市场应用程序配置API：检查用户是否是管理员

发布于 2024-11-08 18:09:53 字数 2204 浏览 5 评论 0原文

我正在尝试在从 Google Apps 市场安装的应用程序中检查用户是否是其 Google Apps 域的管理员。

我将其添加到manifest.xml：

<Scope id="Provisioning API">
  <Url>https://apps-apis.google.com/a/feeds/user/#readonly</Url>
  <Reason>This application can list domain users to give them permissions.</Reason>
</Scope>

然后我设置了一个测试处理程序以使其正常工作：

from google.appengine.ext import webapp
from google.appengine.ext.webapp import util

import gdata.alt.appengine
import gdata.apps.service
import gdata.auth

# App id, key and secret from the Google Apps Marketplace.
APPLICATION_ID = 'XXX'
CONSUMER_KEY = 'XXX'
CONSUMER_SECRET = 'XXX'

class SetupHandler(webapp.RequestHandler):
    def get(self, *args):
        # The domain where this app is installed.
        domain = 'my_customer_domain.com'
        # A username to check.
        username = 'webmaster'

        sig_method = gdata.auth.OAuthSignatureMethod.HMAC_SHA1
        service = gdata.apps.service.AppsService(source='tipfy-com',
                                                 domain=domain)
        service.SetOAuthInputParameters(sig_method, CONSUMER_KEY,
                                        consumer_secret=CONSUMER_SECRET,
                                        two_legged_oauth=True,
                                        requestor_id=APPLICATION_ID)
        service.ssl = True
        service.debug = True
        gdata.alt.appengine.run_on_appengine(service)

        lookup_user = service.RetrieveUser(username)
        if lookup_user.login.admin == 'true':
            res = username + ' is an admin.'
        else:
            res = username + ' is not an admin.'

        self.response.out.write(res)

app = webapp.WSGIApplication([
    ('/.*', SetupHandler),
], debug=True)

def main():
    util.run_wsgi_app(app)

if __name__ == '__main__':
    main()

但我收到401响应（“未知的授权标头”）。我不知道我做错了什么或如何进一步调试它。

清单条目是否正确？
拆分 user.email() 可以获取用户的用户名和域吗？（我对其进行了调试，在我的例子中是：我得到了“webmaster”和“example.com”，这是安装该应用程序的用户和 Google Apps 域）。

我缺少什么？

编辑：由于某种原因，管理面板没有请求授予对所提供范围的访问权限。在我授予它之后，上面的代码就起作用了。因此，将其作为一个工作示例！

原文

I'm trying to check if a user is admin of their Google Apps domain, in an app installed from the Google Apps marketplace.

I added this to manifest.xml:

<Scope id="Provisioning API">
  <Url>https://apps-apis.google.com/a/feeds/user/#readonly</Url>
  <Reason>This application can list domain users to give them permissions.</Reason>
</Scope>

Then I set a test handler to get it working:

from google.appengine.ext import webapp
from google.appengine.ext.webapp import util

import gdata.alt.appengine
import gdata.apps.service
import gdata.auth

# App id, key and secret from the Google Apps Marketplace.
APPLICATION_ID = 'XXX'
CONSUMER_KEY = 'XXX'
CONSUMER_SECRET = 'XXX'

class SetupHandler(webapp.RequestHandler):
    def get(self, *args):
        # The domain where this app is installed.
        domain = 'my_customer_domain.com'
        # A username to check.
        username = 'webmaster'

        sig_method = gdata.auth.OAuthSignatureMethod.HMAC_SHA1
        service = gdata.apps.service.AppsService(source='tipfy-com',
                                                 domain=domain)
        service.SetOAuthInputParameters(sig_method, CONSUMER_KEY,
                                        consumer_secret=CONSUMER_SECRET,
                                        two_legged_oauth=True,
                                        requestor_id=APPLICATION_ID)
        service.ssl = True
        service.debug = True
        gdata.alt.appengine.run_on_appengine(service)

        lookup_user = service.RetrieveUser(username)
        if lookup_user.login.admin == 'true':
            res = username + ' is an admin.'
        else:
            res = username + ' is not an admin.'

        self.response.out.write(res)

app = webapp.WSGIApplication([
    ('/.*', SetupHandler),
], debug=True)

def main():
    util.run_wsgi_app(app)

if __name__ == '__main__':
    main()

But I get a 401 response ("Unknown authorization header"). I don't know what I'm doing incorrectly or how to debug it further.

Is the manifest entry correct?
Splitting user.email() is ok to get the user's username and domain? (I debugged it and in my case it was: I got 'webmaster' and 'example.com', which was the user and Google Apps domain where the app was installed).

What am I missing?

Edit: For some reason, the admin panel didn't ask permission to grant access to the provided scopes. After I granted it, the code above worked. So take it as a working example!

分享到QQ

分享到微博