我正在尝试使用为托管在 Google App Engine 上的 Python 2.7 应用程序创建的 oAuth 2.0 服务帐户凭据通过 GData API 访问 Google 电子表格。
- 该应用程序使用来自 Google 的最新 gdata-python-client，v. 2.0.18（gdata 和 atom）。
- 该应用程序使用最近的 google-api-python-client-gae，v. 1.2。
- 在此项目的 Google Developer Console 中（在本示例中称为“my-gae-app”），我创建了一个服务帐户并将域范围的权限委托给该服务帐户，如此处所述
- Google Drive 中所需的电子表格属于 Google Apps for Work 域，此处称为“mygoogleappsdomain.com”。
my-gae-app@appspot.gserviceaccount.com我已授予对此服务帐户显示的电子邮件地址和该电子表格的读写访问权限，该电子邮件地址已分配给clientEmail下面代码中的变量。不确定实际上需要这两个电子邮件地址中的哪一个，所以我都分配了。拥有该impersonateUser电子邮件地址的用户还拥有对该电子表格的读写访问权限。
使用 Google API Python 客户端，AppAssertionCredentials我可以通过 Google Drive API 访问所需电子表格的元数据。但是，如果我尝试使用 gdata 访问电子表格的内容，则会出现错误。到目前为止，我可以使用服务帐户获得的最佳结果是使用的SignedJwtAssertionCredentials，如此处所建议的。但是，我坚持这一点AccessRefreshTokenError: access denied，我不明白出了什么问题。
import os
import httplib2
from google.appengine.api import memcache
from apiclient.discovery import build
from oauth2client.client import SignedJwtAssertionCredentials
import gdata.spreadsheets.client
import gdata.spreadsheet.service
# AppAssertionCredentials is not supported in gdata python client library,
# so we use SignedJwtAssertionCredentials with the credential
# file of this service account.
# Load the key in PKCS 12 format that you downloaded from the Google API
# Console when you created your Service account.
clientEmail = '10346........-g3dp......................3m1em8@developer.gserviceaccount.com'
p12File = 'app.p12'
path = os.path.join(ROOT_DIR, 'data', 'oAuth2', p12File)
impersonateUser = 'user@mygoogleappsdomain.com'
spreadsheetKey = '1mcJHJ...................................juQMw' # ID copied from URL of desired spreadsheet in Google Drive
with open(path) as f:
privateKey = f.read()
f.close()
# Getting credentials with AppAssertionCredentials only worked successfully
# for Google API Client Library for Python, e.g. accessing file's meta-data.
# So we use SignedJwtAssertionCredentials, as suggested in
# https://stackoverflow.com/questions/16026286/using-oauth2-with-service-account-on-gdata-in-python
credentials = SignedJwtAssertionCredentials(
clientEmail,
privateKey,
scope=(
'https://www.googleapis.com/auth/drive.file ',
# added the scope above as suggested somewhere else,
# but error occurs with and with-out this scope
'https://www.googleapis.com/auth/drive',
'https://spreadsheets.google.com/feeds',
'https://docs.google.com/feeds'
),
sub=impersonateUser
)
http = httplib2.Http()
http = credentials.authorize(http)
auth2token = gdata.gauth.OAuth2TokenFromCredentials(credentials)
# error will occur, wether using SpreadsheetsService() or SpreadsheetsClient()
#srv = gdata.spreadsheet.service.SpreadsheetsService()
#srv = auth2token.authorize(srv)
clt = gdata.spreadsheets.client.SpreadsheetsClient()
clt = auth2token.authorize(clt)
# Until here no errors
wks = clt.get_worksheets(spreadsheetKey)
# AccessTokenRefreshError: access_denied
这是我在远程 shell 中遇到的错误：
s~my-gae-app> wks = clt.get_worksheets(spreadsheetKey)
Traceback (most recent call last):
File "<console>", line 1, in <module>
File "gdata/spreadsheets/client.py", line 108, in get_worksheets
**kwargs)
File "gdata/client.py", line 640, in get_feed
**kwargs)
File "gdata/client.py", line 267, in request
uri=uri, auth_token=auth_token, http_request=http_request, **kwargs)
File "atom/client.py", line 122, in request
return self.http_client.request(http_request)
File "gdata/gauth.py", line 1344, in new_request
refresh_response = self._refresh(request_orig)
File "gdata/gauth.py", line 1485, in _refresh
self.credentials._refresh(httplib2.Http().request)
File "/usr/local/lib/python2.7/dist-packages/oauth2client/client.py", line 653, in _refresh
self._do_refresh_request(http_request)
File "/usr/local/lib/python2.7/dist-packages/oauth2client/client.py", line 710, in _do_refresh_request
raise AccessTokenRefreshError(error_msg)
AccessTokenRefreshError: access_denied
我不确定这是否表明此服务帐户被拒绝访问电子表格，或者刷新访问令牌时是否出错。您知道此代码或设置有什么问题吗？