失败使用谷歌Oauth2服务帐户时的先决条件

Question

有三种类型的google apiclient_id：
1. Web应用程序
2.服务帐户
3.已安装的应用程序

我用了3。基于 oauth2 客户端成功安装应用程序，但在 2 上失败。服务帐户。我想使用 oauth2.0 凭据访问我自己的 gmail 收件箱。

import imaplib
import json
import urllib2
from oauth2client.client import SignedJwtAssertionCredentials
from httplib2 import Http
from apiclient.discovery import build
import os

reldir = os.path.dirname(os.path.relpath(__file__))
CLIENT_SECRET_FILE = os.path.join(reldir, 'gmail_service.json')
OAUTH_SCOPE = "https://mail.google.com"
GMAIL_ADDRESS = '[e-mail]'

def jwt_oauth2():
    '''
    https://developers.google.com/identity/protocols/OAuth2ServiceAccount
    '''
    with open(CLIENT_SECRET_FILE) as f:
        data = json.loads(f.read())
    private_key = data['private_key']
    client_email = data['client_email']
    credentials = SignedJwtAssertionCredentials(
        client_email,   private_key, scope=OAUTH_SCOPE)

    http_auth = credentials.authorize(Http())
    try:
        gmail_service = build('gmail', 'v1', http=http_auth)
        threads = gmail_service.users().messages().list(userId='me').execute()
    except Exception as e:
        return e

我得到了一个与问题相同的例外。我在尝试将sub=GMAIL_ADDRESS添加到凭据时遇到另一个异常：
AccessTokenRefreshError:unauthorized_client:请求中的未授权客户端或作用域。

我正在尝试解决问题，使用< code >凭据而不使用< code>sub:

>>> credentials = SignedJwtAssertionCredentials(
    client_email,   private_key, scope=OAUTH_SCOPE)
>>> http = credentials.authorize(Http())
>>> credentials.access_token
>>> credentials.refresh(http)
>>> credentials.access_token
u'ya29.pAGJjddCXjwsiHFN6hKU1yAkdWN7xMJbks5O76Pmrpe1hW1BbgwfZifjp81aDE55ALMVgjv-yBYiyQ'
>>> gmail_service = build('gmail', 'v1', http=http)
>>> request = gmail_service.users().messages().list(userId='me')
>>> response = request.execute()
{
 "error": {
  "errors": [
   {
    "domain": "global",
    "reason": "failedPrecondition",
    "message": "Bad Request"
   }
  ],
  "code": 400,
  "message": "Bad Request"
 }
}

尝试将凭据与sub一起使用：

>>> credentials = SignedJwtAssertionCredentials(
    client_email,   private_key, scope=OAUTH_SCOPE, sub=GMAIL_ADDRESS)
>>> http = credentials.authorize(Http())
>>> credentials.access_token
>>> credentials.refresh(http)
AccessTokenRefreshError: unauthorized_client: Unauthorized client or scope in request.

我发现了一个类似的问题 谷歌OAuth2服务帐户 HTTP / REST身份验证，但我对节点.js了解不多。任何帮助将不胜感激。

Answer 1

您应该使用指定要模拟的帐户的子字段。

比方说，使用您的服务帐户，您想要获得用户[e-mail]的详细信息，子字段应该填充为:

sub: [e-mail]

您还应确保已将服务帐户访问权限授予域中的用户。参考-https://developers.google.com/drive/web/delegation