如何使用access_token查询gmail api

Question

我有一个网络应用程序，用户在登录我们的系统后，可以进入一个页面授权gmail访问，通过谷歌的整个OAuth过程。这个过程完成了，我收到了access_token和refresh_token，还解析了用户子属性的id_token，并将其保存到数据库中。这样做的目的是，通过用户授权我们的应用程序，我们然后使用控制台应用程序中的访问和刷新令牌来检索他们的电子邮件，并将其与我们的内部系统同步。

在google dev控制台中，我创建了一个带有适当重定向uris的web应用程序凭据。浏览器授权过程一切正常。然而，当我使用访问令牌运行控制台应用程序时，它会打开一个浏览器窗口，上面有一个谷歌错误

Error: redirect_uri_mismatch

The redirect URI in the request, http://127.0.0.1:57590/authorize/, does not match the ones authorized for the OAuth client.

由于这是一个控制台应用程序，没有重定向uri。这让我想知道是否需要将凭据设置为“其他”应用程序类型。我创建了一个新的凭据，并用新的凭据替换了我的网络应用程序中的客户端和秘密。当我经历登录到我们的系统，然后访问授权页面的过程时，一切都很好。然后我回到我的控制台应用程序（现在使用更新的id），当它运行时，它会打开一个浏览器窗口，要求我登录谷歌并再次验证它！我已经在第一步做到了。由于这是在应用服务器上运行的控制台应用，用户无法与它交互以授权访问...我以为这就是访问令牌的全部意义！？

这是我的代码。

处理授权的Web应用控制器。

public class GoogleController : Controller
{
    private readonly CredentialService _credentialService;
    private readonly GoogleEndpoints _endpoints;

    private string AuthorizeUrl{ get { return ...; }}
    private string AuthorizeResponseUrl{ get { return ...; }}
    private string SaveResponseUrl{ get { return ...; }}

    public GoogleController()
    {
        _endpoints = new GoogleEndpoints();
        _credentialService = new CredentialService(new CredentialRepository(ConnectionStrings.GeneralInfo));
    }

    public void Authorize()
    {
        if (Session["UserID"] == null || Session["Email"] == null)
        {
            Response.Redirect("~/Login.aspx", true);
            Session["LoginSource"] = AuthorizeUrl;
            Response.End();
        }
        else
        {
            if (Session["SessionId"] == null || Session["SessionId"].ToString().Trim().Length == 0)
                Session["SessionId"] = _credentialService.CreateSessionId(Session["UserID"].To<int>());


            var url = _endpoints.AuthorizationEndpoint + "?" +
                      "client_id=" + APIConstants.GMailApiKey + "&" +
                      "response_type=code&" +
                      "scope=openid%20email https://www.googleapis.com/auth/gmail.readonly&" +
                      "redirect_uri=" + AuthorizeResponseUrl + "&" +
                      "state=" + Session["SessionId"] + "&" +
                      "login_hint=" + Session["Email"] + "&" +
                      "access_type=offline&prompt=consent";

            Response.Redirect(url);
        }
    }

    public ActionResult AuthorizeResponse()
    {
        var state = Request.QueryString["state"];
        if (state == Session["SessionId"].ToString())
        {
            var code = Request.QueryString["code"];
            var values = new Dictionary<string, object>
            {
                {"code", code},
                {"redirect_uri", AuthorizeResponseUrl},
                {"client_id", APIConstants.GMailApiKey},
                {"client_secret", APIConstants.GmailApiSecret},
                {"grant_type", "authorization_code"},
                {"scope", ""}
            };

            var webmethods = new WebMethods();
            var tokenResponse = webmethods.Post(_endpoints.TokenEndpoint, values);

            var jobject = JObject.Parse(tokenResponse);
            var access_token = jobject.SelectToken("access_token");
            var refresh_token = jobject.SelectToken("refresh_token");
            var id_token = jobject.SelectToken("id_token");

            if (access_token == null || access_token.ToString().Trim().Length == 0)
            {
                var emailService = new EmailRouterService(new EmailRouterRepository(ConnectionStrings.EmailRouter));
                emailService.SendEmail(new Email
                {
                    Body = tokenResponse,
                    Subject = "Error setting up google for " + Session["Email"] + ". ",
                    FromAddress = "[e-mail]",
                    ToAddress = "[e-mail]"
                });

                return View(new GoogleAuthResponse(tokenResponse, false));
            }


            var idTokenEls = id_token.ToString().Split('.');
            var idTokenString = base64Decode(idTokenEls[1]);
            var id_token_json = JObject.Parse(idTokenString);

            var credentials = _credentialService.GetUserCredentials(Session["SessionId"].ToString());

            credentials.AccessToken = access_token.ToString();
            credentials.RefreshToken = refresh_token.ToString();
            credentials.TEEmployeeId = Session["UserId"].To<int>();
            credentials.EmailAddress = id_token_json.SelectToken("email").ToString();
            credentials.GoogleSubKey = id_token_json.SelectToken("sub").ToString();


            _credentialService.SaveUserCredentials(credentials);

            return View(new GoogleAuthResponse("Integration successful!", true));
        }

        return View(new GoogleAuthResponse("Missing state information.", false));
    }

    public string base64Decode(string data)
    {
        ....
    }
}

控制台应用程序正在使用。net谷歌api库。

public class GmailUserSync
{
    private readonly CredentialService _credentialService;

    public GmailUserSync(CredentialService credentialService)
    {
        _credentialService = credentialService;
    }

    public void SyncThreads()
    {
        var secrets = new ClientSecrets
        {
            ClientId = APIConstants.GMailApiKey,
            ClientSecret = APIConstants.GmailApiSecret
        };

        var credentials = _credentialService.GetAllCredentials();

        foreach (var c in credentials)
        {
            var credential = GoogleWebAuthorizationBroker.AuthorizeAsync(
                secrets,
                new[] { GmailService.Scope.GmailReadonly },
                c.GoogleSubKey,
                CancellationToken.None,
                new TenixDataStore(_credentialService)).Result;

            var service = new GmailService(new BaseClientService.Initializer
            {
                HttpClientInitializer = credential,
                ApplicationName = "Gmail Integration"
            });

            var request = service.Users.Messages.List("me");

            // List messages.
            var messages = request.Execute().Messages;
            Console.WriteLine("Messages:");

            if (messages != null && messages.Count > 0)
                foreach (var message in messages)
                {
                    Console.WriteLine("From : " + message.ThreadId);
                }

            else
                Console.WriteLine("No labels found.");
        }

        Console.Read();
    }
}

以及我对IDataStore的实施。

public class TenixDataStore : IDataStore
{
    private readonly ICredentialService _service;

    public TenixDataStore(ICredentialService credentialService)
    {
        _service = credentialService;
    }

    public Task StoreAsync<T>(string key, T value)
    {
        if (string.IsNullOrEmpty(key))
            throw new ArgumentException("Key MUST have a value");

        var serialized = NewtonsoftJsonSerializer.Instance.Serialize(value);
        var jObject = JObject.Parse(serialized);

        var access_token = jObject.SelectToken("access_token");
        var refresh_token = jObject.SelectToken("refresh_token");

        if (access_token == null)
            throw new ArgumentException("Missing access token");

        if (refresh_token == null)
            throw new ArgumentException("Missing refresh token");

        var credential = _service.GetUserCredentialsFromGoogleSubId(key);

        credential.AccessToken = (string) access_token;
        credential.RefreshToken = (string) refresh_token;

        _service.SaveUserCredentials(credential);

        return Task.Delay(0);
    }

    public Task DeleteAsync<T>(string key)
    {
        return Task.Delay(0);
    }

    public Task<T> GetAsync<T>(string googleSubId)
    {
        var credentials = _service.GetUserCredentialsFromGoogleSubId(googleSubId);
        var completionSource = new TaskCompletionSource<T>();

        if (!string.IsNullOrEmpty(credentials.RefreshToken))
        {
            var jsonData = Newtonsoft.Json.JsonConvert.SerializeObject(credentials);
            completionSource.SetResult(NewtonsoftJsonSerializer.Instance.Deserialize<T>(jsonData));
        }
        else
            completionSource.SetResult(default(T));

        return completionSource.Task;
    }

    public Task ClearAsync()
    {
        return Task.Delay(0);
    }
}

IDataStore中的GetAsync方法正在向GoogleWebAuthorizationBroker返回访问令牌并刷新令牌凭据。AuthorizeAsync和之后，这是当一个新的浏览器打开，要求我授权的应用程序。

那么，我应该在谷歌控制台中将其设置为web应用类型还是其他类型？既然我在任何一方面都遇到了问题，我做错了什么？

Answer 1

您从Google Dev控制台生成的每个OauClientID都有一个redirect_uri。