使用日历api与google-api-php-client进行Google服务帐户身份验证

i am using php 5.3.3, and codeigniter 2.1.0. what i want to do is set up a service account, so a user can add an appointment in a text entry field on my website, then have that appointment added to a shared shared google calendar.

我使用的是php 5.3.3和codeigniter 2.1.0。我想要做的是设置一个服务帐户，这样用户就可以在我的网站上的文本输入字段中添加约会，然后将该约会添加到共享的共享谷歌日历中。

i have a google account, and using : https://code.google.com/apis/console I created a new project called 'pqp' on services: enabled the calendar api on api access: i created an oath 2.0 client id… product name = pqp, application type = service account.

我有一个谷歌帐户，并使用：https：//code.google.com/apis/console我在服务上创建了一个名为'pqp'的新项目：在api访问时启用了日历api：我创建了一个誓言2.0客户端ID ...产品名称= pqp，应用程序类型=服务帐户。

downloaded the key 46… -privatekey.p12. there is a screenshot of the settings:

下载了密钥46 ... -privatekey.p12。有一个设置的屏幕截图：

I got an svn checkout of the google-api-php-client (28/6/2012) In the google-api-php-client/src/config.php I changed lines:

我得到了google-api-php-client的svn签出（28/6/2012）在google-api-php-client / src / config.php中我更改了行：

25: 'application_name' => 'pqp',
28: 'oauth2_client_id' => '373xxx730.apps.googleusercontent.com',
57: 'ioFileCache_directory'  => 'tmp/apiClient',  // my apache user does not have access to the system /tmp folder.  + tmp/apiClient has permissions of 777 on the server.

using this link:

使用此链接：

http://code.google.com/p/google-api-php-client/source/browse/trunk/examples/prediction/serviceAccount.php?spec=svn445&r=395

I modified it to:

我把它修改为：

<?php if ( ! defined('BASEPATH')) exit('No direct script access allowed');
class Test extends CI_Controller{
    function __construct()
    {
        parent::__construct();
    }
    function index()
    {
        set_include_path(get_include_path() . PATH_SEPARATOR .dirname(__FILE__).'/../libraries/google-api-php-client/src');
        ini_set('error_reporting',E_ALL);
        ini_set('display_errors','1');
        // Set your client id, service account name, and the path to your private key.
        // For more information about obtaining these keys, visit:
        // https://developers.google.com/console/help/#service_accounts
        define('CLIENT_ID','3731xxx44730.apps.googleusercontent.com');
        define('SERVICE_ACCOUNT_NAME','[e-mail]');
        // Make sure you keep your key.p12 file in a secure location, and isn't
        // readable by others.
        define('KEY_FILE',dirname(__FILE__).'/../../461290xxx796c0b7db9582c-privatekey.p12');

        require_once "apiClient.php";
        require_once "contrib/apiCalendarService.php";

        $client = new apiClient();
        $client->setApplicationName("pqp");     
        // Set your cached access token. Remember to replace $_SESSION with a
        // real database or memcached.
        session_start();
        if (isset($_SESSION['token'])) {
            $client->setAccessToken($_SESSION['token']);
            echo 'client access token is set.<br/>';
        }

        // Load the key in PKCS 12 format (you need to download this from the
        // Google API Console when the service account was created.
        $key = file_get_contents(KEY_FILE);
        $creds = new apiAssertionCredentials(SERVICE_ACCOUNT_NAME,array('https://www.googleapis.com/auth/calendar'),$key);
        $client->setAssertionCredentials($creds);
        $client->setClientId(CLIENT_ID);
        $service = new apiCalendarService($client);
        echo 'client:<br/>';
        var_dump($client);
        echo 'service:<br/>';
        var_dump($service);
        // We're not done yet. Remember to update the cached access token.
        // Remember to replace $_SESSION with a real database or memcached.
        if ($client->getAccessToken()) {
            $_SESSION['token'] = $client->getAccessToken();
            echo 'token is good!, so creating an event....';
            echo $this->insert_event($service,'testing summary','my location','2012-06-29T10:00:00.000+10:00','2012-06-29T10:00:00.000+10:00');
        }
    }


    function insert_event($service,$summary,$location,$from,$to){
        $event = new Event();
        $event->setSummary($summary);
        $event->setLocation($location);
        $start = new EventDateTime();
        $start->setDateTime($from);
        $event->setStart($start);
        $end = new EventDateTime();
        $end->setDateTime($to);
        $event->setEnd($end);
        $attendee1 = new EventAttendee();
        $attendee1->setEmail('[e-mail]');
        $attendees = array($attendee1);
        $event->attendees = $attendees;
        $createdEvent = $service->events->insert('primary', $event);
        return $createdEvent->getId();

    }
}

a pastie of the output is here:

输出的馅饼在这里：

the $client object is not authenticated, the getAccessToken is not set, and the event is not inserted.

$ client对象未经过身份验证，未设置getAccessToken，并且未插入事件。

i have found it difficult to work out which settings in the $config file to change because there is different nomenclature. i guess this is an artifact of how the code has progressed. are the settings in src/config.php correct? do i need to alter any more settings?

我发现很难找出$ config文件中的哪些设置要更改，因为有不同的命名法。我想这是代码进展的一个神器。 src / config.php中的设置是否正确？我需要更改更多设置吗？

it is my understanding that if i create the service account, download the key file, and the contents of this file with my developer id, it should return a token, and there is no need to set up a redirection uri.. is that correct? this is the functionality i want. i don't want the user to have to authorise access because the website will only ever interact with one google account.

我的理解是，如果我创建服务帐户，下载密钥文件，以及我的开发人员ID的此文件的内容，它应该返回一个令牌，并且没有必要设置重定向uri ..是正确的？这是我想要的功能。我不希望用户必须授权访问，因为该网站只会与一个谷歌帐户进行交互。

So, the question is, how do i get this calendar api to authenticate using a google service account?

所以，问题是，我如何使用谷歌服务帐户获取此日历api进行身份验证？

1 个解决方案

#1

You can try this one if you not already...

你可以尝试这个，如果你还没有...

EDIT: this one intresting but if you still feel like to write one yourself then try this THE mother of the oauth2. helpful

编辑：这个有趣，但如果你仍然想自己写一个，那么试试这个oauth2的母亲。有帮助

About Service Account at google-api-php-client that you use(always take the trunk's one with SVN) I can't found in that code manipulations any reference apiAssertionCredentials::generateAssertion() definitely there is no call to auth in there

关于你使用google-api-php-client的服务帐户（总是把主干的一个用SVN）我在代码操作中找不到任何参考apiAssertionCredentials :: generateAssertion（）肯定没有调用auth在那里

public function __construct(
      $serviceAccountName,
      $scopes,
      $privateKey,
      $privateKeyPassword = 'notasecret',
      $assertionType = 'http://oauth.net/grant_type/jwt/1.0/bearer',
      $prn = false) {
    $this->serviceAccountName = $serviceAccountName;
    $this->scopes = is_string($scopes) ? $scopes : implode(' ', $scopes);
    $this->privateKey = $privateKey;
    $this->privateKeyPassword = $privateKeyPassword;
    $this->assertionType = $assertionType;
    $this->prn = $prn;
}

and this method should be called I guess...

这个方法应该叫我猜...

public function generateAssertion() {
    $now = time();

    $jwtParams = array(
          'aud' => apiOAuth2::OAUTH2_TOKEN_URI,
          'scope' => $this->scopes,
          'iat' => $now,
          'exp' => $now + self::MAX_TOKEN_LIFETIME_SECS,
          'iss' => $this->serviceAccountName,
    );

    if ($this->prn !== false) {
      $jwtParams['prn'] = $this->prn;
    }

    return $this->makeSignedJwt($jwtParams);
}

EDIT: Pardon. In fresh ver. look's like it's Google_OAuth2::refreshTokenWithAssertion() actualy who should start the real proces

编辑：原谅。在新的版本。看起来像是Google_OAuth2 :: refreshTokenWithAssertion（）实际应该启动真正的过程