使用OAuth2令牌对Google App Engine上托管的API进行身份验证？

Question

I'm building a backend for my Android app using GAE, and I'd like to authenticate users with their Google accounts, sent from the Android app.

Before OAuth2, you were able to use a Cookie retrieved from the _ah/login endpoint to authenticate users into your web app, but that method is deprecated and I'd like to be able to use the updated OAuth2 method.

In my Android app I've been able to generate a JSON Web Token using the following line:

String jwt =  GoogleAuthUtil.getToken(FamiliarActivity.this, Plus.AccountApi.getAccountName(mGoogleApiClient), "audience:server:client_id:1234567.apps.googleusercontent.com");

or an OAuth token:

String oauth2 =  GoogleAuthUtil.getToken(FamiliarActivity.this, Plus.AccountApi.getAccountName(mGoogleApiClient), "oauth2:server:client_id:1234567.apps.googleusercontent.com:api_scope:https://www.googleapis.com/auth/plus.login");

Either, manually, I can pass to my API and validate against Google. But I haven't been able to figure out a way to use a token like this to trigger authentication in GAE like the Cookie used to. The documentation seems to indicate passing it as a header: Authorization: Bearer <TOKEN> but that doesn't seem to work.

What is the correct way to retrieve and pass a token to my GAE endpoint so that it authenticates the user?

Answer 1

The correct and documented way to accomplish this is to:

1) Create an OAuth protected endpoint with the

https://www.googleapis.com/auth/plus.login

or

https://www.googleapis.com/auth/userinfo.email

scope and authorized Client ID for the Android client app.

2) Generate client library and integrate with your app.