带有 google-api-java-client 的 2 足 OAuth

发布于 2024-09-24 00:07:04 字数 1182 浏览 1 评论 0原文

有谁知道如何将 2-legged OAuth 与 google-api-java-client 一起使用？我正在尝试访问 Google Apps 配置 API 以获取特定域的用户列表。

以下不起作用

HttpTransport transport = GoogleTransport.create();
GoogleHeaders headers = (GoogleHeaders) transport.defaultHeaders;
headers.setApplicationName(APPLICATION_NAME);
headers.gdataVersion = GDATA_VERSION;

OAuthHmacSigner signer = new OAuthHmacSigner();
signer.clientSharedSecret = CONSUMER_SECRET;

OAuthParameters oauthParameters = new OAuthParameters();
oauthParameters.version = OAUTH_VERSION;
oauthParameters.consumerKey = CONSUMER_KEY;
oauthParameters.signer = signer;
oauthParameters.signRequestsUsingAuthorizationHeader(transport);

我得到“com.google.api.client.http.HttpResponseException：401未知授权标头”。标题看起来像这样

OAuth oauth_consumer_key="...", oauth_nonce="...", oauth_signature="...", oauth_signature_method="HMAC-SHA1", oauth_timestamp="...", oauth_version="1.0"

我也尝试过但没有成功

GoogleOAuthDomainWideDelegation delegation = new GoogleOAuthDomainWideDelegation();
delegation.requestorId = REQUESTOR_ID;
delegation.signRequests(transport, oauthParameters);

有什么想法吗？提前致谢。

原文

Does anyone know how to use 2-legged OAuth with google-api-java-client?
I'm trying to access the Google Apps Provisioning API to get the list of users for a particular domain.

The following does not work

HttpTransport transport = GoogleTransport.create();
GoogleHeaders headers = (GoogleHeaders) transport.defaultHeaders;
headers.setApplicationName(APPLICATION_NAME);
headers.gdataVersion = GDATA_VERSION;

OAuthHmacSigner signer = new OAuthHmacSigner();
signer.clientSharedSecret = CONSUMER_SECRET;

OAuthParameters oauthParameters = new OAuthParameters();
oauthParameters.version = OAUTH_VERSION;
oauthParameters.consumerKey = CONSUMER_KEY;
oauthParameters.signer = signer;
oauthParameters.signRequestsUsingAuthorizationHeader(transport);

I get the "com.google.api.client.http.HttpResponseException: 401 Unknown authorization header".
The header looks something like this

OAuth oauth_consumer_key="...", oauth_nonce="...", oauth_signature="...", oauth_signature_method="HMAC-SHA1", oauth_timestamp="...", oauth_version="1.0"

I also tried following without success

GoogleOAuthDomainWideDelegation delegation = new GoogleOAuthDomainWideDelegation();
delegation.requestorId = REQUESTOR_ID;
delegation.signRequests(transport, oauthParameters);

Any ideas?
Thanks in advance.

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

若沐 2024-10-01 00:07:04

看起来代码并没有什么问题。它确实有效。
问题出在我们的 Google Apps 设置上。

当您访问“管理此域的 OAuth 密钥和密码”页面 (https:// /www.google.com/a/cpanel/YOUR-DOMAIN/SetupOAuth），
并启用“两条腿OAuth访问控制”并选择
“允许访问所有API”，实际上并没有允许访问所有API。

如果您之后访问“管理 API 客户端访问”页面
(https://www.google.com/a/cpanel/YOUR-DOMAIN/管理OauthClients），
您会看到有一个条目，例如：

YOR-DOMAIN/CONSUMER-KEY  "This client has access to all APIs"

看来这不包括配置 API。
只有在我们明确添加了 Provisioning API 后，代码才开始工作。
因此，要启用 Provisioning API，您的列表中还应该有类似以下条目的内容：

YOR-DOMAIN/CONSUMER-KEY  Groups Provisioning (Read only) https://apps-apis.google.com/a/feeds/group/#readonly 
                         User Provisioning (Read only)  https://apps-apis.google.com/a/feeds/user/#readonly

其他人也遇到了同样的问题：

http://www.gnegg.ch/2010/06/google-apps-provisioning-two-legged-oauth/

Sasa

It seems that there was nothing wrong with the code. It actually works.
The problem was with the our Google Apps setup.

When you visit the "Manage OAuth key and secret for this domain" page (https://www.google.com/a/cpanel/YOUR-DOMAIN/SetupOAuth),
and enable "Two-legged OAuth access control" and select
"Allow access to all APIs", it doesn't actually allow access to all APIs.

If you visit the "Manage API client access" page after that
(https://www.google.com/a/cpanel/YOUR-DOMAIN/ManageOauthClients),
you'll see that there is an entry like:

YOR-DOMAIN/CONSUMER-KEY  "This client has access to all APIs"

It seems that this doesn't include Provisioning API.
Only after we explicitly added the Provisioning API, the code started to work.
So to enable Provisioning API, you should also have something like the following entry in your list:

YOR-DOMAIN/CONSUMER-KEY  Groups Provisioning (Read only) https://apps-apis.google.com/a/feeds/group/#readonly 
                         User Provisioning (Read only)  https://apps-apis.google.com/a/feeds/user/#readonly

Somone else had the same problem:

http://www.gnegg.ch/2010/06/google-apps-provisioning-two-legged-oauth/

Sasa

回复收藏 0 原文