Using Google Class room Java API in Tomcat Server as a rest API - google-oauth

I want to use Google Classroom Java API in Tomcat Server as a REST API.
I want the client-side code to generate an access token and refresh token and pass them to the REST API endpoints.
The REST API then use the above token to call the following code to get the list of Courses: objectOf(Classroom).courses().list().setPageSize(100).execute();
I am creating the Classroom as follows, where .getCredentials() uses
GoogleAuthorizationCodeFlow.Builder to create the credential required, but it opens a browser window to authorize the user and get the token. This doesn't work for me.
NetHttpTransport httpTransport = GoogleNetHttpTransport.newTrustedTransport();
Classroom classRoom = new Classroom.Builder(httpTransport, JSON_FACTORY, getCredentials(httpTransport))
.setApplicationName(APPLICATION_NAME).build();

I understand that you want to receive access and refresh tokens to later use them in Classroom; and you want to run this operation from a server. If that is correct, you would need to login as your account to prove your identity and receive the credentials, but there are some alternatives.
Since you are going to execute the code from a server you could follow these steps to create your credentials. Those credentials need to be saved in your work folder once and they can be read on every run.
Alternatively, you could create a service account and use it to reach your goals if you want to interact with Classroom as a different user of your organization. Please, remember to activate domain-wide delegation for this step. Don't hesitate to write back if you have some questions.

Related

Obtain user information on Actions on Google Through OAuth in AoG?

Account Linking provides several ways of linking users to their own accounts such as their Google account or Twitter account.
I chose OAuth in Actions on Google website to do OAuth 2.0 Authorization Code Grant for obtaining access token in exchange for data resources. When I linked a user to a Google account Google Sign-In enabled, the fetching of user information was easy because the data is stored under payload, but OAuth implementation does not seem like it produces user data under payload inside User object.
So should I make an API call to the third party to fetch the user data and store that personal data to a database in this case? I wondered if there is a way that Google prepares on behalf of developers. If not, then greeting a user who visits my app again by saying 'Hello, {person name}' gets tedious...
You have two options with Account Linking.
In the case you describe, you're providing an OAuth endpoint and getting an auth token from the Assistant, and you are responsible for taking this token and using it to determine who the user is so you can get whatever you know about him. The token is one that you issue and control, so presumably you have that info in your database already. If you are reusing a token from another service, that service should be able to tell you who they are.
It sounds like you're using using a Google Sign In, however, in which case it is easier to use Google Sign In for Assistant. Once the user has signed into your service (either through an app or webapp) and granted permission to your service, then they will also be able to gain access through the Assistant. You will get an id token which can be decoded to get profile information about the user including their Google ID and name.

Trying to Understand Google Calendar API Service Account Authorization

I am new to using Google API and I am struggling to understand how it works. I want to be able to access a calendar and add events to it. I don't want the user to login every time because it will be a universal calendar that holds invoice due dates so from what I understand I want to use a service account. I created a calendar api project and a service account. I set the calendar share permissions to the project email. I have an API key and a service account key. However, I get confused with understanding how it needs to be authenticated. Unfortunately I am using Filemaker so I don't have any helper libraries to help me. I basically just have a POST option.
The google api documentation states that the insert event call requires authorization:
"This request requires authorization with the following scope (read more about authentication and authorization)" https://www.googleapis.com/auth/calendar"
https://developers.google.com/google-apps/calendar/v3/reference/events/insert
So if I was just using basic POST requests how would I authorize this and which keys do I need? Do I need the API key and Service Account Key? Do i have to use a client key even if I want all users to access the same calendar?
If I need to clarify anything just let me know.
Thanks!
You will need to include a valid access_token in the HTTP headers of your POST request, e.g. Authorization: Bearer ya29.xxxxxxxxxxxxxxxxxx
In order to get a valid access_token, you will need to go through the OAuth2 Authorization process as described at https://developers.google.com/identity/protocols/OAuth2ServiceAccount#authorizingrequests
Note: Please click on "HTTP/REST" to see the details of doing that without using any specific client libraries.

Is Firebase's built-in authentication able to be used on a 3rd party server?

I'm looking to create a game server backend for a game I'm creating. We're currently using Firebase for handling of data and ads, and Firebase has built in authentication. Is it possible to have a user log into our app via Firebase's auth system, then confirm the user's authentication when they connect to the game server to ensure it's who they say they are?
Basically, after someone logs into our firebase, can we use that authentication information for a separate server, and what protocol/method would need to be used (if there's a specific one)
I've figured out the two steps you need to get the information required to auth, one clientside and one serverside. Note: the following examples are for the Java apis, but you can use any of firebase's equivalents.
Clientside: In the Firebase-Auth package, there's the FirebaseUser object. This contains information about their auth state, unique details, etc. There is a method here called getToken(), which will grab your token for the current authentication. Once you have this, you want to send it to the server when you need to auth.
Serverside: On the server, there's a FirebaseAuth object. Once you get the token from the client, you can use verifyIdToken(), which will confirm this is a valid token and give you the details about the user when you get the result. I suggest cross-checking the UUID against one a client sends, to just confirm someone didn't get their hands on a token and send a random ID.
Hope this helps.

BigQuery Simple Api Authentication

I am trying to gain access to my BigQuery enabled Google API project using the .net Google APIs.
Using a console application, I am trying to authenicate first by supplying my simple API key in the URI, then just trying to get the list of projects.
The error I am receiving when I call Fetch() on the project list is: Login Required [401]
var bigqueryService = new BigqueryService{ Key = "MY-API_KEY" };
var projectList = bigqueryService.Projects.List().Fetch();
I am purposefully not using OAuth2 as we don't need any user data.
The API key simply identifies your app to the API console for quota purposes and other housekeeping. It's not authoritative for accessing BigQuery, as we do consider the BigQuery data as "user data."
If you're just trying to get an OAuth 2 access token for playing around quickly, you can use the OAuth 2 playground:
https://code.google.com/oauthplayground/
This token will be valid for one hour and can be copied/pasted as the access_token query parameter
Here's the scope for BigQuery to use in the playground:
https://www.googleapis.com/auth/bigquery
In the end, you'll either want to use the native client (out of band) flow:
https://developers.google.com/accounts/docs/OAuth2InstalledApp
Or the server-to-server (service accounts) flow:
https://developers.google.com/accounts/docs/OAuth2ServiceAccount
I don't have quick samples handy for those in .NET, but post another question on SO if you can't find them-- I'm sure someone will chip in!
You won't be able to use a simple API key - all authorization to the BigQuery API must happen via user interaction, or alternatively through a service account.

Authorizing for Google ToDo List (AuthToken, secid)

I'm trying to get access to the Google's todo feed with this url:
https://www.google.com/calendar/tdl?secid=<SECID>&tdl={%22action_list%22%3A[{%22action_type%22%3A%22get_all%22%2C%22action_id%22%3A%221%22%2C%22list_id%22%3A%2215052708471047222911%3A0%3A0%22%2C%22get_deleted%22%3Afalse}]%2C%22client_version%22%3A-1}
If I open this in my browser with a correct secid, it shows me right what I want.
Now, the question is: how do I get secid programmatically (specifically, in a java program)? I have access to the authToken (from CalendarService), but I have no clue how to use it to authorize my access to the URL above.
I tried to use the url http://google.com/accounts/ServiceLogin, but I didn't find any examples.
Any help, please?
From what I read secid is a session ID obtained from browser's cookies. Whereas your case uses Java which implies a server app. If that is the case, you want to drop the idea of using secid entirely.
Instead, you want to check out Google's OAuth2 documentation. If you are using Java, most likely you would be interested in the web-server OAuth flow. Pay special attention to the sequence diagrams.
The key steps include:
1) Obtain an authorization code from Google OAuth with the user's consent. For that, you redirect the user to Google with the appropriate scope. Check the list of calendar scopes for your case. Once the user consents, Google redirects back to you with an authorization code.
2) Call Google OAuth with the authorization code and your app's credentials to exchange for an access token.
3) Call Google's Calendar API using the access token.
And if you use Google's Java client as suggested by #ChaosPredictor, chances are some of the steps are already wrapped into the Java client (and your code will be much simpler).