I'm trying to get a Google Marketplace App to get permissions to run the Provisioning API. When installing on a test domain, the installation process skips the grant access section and doesn't seem to give the permissions needed. The documentation seems to indicate that adding a scope tag with the right url is enough to let new installs grant access for the domain. The app hasn't been listed.
Here's the app manifest:
<?xml version="1.0" encoding="UTF-8" ?>
<ApplicationManifest xmlns="http://schemas.google.com/ApplicationManifest/2009">
  <Name>App</Name>
  <Description>My Cool App</Description>
  <Support>
    <Link rel="support" href="http://www.example.com/support" />
  </Support>
  <Extension id="navLink" type="link">
    <Name>App</Name>
    <Url>http://www.example.com/</Url>
    <Scope ref="userprovisioning" />
  </Extension>
  <!-- Declare our OpenID realm so our app is white listed -->
  <Extension id="realm" type="openIdRealm">
    <Url>http://www.example.com/</Url>
  </Extension>
  <Edition id="free">
    <Name>Free edition</Name>
  </Edition>
  <Scope id="userprovisioning">
    <Url>https://apps-apis.google.com/a/feeds/user/#readonly</Url>
    <Reason>This application lets you see people in your domain.</Reason>
  </Scope>
</ApplicationManifest>