I am trying to access a list of users through an app. I cannot get two-legged auth to work. I want to be able to access google's APIs without requiring user consent after install. The gdata lib was deprecated earlier this year, but a business requirement requires accessing the APIs without additional user consent after the domain admin has installed the app.
Here is what I have done so far:
I have created an application on the Marketplace. The app manifest declares this scope:
https://apps-apis.google.com/a/feeds/user/I have installed my app in a test domain and granted permissions for the above scope.
I have looked at the samples here: https://code.google.com/p/gdata-python-client/source/browse/samples/oauth/
- Deprecated
Serviceapproach: 2_legged_oauth.py - Updated
Clientapproach: TwoLeggedOAuthExample.py
- Deprecated
I am using Python 2.7.5 and gdata 2.0.18. Here is my code, which was adapted from the above mentioned examples:
import gdata.gauth
import gdata.apps.client
CONSUMER_KEY = "[snip].apps.googleusercontent.com"
CONSUMER_SECRET = "[snip]"
requestor_id = '[email protected]'
client = gdata.apps.client.AppsClient(domain='mydomain.com', source='myapp-v1')
client.auth_token = gdata.gauth.TwoLeggedOAuthHmacToken(
CONSUMER_KEY, CONSUMER_SECRET, requestor_id)
client.ssl = True
# Failure occurs here.
feed = client.RetrieveAllUsers()
The response:
<HTML>
<HEAD>
<TITLE>Unknown authorization header</TITLE>
</HEAD>
<BODY BGCOLOR="#FFFFFF" TEXT="#000000">
<H1>Unknown authorization header</H1>
<H2>Error 401</H2>
</BODY>
</HTML>
Here are the details for the headers being sent:
GET /a/feeds/mydomain.com/user/2.0?xoauth_requestor_id=myuser%40mydomain.com HTTP/1.1
Host: apps-apis.google.com
Accept-Encoding: identity
GData-Version: 2.0
Authorization: OAuth oauth_nonce="035378574830673", oauth_timestamp="1383593346", oauth_consumer_key="[snip].apps.googleusercontent.com", oauth_signature_method="HMAC-SHA1", oauth_version="1.0", oauth_signature="[snip]"
User-Agent: test-test-v1 gdata-py/2.0.18
Here is debugging information on the response (as taken from putting atom.http_core.ProxiedHttpClient into debug mode):
reply: 'HTTP/1.1 401 Unknown authorization header\r\n'
header: WWW-Authenticate: GoogleLogin realm="http://www.google.com/accounts/ClientLogin", service="apps"
header: Content-Type: text/html; charset=UTF-8
header: Date: Mon, 04 Nov 2013 19:33:35 GMT
header: Expires: Mon, 04 Nov 2013 19:33:35 GMT
header: Cache-Control: private, max-age=0
header: X-Content-Type-Options: nosniff
header: X-Frame-Options: SAMEORIGIN
header: X-XSS-Protection: 1; mode=block
header: Server: GSE
header: Alternate-Protocol: 443:quic
header: Transfer-Encoding: chunked
How do I use use two-legged oauth to access users on a domain? I am open to using the newer Google API clients (oauth2client and apiclient), but only if I can use two-legged authentication since I have a business requirement to not have the third leg.
I recommend you to read the docs regarding OAuth2 Service Accounts.
2-legged-OAuth is deprecated, gdata APIs are largely deprecated and apiclient services are much cleaner and easier to use.