1

我有一个带有Google Coordinate .Net 库和服务帐户开放身份验证的 C# 控制台应用程序。

private const string SERVICE_ACCOUNT_EMAIL = "XXX@developer.gserviceaccount.com";
private const string SERVICE_ACCOUNT_PKCS12_FILE_PATH = @"<path-to-private-key-file>\YYY-privatekey.p12";
private const string GOOGLE_COORDINATE_TEAM_ID = "ZZZ";

private CoordinateService BuildService()
{
    X509Certificate2 certificate = new X509Certificate2(SERVICE_ACCOUNT_PKCS12_FILE_PATH, "notasecret", X509KeyStorageFlags.Exportable);

    var provider = new AssertionFlowClient(GoogleAuthenticationServer.Description, certificate){
        ServiceAccountId = SERVICE_ACCOUNT_EMAIL,
        Scope = CoordinateService.Scopes.Coordinate.GetStringValue()
    };
    var auth = new OAuth2Authenticator<AssertionFlowClient>(provider, AssertionFlowClient.GetState);

    return new CoordinateService(new BaseClientService.Initializer(){
        Authenticator = auth
    });
}

//some code that retrieves data from coordinate service
public void DoSomething()
{
    CoordinateService service = BuildService();
    var response = service.Jobs.List(GOOGLE_COORDINATE_TEAM_ID).Fetch();
    ...
}

在从坐标服务检索作业列表时，发生 DotNetOpenAuth.Messaging.ProtocolException（内部异常“远程服务器返回错误：（400）错误请求”）。使用Fiddler，我设法看到了来自 Google OAuth 服务的响应。JSON 响应对象：

{
  "error" : "invalid_grant"
}

我已经阅读了一些建议更改本地服务器时间以匹配 Google OAth 服务器时间的文章。但是在将时间更改为一侧和另一侧后，问题仍然存在。您能否给我一些想法，为什么会发生这种情况？感谢所有回复！

4

1 回答 1

1

服务帐号不能与 Coordinate API 一起使用。[这是因为 Coordinate API 要求经过身份验证的 API 用户拥有 Coordinate 许可，但无法将 Coordinate 许可附加到服务帐户]

您可以改用 Web 服务器流程，请在下面找到示例。

确保更新下面的代码，其中有包含“TO UPDATE”的注释。

using System; 
using System.Diagnostics; 
using System.Collections.Generic; 
using DotNetOpenAuth.OAuth2; 
using Google.Apis.Authentication.OAuth2; 
using Google.Apis.Authentication.OAuth2.DotNetOpenAuth; 
using Google.Apis.Coordinate.v1; 
using Google.Apis.Coordinate.v1.Data;

namespace Google.Apis.Samples.CoordinateOAuth2
{ 
    /// <summary> 
    /// This sample demonstrates the simplest use case for an OAuth2 service. 
    /// The schema provided here can be applied to every request requiring authentication. 
    /// </summary> 
    public class ProgramWebServer
    { 
        public static void Main (string[] args)
        { 
            // TO UPDATE, can be found in the Coordinate application URL
            String TEAM_ID = "jskdQ--xKjFiFqLO-IpIlg"; 

            // Register the authenticator. 
            var provider = new WebServerClient (GoogleAuthenticationServer.Description);
            // TO UPDATE, can be found in the APIs Console.
            provider.ClientIdentifier = "335858260352.apps.googleusercontent.com";
            // TO UPDATE, can be found in the APIs Console.
            provider.ClientSecret = "yAMx-sR[truncated]fX9ghtPRI"; 
            var auth = new OAuth2Authenticator<WebServerClient> (provider, GetAuthorization); 

            // Create the service. 
            var service = new CoordinateService(new BaseClientService.Initializer()
                       {
                          Authenticator = auth
                       });

            //Create a Job Resource for optional parameters https://developers.google.com/coordinate/v1/jobs#resource 
            Job jobBody = new Job (); 
            jobBody.Kind = "Coordinate#job"; 
            jobBody.State = new JobState (); 
            jobBody.State.Kind = "coordinate#jobState"; 
            jobBody.State.Assignee = "user@example.com"; 


            //Create the Job 
            JobsResource.InsertRequest ins = service.Jobs.Insert (jobBody, TEAM_ID, "My Home", "51", "0", "Created this Job with the .Net Client Library");
            Job results = ins.Fetch (); 

            //Display the response 
            Console.WriteLine ("Job ID:"); 
            Console.WriteLine (results.Id.ToString ()); 
            Console.WriteLine ("Press any Key to Continue"); 
            Console.ReadKey (); 
        }

        private static IAuthorizationState GetAuthorization (WebServerClient client)
        { 
            IAuthorizationState state = new AuthorizationState (new[] { "https://www.googleapis.com/auth/coordinate" }); 
            // The refresh token has already been retrieved offline
            // In a real-world application, this has to be stored securely, since this token
            // gives access to all user data on the Coordinate scope, for the user who accepted the OAuth2 flow
            // TO UPDATE (see below the sample for instructions)
            state.RefreshToken = "1/0KuRg-fh9yO[truncated]yNVQcXcVYlfXg";

            return state;
        } 

    } 
}

可以使用 OAuth2 Playground 检索刷新令牌：

  • 在 API 控制台中，添加 OAuth Playground URL https://developers.google.com/oauthplayground作为授权的重定向 URI（当我们在 OAuth Playground 中检索刷新令牌时需要它，如下所示）
  • 在您的 API 用户已通过身份验证的浏览器会话中转到 OAuth Playground（此用户需要拥有 Coordinate 许可证）。确保提供您自己的 OAuth2 客户端 ID（设置 > 使用您自己的 OAuth 凭据）。否则，您的刷新令牌将与 OAuth2 操场的内部 OAuth2 客户端 ID 绑定，并且当您想将刷新令牌与您自己的客户端 ID 一起使用以获取访问令牌时，您的刷新令牌将被拒绝。
  • 使用范围https://www.googleapis.com/auth/coordinate在第 1 步中，点击“授权 API” 在第 2 步中，点击“交换令牌授权码”</li>
  • 复制代码中的刷新令牌。保持安全。
  • 此刷新令牌不会过期，因此您的应用将保持身份验证状态。
于 2013-06-20T20:41:33.560 回答