1

Important: API has changed - Read this first: https://developers.google.com/accounts/docs/AuthForInstalledApps

ClientLogin has been officially deprecated as of April 20, 2012. It will continue to work as per our deprecation policy, but we encourage you to migrate to OAuth 2.0 as soon as possible.

I want to build two application client (some python/java program) and server (Google App Engine application) and authenticated with google acount from client to server to get some secret information.

Let me explain scenario:

  1. Server has address https://example.appspot.com.
  2. Client want download restricted information from https://example.appspot.com/restricted so this url is defined and login: required in app.yaml.
  3. Client use some Google Account example_login and example_password to get access.

How properly authenticate from client into Google App Engine to get access to https://example.appspot.com/restricted?

Robert Harvey
  • 178,213
  • 47
  • 333
  • 501
Chameleon
  • 9,722
  • 16
  • 65
  • 127
  • 1
    See this question : http://stackoverflow.com/questions/101742/how-do-you-access-an-authenticated-google-app-engine-service-from-a-non-web-py – voscausa Oct 03 '12 at 21:12
  • Consider that http://stackoverflow.com/questions/101742/how-do-you-access-an-authenticated-google-app-engine-service-from-a-non-web-py is not duplicate since was asked in 2008 and become invalid in 2012 since ClientLogin become marke by Google as deprecated. – Chameleon Oct 04 '12 at 20:23

1 Answers1

1

Another easy method, without login, is to use HMAC. You create a MAC signature based on timestamp (to make every request unique) and a secret MAC KEY. You request contains the timestamp and the MAC signature. The server can verify the MAC, because it also has the secret MAC KEY.

This Python code works on both sides (client and server)`:

import hmac, base64, hashlib

new_hmac = hmac.new(key=my_secret_MAC_KEY, msg=timestamp_in_request, digestmod=hashlib.sha256)
signature = base64.b64encode(new_hmac.digest()).decode()
if signature_in_request != signature : raise ValueError('access denied')

This works fine for a single user, because you have to manage a single key. When you have a lot of users, client login is a much better option.

voscausa
  • 11,253
  • 2
  • 39
  • 67
  • Want to avoid this method because it will lead me to develop custom users management what will complicate authorization. As you said better is to use client login if you have more user - another advantage is that user knows that with one user name and password can log everywhere with same method - learning time is shorter. – Chameleon Oct 04 '12 at 06:35
  • appcfg.py works fine with client login. I think that is the only reason for the Google app engine team to not use OAuth2 for installed applications. – voscausa Oct 04 '12 at 20:10
  • appcfg.py contains ClientLogin and this code still works but it is deprecated in documentation since 2012 - appcfg.py contains now also some code related to oauth - search string APPCFG_CLIENT_ID. Try appcfg.py --help it contains also option for oauth2. – Chameleon Oct 04 '12 at 20:18
  • Thanks for the TIP. Now I can use: Passwordless Login with OAuth2 in appcfg.py. – voscausa Oct 04 '12 at 20:34
  • I must check what you found with use of it --oauth2 :) – Chameleon Oct 05 '12 at 20:17