Für die später in diesem Thema beschriebenen Apigee API-Aufrufe benötigen Sie ein Autorisierungstoken mit der Rolle "Administrator der Apigee-Organisation".
Wenn Sie nicht der Inhaber des Google Cloud-Projekts sind, das mit Ihrer Apigee Hybrid-Organisation verknüpft ist, prüfen Sie, ob Ihr Google Cloud-Nutzerkonto die Rolle roles/apigee.admin (Administrator der Apigee-Organisation) hat. Sie können die Ihnen zugewiesenen Rollen mit diesem Befehl prüfen:
Wenn Ihre Rollen nicht roles/apigee.admin enthalten, fügen Sie Ihrem Nutzerkonto die Rolle Apigee-Organisationsadministrator hinzu. Verwenden Sie den folgenden Befehl, um Ihrem Nutzerkonto die Rolle hinzuzufügen:
Rufen Sie ein Autorisierungstoken für Ihr Nutzerkonto ab:
export TOKEN=$(gcloud auth print-access-token)
Sie können die Umgebungsvariable $TOKEN mit dem folgenden Befehl prüfen:
echo $TOKEN
Synchronizer-Zugriff aktivieren
So aktivieren Sie den Synchronizer-Zugriff:
Rufen Sie die E-Mail-Adresse des Dienstkontos ab, auf das Sie Synchronizer-Zugriff gewähren.
Für Nicht-Produktionsumgebungen (wie in dieser Anleitung vorgeschlagen) sollte der Wert apigee-non-prod sein. In Produktionsumgebungen sollte es apigee-synchronizer sein. Verwenden Sie den folgenden Befehl:
gcloud iam service-accounts list --filter "apigee-non-prod"
Wenn es mit dem Muster apigee-non-prod@$ORG_NAME.iam.gserviceaccount.com übereinstimmt, können Sie dieses Muster im nächsten Schritt verwenden.
Rufen Sie die setSyncAuthorization API mit dem folgenden Befehl auf, um die erforderlichen Berechtigungen für Synchronizer zu aktivieren:
Sie haben jetzt festgelegt, dass Ihre Apigee Hybrid-Laufzeit- und -Verwaltungsebenen miteinander kommunizieren können. Als Nächstes wenden Sie Ihre Konfiguration auf die Hybrid-Laufzeit an und schließen die Installation von Apigee Hybrid ab.
[[["Leicht verständlich","easyToUnderstand","thumb-up"],["Mein Problem wurde gelöst","solvedMyProblem","thumb-up"],["Sonstiges","otherUp","thumb-up"]],[["Schwer verständlich","hardToUnderstand","thumb-down"],["Informationen oder Beispielcode falsch","incorrectInformationOrSampleCode","thumb-down"],["Benötigte Informationen/Beispiele nicht gefunden","missingTheInformationSamplesINeed","thumb-down"],["Problem mit der Übersetzung","translationIssue","thumb-down"],["Sonstiges","otherDown","thumb-down"]],["Zuletzt aktualisiert: 2025-08-28 (UTC)."],[[["\u003cp\u003eThis documentation refers to Apigee hybrid version 1.5, which is end-of-life and requires an upgrade to a newer version.\u003c/p\u003e\n"],["\u003cp\u003eTo utilize the Apigee API, you must acquire an authorization token with the Apigee Organization Admin role, which can be done using the \u003ccode\u003egcloud\u003c/code\u003e tool and the \u003ccode\u003eroles/apigee.admin\u003c/code\u003e role.\u003c/p\u003e\n"],["\u003cp\u003eTo enable synchronizer access, you will need to determine the correct service account email, and then use the \u003ccode\u003esetSyncAuthorization\u003c/code\u003e API call, after setting your variables, to enable the synchronizer permissions.\u003c/p\u003e\n"],["\u003cp\u003eYou can verify the service account settings by using the \u003ccode\u003egetSyncAuthorization\u003c/code\u003e API call to get a list of authorized service accounts.\u003c/p\u003e\n"]]],[],null,["# Step 8: Enable Synchronizer access\n\n| You are currently viewing version 1.5 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\nGet an authorization token\n--------------------------\n\n\nTo make the Apigee API calls described later in this topic, you need to get an authorization\ntoken that has the Apigee Organization Admin role.\n\n1. If you are not the owner of the Google Cloud project that is associated with your Apigee hybrid organization, be sure that your Google Cloud user account has the **roles/apigee.admin** (Apigee Organization Admin) role. You can check the roles assigned to you with this command: \n\n ```\n gcloud projects get-iam-policy $PROJECT_ID \\\n --flatten=\"bindings[].members\" \\\n --format='table(bindings.role)' \\\n --filter=\"bindings.members:your_account_email\"\n ```\n\n\n For example: \n\n ```\n gcloud projects get-iam-policy my-project \\\n --flatten=\"bindings[].members\" \\\n --format='table(bindings.role)' \\\n --filter=\"bindings.members:myusername@example.com\"\n ```\n\n\n The output should look something like: \n\n ```\n ROLE\n roles/apigee.admin\n roles/compute.admin\n roles/container.admin\n roles/gkehub.admin\n roles/iam.serviceAccountAdmin\n roles/iam.serviceAccountKeyAdmin\n roles/meshconfig.admin\n roles/owner\n roles/resourcemanager.projectIamAdmin\n roles/servicemanagement.admin\n roles/serviceusage.serviceUsageAdmin\n ```\n2. If you do not have `roles/apigee.admin` in your roles, add the **Apigee\n Organization Admin** role to your user account. Use the following command to add the role to your user account: \n\n ```\n gcloud projects add-iam-policy-binding $PROJECT_ID \\\n --member user:your_account_email \\\n --role roles/apigee.admin\n ```\n\n\n For example: \n\n ```\n gcloud projects add-iam-policy-binding my-project \\\n --member user:myusername@example.com \\\n --role roles/apigee.admin\n ```\n3. Get an authorization token for your user account: \n\n ```\n export TOKEN=$(gcloud auth print-access-token)\n ```\n\n\n You can check the \u003cvar translate=\"no\"\u003e$TOKEN\u003c/var\u003e environment variable with the following command: \n\n ```\n echo $TOKEN\n ```\n\nEnable synchronizer access\n--------------------------\n\n\nTo enable synchronizer access:\n\n1. Get the email address for the service account to which you are granting synchronizer access. For non production environments (as suggested in this tutorial) it should be `apigee-non-prod`. For production environments, it shoudl be `apigee-synchronizer`. Use the following command: \n\n ```\n gcloud iam service-accounts list --filter \"apigee-non-prod\"\n ```\n\n\n If it matches the pattern `apigee-non-prod@`**$ORG_NAME**`.iam.gserviceaccount.com`, you\n can use that pattern in the next step.\n2. Call the [setSyncAuthorization](/apigee/docs/reference/apis/apigee/rest/v1/organizations/setSyncAuthorization) API to enable the required permissions for Synchronizer using the following command: \n\n ```\n curl -X POST -H \"Authorization: Bearer $TOKEN\" \\\n -H \"Content-Type:application/json\" \\\n \"https://apigee.googleapis.com/v1/organizations/$ORG_NAME:setSyncAuthorization\" \\\n -d '{\"identities\":[\"'\"serviceAccount:apigee-non-prod@$ORG_NAME.iam.gserviceaccount.com\"'\"]}'\n ```\n\n\n Where:\n - **`$ORG_NAME`**: The name of your hybrid organization.\n - **`apigee-non-prod$ORG_NAME.iam.gserviceaccount.com`**: The email address of the service account.\n\n | **Tip:** Some shells may return an error like `bad substitution`. In this case, replace \u003cvar translate=\"no\"\u003e$ORG_NAME\u003c/var\u003e with the name of your organization and replace the `\"'\"` with `\"` as follows: \n |\n | ```\n | curl -X POST -H \"Authorization: Bearer $TOKEN\" \\\n | -H \"Content-Type:application/json\" \\\n | \"https://apigee.googleapis.com/v1/organizations/YOUR_ORG_NAME:setSyncAuthorization\" \\\n | -d '{\"identities\":[\"serviceAccount:apigee-non-prod@YOUR_ORG_NAME.iam.gserviceaccount.com\"]}'\n | \n | ```\n3. To verify that the service account was set, use the following command to call the API to get a list of service accounts: \n\n ```\n curl -X POST -H \"Authorization: Bearer $TOKEN\" \\\n -H \"Content-Type:application/json\" \\\n \"https://apigee.googleapis.com/v1/organizations/$ORG_NAME:getSyncAuthorization\" \\\n -d ''\n ```\n\n\n The output looks similar to the following: \n\n ```\n {\n \"identities\":[\n \"serviceAccount:apigee-non-prod@my_project_id.iam.gserviceaccount.com\"\n ],\n \"etag\":\"BwWJgyS8I4w=\"\n }\n ```\n\nYou have now made it possible for your Apigee hybrid runtime and management planes to\ncommunicate. Next, let's apply your configuration to the hybrid runtime and complete your\ninstallation of Apigee hybrid.\n[1](/apigee/docs/hybrid/v1.5/install-create-cluster) [2](/apigee/docs/hybrid/v1.5/install-cert-manager) [3](/apigee/docs/hybrid/v1.5/install-asm) [4](/apigee/docs/hybrid/v1.5/install-apigeectl) [5](/apigee/docs/hybrid/v1.5/install-service-accounts) [6](/apigee/docs/hybrid/v1.5/install-create-tls-certificates) [7](/apigee/docs/hybrid/v1.5/install-configure-cluster) [8](/apigee/docs/hybrid/v1.5/install-enable-synchronizer-access) [(NEXT) Step 9: Install the hybrid runtime](/apigee/docs/hybrid/v1.5/install-hybrid-runtime)\n\n\u003cbr /\u003e"]]
