Using OAuth2 token to authenticate to an API hosted on Google App Engine?

Question

I'm building a backend for my Android app using GAE, and I'd like to authenticate users with their Google accounts, sent from the Android app.

Before OAuth2, you were able to use a Cookie retrieved from the _ah/login endpoint to authenticate users into your web app, but that method is deprecated and I'd like to be able to use the updated OAuth2 method.

In my Android app I've been able to generate a JSON Web Token using the following line:

String jwt =  GoogleAuthUtil.getToken(FamiliarActivity.this, Plus.AccountApi.getAccountName(mGoogleApiClient), "audience:server:client_id:1234567.apps.googleusercontent.com");

or an OAuth token:

String oauth2 =  GoogleAuthUtil.getToken(FamiliarActivity.this, Plus.AccountApi.getAccountName(mGoogleApiClient), "oauth2:server:client_id:1234567.apps.googleusercontent.com:api_scope:https://www.googleapis.com/auth/plus.login");

Either, manually, I can pass to my API and validate against Google. But I haven't been able to figure out a way to use a token like this to trigger authentication in GAE like the Cookie used to. The documentation seems to indicate passing it as a header: Authorization: Bearer <TOKEN> but that doesn't seem to work.

What is the correct way to retrieve and pass a token to my GAE endpoint so that it authenticates the user?

I know answers shouldn't be links, but anyway, here is what I personally looked at to get a better understanding of App engine + Oauth 2.0 youtube.com/watch?v=HoUdWBzUZ-M — Patrice
– Patrice, Commented Aug 29, 2014 at 17:46
Doesn't GAE have an API that lets your log users in manually (IIRC, it used to)? If so, implement custom authentication using filters, etc. and just call the API after you verify the token. — Nikolay Elenkov
– Nikolay Elenkov, Commented Sep 1, 2014 at 5:13
Another idea is to compare the bearer tokens sent by browser login with the the tokens you get from GoogleAuthUtil. This is a different method, that should work, but it requires a full account access token. It basically simulates Web login, and then saves all cookies, so you can send them with subsequent requests: github.com/AndlyticsProject/andlytics/blob/dev/src/com/github/… — Nikolay Elenkov
– Nikolay Elenkov, Commented Sep 1, 2014 at 5:17

Nikita Uchaev · Accepted Answer · 2015-02-16 12:14:54Z

0

The correct and documented way to accomplish this is to:

1) Create an OAuth protected endpoint with the

https://www.googleapis.com/auth/plus.login

or

https://www.googleapis.com/auth/userinfo.email

scope and authorized Client ID for the Android client app.

2) Generate client library and integrate with your app.

answered Feb 16, 2015 at 12:14

Nikita Uchaev

1,1845 silver badges17 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Graham P Heath Over a year ago

All 3 links in this answer have been deprecated.

Collectives™ on Stack Overflow

Using OAuth2 token to authenticate to an API hosted on Google App Engine?

1 Answer 1

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related