sertys3
commented
10 months ago I have been able to produce a working solution with a token that was "sniffed" by GYB with a service account file and voiding the encryption/decryption of access_token config variables in the code. Thus I could place then generated token in plaintext in the config. And authentication works as expected. Now I have 2 options - inspect the GYB way of taking the token and implementing this in your project or have a script that gets a valid token and populates the config file for email accounts of the Workspace.
EDIT: That was fast. Using the google.oauth2 it is easy to generate a valid access token:
import os
import os.path
import json
import httplib2
import google.oauth2.service_account
import google_auth_oauthlib.flow
import google_auth_httplib2
import google.oauth2.id_token
def _createHttpObj(cache=None, timeout=600):
http_args = {'cache': cache, 'timeout': timeout}
http_args['tls_maximum_version'] = 'TLSv1_3'
http_args['tls_minimum_version'] = 'TLSv1_2'
return httplib2.Http(**http_args)
def readFile(filename, mode='r', continueOnError=False, displayError=True, encoding=None):
try:
if filename != '-':
if not encoding:
with open(os.path.expanduser(filename), mode) as f:
return f.read()
with codecs.open(os.path.expanduser(filename), mode, encoding) as f:
content = f.read()
# codecs does not strip UTF-8 BOM (ef:bb:bf) so we must
if not content.startswith(codecs.BOM_UTF8):
return content
return content[3:]
return unicode(sys.stdin.read())
except IOError as e:
if continueOnError:
if displayError:
sys.stderr.write(str(e))
return None
systemErrorExit(6, e)
except (LookupError, UnicodeDecodeError, UnicodeError) as e:
systemErrorExit(2, str(e))
def getSvcAcctCredentials(scopes, act_as):
try:
json_string = readFile('./oauth2service.json', continueOnError=True, displayError=True)
if not json_string:
print(MESSAGE_INSTRUCTIONS_OAUTH2SERVICE_JSON)
systemErrorExit(6, None)
sa_info = json.loads(json_string)
credentials = google.oauth2.service_account.Credentials.from_service_account_info(sa_info)
credentials = credentials.with_scopes(scopes)
credentials = credentials.with_subject(act_as)
request = google_auth_httplib2.Request(_createHttpObj())
credentials.refresh(request)
return credentials
except (ValueError, KeyError):
print(MESSAGE_INSTRUCTIONS_OAUTH2SERVICE_JSON)
systemErrorExit(6, 'oauth2service.json is invalid.')
API_SCOPE_MAPPING = {
'email': ['https://www.googleapis.com/auth/userinfo.email'],
'drive': ['https://www.googleapis.com/auth/drive.appdata',],
'gmail': ['https://mail.google.com/',],
'groupsmigration': ['https://www.googleapis.com/auth/apps.groups.migration',],
}
creds = getSvcAcctCredentials(['https://mail.google.com/'],'account@google-workspace.tld')
print(vars(creds))
I would think that would be trivial to integrate in the existing codebase.
Regards, Daniel
simonrob
johspa933
Greetings, thank you for the wonderful work thus far on the project. I have a case where I'd would like to authenticate with a service account for the users in a Google Workspace account. From what I am seeing such an account would not require an authorization on the web and the credentials come in a .json file. It has an embedded certificate instead of a secret.
Has that been implemented as a use case already and I'm missing something or there would be a different OAuth2 path for authorizing the token to access the accounts in the Workspace?
Regards, Daniel