jwt1=`echo -n '{"alg":"RS256","typ":"JWT"}' | openssl base64 -e`
jwt2=`echo -n '{\
"iss":"...@developer.gserviceaccount.com",\
"scope":"https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/datastore",\
"aud":"https://accounts.google.com/o/oauth2/token",\
"exp":'$(($(date +%s)+3600))',\
"iat":'$(date +%s)'}' | openssl base64 -e`
jwt3=`echo -n "$jwt1.$jwt2" | tr -d '\n' | tr -d '=' | tr '/+' '_-'`
jwt4=`echo -n "$jwt3" | openssl sha -sha256 -sign google.p12 | openssl base64 -e`
jwt5=`echo -n "$jwt4" | tr -d '\n' | tr -d '=' | tr '/+' '_-'`
curl -H "Content-type: application/x-www-form-urlencoded" -X POST "https://accounts.google.com/o/oauth2/token" -d \
"grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer&assertion=$jwt3.$jwt5"
トークンを正常に受け取りましたが、それを使用すると許可が拒否されますか?
https://developers.google.com/datastore/docs/apis/v1beta1/datasets/blindWrite#try-itから oauth2 トークンをコピーする と動作しますか?
curl -X GET "https://www.googleapis.com/oauth2/v1/tokeninfo?access_token=$1"
curl -X GET "https://www.googleapis.com/oauth2/v2/userinfo?access_token=$1"
curl -H "Content-type: application/json" -H "Authorization: Bearer $1" -X POST "https://www.googleapis.com/datastore/v1beta1/datasets/.../blindWrite" -d \
'{
"mutation": {
"upsert": [
{
"key": {
"path": [
{
"kind": "person",
"name": "gert"
}
]
}
}
]
}
}'
2 つのトークンの違い:
1) jwt から (許可が拒否されました)
{
"issued_to": "522156758812-u8hj8dhnk5br3vnpqqvuscievhbnl0gg.apps.googleusercontent.com",
"audience": "522156758812-u8hj8dhnk5br3vnpqqvuscievhbnl0gg.apps.googleusercontent.com",
"scope": "https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/datastore",
"expires_in": 3588,
"email": "522156758812-u8hj8dhnk5br3vnpqqvuscievhbnl0gg@developer.gserviceaccount.com",
"verified_email": true,
"access_type": "offline"
}
{
"email": "522156758812-u8hj8dhnk5br3vnpqqvuscievhbnl0gg@developer.gserviceaccount.com",
"verified_email": true
}
2) https://developers.google.com/datastore/docs/apis/v1beta1/datasets/blindWrite#try-it (動作)から
{
"issued_to": "292824132082.apps.googleusercontent.com",
"audience": "292824132082.apps.googleusercontent.com",
"user_id": "116469479527388802962",
"scope": "https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/datastore https://www.googleapis.com/auth/plus.me",
"expires_in": 3568,
"email": "gert.cuykens@gmail.com",
"verified_email": true,
"access_type": "online"
}
{
"id": "116469479527388802962",
"email": "gert.cuykens@gmail.com",
"verified_email": true
}
jwt で受け取ったトークンの何が問題になっていますか? jwtも機能させるにはどうすればよいですか？
