

Made the update and confirmed it doesn't balk when trying to create the service. Thanks, @jdstanberry!! Should have this out shortly =]

[scrthq]

Big thanks to @jdstanberry for pointing out the additional scopes!

@IronKane2 - v2.18.1 is now available on the PowerShell Gallery! Try it out and see if you're getting that EmailAddress value back now =]

[Foggy2]

Posting in this issue as I suspect that it is linked to the changes that have been made. Using v2.18.1 Get-GSCourseParticipant appears to now be broken.

I have tested the same commands with v2.17.2 and the command works as intended.

[scrthq]

@Foggy2 this is indeed the correct spot, thanks for testing and letting me know! Looks like overscoped on that one.

Can you try out Get-GSClassroomUserProfile and see if you're getting the same error?

_{Sent with GitHawk}

[Foggy2]

@scrthq Yes, same error.

[Foggy2]

I see a reference to a similar error posted in this issue previously so posting again here to keep it all together.

I have reverted to v2.17.2 for the moment while the other error I posted above is being resolved. So the below is using v2.17.2.

I believe everything is configured correctly on my end:

• I have verified that the scopes are present in the API Client access in Google Admin Console.
• I can issue Get-* Classroom commands
• I can use the Add-GSCourseParticipant command without error.
• I even put the admin account in the classroom_teachers group.
• I have also tried user the -User parameter and impersonating other teachers assigned to the course and other super admin accounts

Any thoughts why I can add teachers but not remove them?

[scrthq]

@Foggy2 - Can you update your scopes for your Service Account in the Admin Console @ API Client Access? The Classroom API functions are pretty new, so there's a chance that you may not included the newer Classroom scopes when you set it up.

Here's the link to the Initial Setup page with instructions on accessing that page in the Admin Console: https://github.com/scrthq/PSGSuite/wiki/Initial-Setup#adding-api-client-access-in-admin-console

And here's the list of scopes that you'll need to copy/paste:

https://apps-apis.google.com/a/feeds/emailsettings/2.0/,
https://mail.google.com/,
https://sites.google.com/feeds,
https://www.google.com/m8/feeds/contacts,
https://www.googleapis.com/auth/activity,
https://www.googleapis.com/auth/admin.datatransfer,
https://www.googleapis.com/auth/admin.directory,
https://www.googleapis.com/auth/admin.directory.customer,
https://www.googleapis.com/auth/admin.directory.device.mobile,
https://www.googleapis.com/auth/admin.directory.domain,
https://www.googleapis.com/auth/admin.directory.group,
https://www.googleapis.com/auth/admin.directory.orgunit,
https://www.googleapis.com/auth/admin.directory.rolemanagement,
https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly,
https://www.googleapis.com/auth/admin.directory.user,
https://www.googleapis.com/auth/admin.directory.user.readonly,
https://www.googleapis.com/auth/admin.directory.user.security,
https://www.googleapis.com/auth/admin.directory.resource.calendar,
https://www.googleapis.com/auth/admin.directory.userschema,
https://www.googleapis.com/auth/admin.reports.audit.readonly,
https://www.googleapis.com/auth/admin.reports.usage.readonly,
https://www.googleapis.com/auth/apps.groups.settings,
https://www.googleapis.com/auth/apps.licensing,
https://www.googleapis.com/auth/calendar,
https://www.googleapis.com/auth/chat.bot,
https://www.googleapis.com/auth/drive,
https://www.googleapis.com/auth/gmail.settings.basic,
https://www.googleapis.com/auth/gmail.settings.sharing,
https://www.googleapis.com/auth/plus.login,
https://www.googleapis.com/auth/plus.me,
https://www.googleapis.com/auth/tasks,
https://www.googleapis.com/auth/tasks.readonly,
https://www.googleapis.com/auth/urlshortener,
https://www.googleapis.com/auth/userinfo.email,
https://www.googleapis.com/auth/userinfo.profile,
https://www.googleapis.com/auth/classroom.courses,
https://www.googleapis.com/auth/classroom.rosters,
https://www.googleapis.com/auth/classroom.rosters.readonly,
https://www.googleapis.com/auth/classroom.profile.emails,
https://www.googleapis.com/auth/classroom.profile.photos,
https://www.googleapis.com/auth/classroom.coursework.me,
https://www.googleapis.com/auth/classroom.coursework.students,
https://www.googleapis.com/auth/classroom.announcements,
https://www.googleapis.com/auth/classroom.guardianlinks.students,
https://www.googleapis.com/auth/classroom.push-notifications

[scrthq]

I saw the first part of your message but should mention that I just updated the wiki to include the additional profile scopes

_{Sent with GitHawk}

[Foggy2]

@scrthq - Just double checked the scopes. I had all but the profiles scopes which I have now added.

Still getting the error though.

[Foggy2]

@scrthq - Figured it out. The error was something on my part although it wasn't immediate clear what I was doing was not allowed.

The user I was attempting to remove from the class was set as the class owner. As soon as I changed the owner of the class to the other teacher assigned to the class, the Remove-GSCourseParticipant succeeded.

It would have been more useful if Google would provide a better error message other than 'The caller does not have permission' as this implies a scoping issue as you suggested.

This is illustrated in the below screen capture.

Would it be possible to test for this error condition upon receiving an error response from the API to help point other users towards the real cause? The Google API documentation did not mention this requirement at all. (At least in the pages I read trying to solve this) So I think other users would find it helpful if the real cause was indicated.

[scrthq]

@Foggy2 -Thanks for digging in on that one and figuring it out! We should be able to test for that specific message, but I'd need to see if there are any other errors which could throw the same message. At the very least, the docs/comment based help can be updated to advise that removal of a course owner will return that error.

Considering you checked your scopes and re-pasted them recently, can you try out Get-GSCourseParticipant and/or Get-GSClassroomUserProfile to see if you're still getting the same errors as prior?

[Foggy2]

@scrthq - Just tested using v2.19.0. Get-GSCourseParticipant and Get-GSClassroomUserProfile both are working with the extra scopes.

I can also confirm that the EmailAddress is populated in the returned results for both commands.

[scrthq]

@Foggy2 - Fantastic, thank you for checking! Paging @IronKane2 to check when able as well =]. Follow up thanks to @jdstanberry for the pointer also.

[scrthq]

Hey guys - going to close this out, as I feel like the Classroom functions are pretty stable now with no other outstanding issues to note. Feel free to open a new issue if anything new pops up!

[IronKane2]

Hey all, I'm back. I was experiencing that error, but after getting caught up, I updated my scopes and it works great! Thank you so much for getting those email addresses in the Get-GSCourseParticipant.
I think you can put this to bed.

Sorry my posting is re-opening this, but I really wanted to express my appreciation for all your hard work. I love PSGSuite! You've made my life much easier.

[scrthq]

Cheers, @IronKane2! ❤️