How to get the email of the logged user with oauth2 service account?

Question

I'm trying to get the email of a user in appengine. I can't use the UserService nor , in the web.xml file.

I'm using OAuth2 with "Service Account", so that if the domain administrator, gives it high, users should be transparent.

Here's the code I'm using, but I can not reach any solution. Because when I request the user email with "Google Plus Service" , return the oauth2 clientID.

    GoogleCredential credential = new GoogleCredential.Builder().setTransport(HTTP_TRANSPORT)
        .setJsonFactory(JSON_FACTORY)
        .setServiceAccountId("Client_ID_Service_Account@developer.gserviceaccount.com")
        .setServiceAccountScopes(Arrays.asList(
             "https://www.googleapis.com/auth/plus.me",
                "https://www.googleapis.com/auth/userinfo.email",
                "https://www.googleapis.com/auth/userinfo.profile"))
       .setServiceAccountPrivateKeyFromP12File(
                new java.io.File(
                        "WEB-INF/yyyyyyyyyyyyyyyyyy-privatekey.p12"))
        .build();

      Plus plus = new Plus(HTTP_TRANSPORT, JSON_FACTORY, credential);

      Person profile = plus.people().get("me").execute();

      String email=profile.getEmails().get(0);

      String state = new BigInteger(130, new SecureRandom()).toString(32);


       String send="https://accounts.google.com/o/oauth2/auth?"+
                                        "scope=https://www.googleapis.com/auth/userinfo.email+https://www.googleapis.com/auth/userinfo.profile&"+
                                        "state=url%3Dhttps%253A%252F%rrrrrrrrrrrrrrr.appspot.com%26security_token%3D"+state+"&"+
                                        "redirect_uri=https://rrrrrrrrrrrrrrrr.appspot.com/vuelta&"+
                                        "response_type=id_token&"+
                                        "login_hint="+email+"&"+
                                        "client_id=Client_ID_for_web_application.apps.googleusercontent.com";
       resp.sendRedirect(send);

How I could continue?

Thanks in advance.

Answer 1

You are making the request on behalf of the service account, so the plus.me request returns information about the service account. To make the request on behalf of the user, you need something (the email) to identify the user you are interested in. Without this, there's no way for Google to know which user you are interested in. So, what you are asking is not possible on the server side unless you already have the email.

What you want to do is initiate a standard (not service account) oauth 2 authentication, asking the user for the plus.me scope. Because the service account already has permissions, you will automatically be granted these permissions. You can then use that authorization to request the information about the user.