Google client credential JWT
Revision as of 18:19, 18 April 2020 by Pavel.lobko (talk | contribs)
When you need your application to call Google APIs on behalf of its own (users aren't directly involved), you should refer to Google OAuth 2.0 for Server to Server Applications. It is not exactly Oauth2 Client Credential flow, so i2rest client can't deal with it for you with the only command call. But we still can reproduce this authorization scenario composing requests and handling responses manually. Lets
I2REST COMMAND(*POST) URL('https://oauth2.googleapis.com/token') BODY(*N 'grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agra nt-type%3Ajwt-bearer&assertion=eyJhbGciOiJSUzI1N iIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJpMnJlc3RzZXJ2QGNs aWVudC1mbG93LWV4YW1wbGUuaWFtLmdzZXJ2aWNlYWNjb3Vu dC5jb20iLCJzY29wZSI6Imh0dHBzOi8vd3d3Lmdvb2dsZWFw aXMuY29tL2F1dGgvY2xvdWQtcGxhdGZvcm0iLCJhdWQiOiJo dHRwczovL29hdXRoMi5nb29nbGVhcGlzLmNvbS90b2tlbiIs ImV4cCI6MTU4NzEzMzAwMCwiaWF0IjoxNTg3MTI5NDU3fQ.h _n7RXC13ACXFJQ5J2_5AlMcRxhaEK0Yi7SW6s_GRkED9qV8X rDFa47e-5uI3ZuMSw3aak9-RUJk7v2uw7kJUhT11At5JLPtb wpwJxqj0dbvaqUKuwk4OKXYBWrHsRfWq8-GZZ-GryAwXzq38 p6j-3-jSJUm4EYKiXukzRWiGlUpP9xDZsOU_8gemJM3yR911 95Bsc0yY-sHoG1FjaGy9EMRq4nHzD-An-8OGezYot2tWbunk MU8LmurcM0IEafwytB_iM7QOO8LNV2eKbjj-Ilxqm5XLbzIm WAvqIK9gNQ7avrmpnttJMX78VKuCFK9UB3OdcTtCs3Wb7r4P jQ5qg' 'application/x-www-form-urlencoded') OUTPUT(*BOTH) DCMCLIENT(MYCLIENT) RECVLOG('/home/btpl/rejwt.log') SENTLOG('/home/btpl/sejwt.log') AUTHMETHOD(*NONE)
Server response (status 200, shown 261 bytes of 261): {"access_token":"ya29.c.Ko8BxwcD_TDznwIQVB7Y_vs1S8a86_DhMfVwz1rcMfLkaMkMtx BBIxqoYbfJdQvp5O3EONN-lz7VviAVNWx3pQInTxPdf_2pmL9JW3l8Qt DfSrfVL0CSk1j_BgEdR0jkPCCsRQPtWkSdSm-cH2vFZZiVcOOEOq4Yt8C3jzBl3kzNt2N882ic P0G6vmwdFljOdhY","expires_in":3599,"token_type":"Bearer"}
I2REST COMMAND(*POST) URL('https://iam.googleapis.com/v1/projects/client-fl ow-example/serviceAccounts?access_token=ya29.c.Ko 8BxwcD_TDznwIQVB7Y_vs1S8a86_DhMfVwz1rcMfLkaMkMtxB BIxqoYbfJdQvp5O3EONN-lz7VviAVNWx3pQInTxPdf_2pmL9J W3l8QtDfSrfVL0CSk1j_BgEdR0jkPCCsRQPtWkSdSm-cH2vFZ ZiVcOOEOq4Yt8C3jzBl3kzNt2N882icP0G6vmwdFljOdhY') BODY(*N '{ "accountId": "i2restcreated", "serviceAccount": { "description": "created via i2rest client", "displayName": "example one" } }' 'application/json' *YES 1208) OUTPUT(*BOTH) DCMCLIENT(MYCLIENT) RECVLOG('/home/btpl/recreatsr1.log') SENTLOG('/home/btpl/sncreatsr1.log') AUTHMETHOD(*NONE) I2REST COMMAND(*GET) URL('https://iam.googleapis.com/v1/projects/client-fl ow-example/serviceAccounts') HEADERS((AUTHORIZATION 'Bearer ya29.c.Ko8BxwcD_TDznwI QVB7Y_vs1S8a86_DhMfVwz1rcMfLkaMkMtxBBIxqoYbfJ dQvp5O3EONN-lz7VviAVNWx3pQInTxPdf_2pmL9JW3l8Q tDfSrfVL0CSk1j_BgEdR0jkPCCsRQPtWkSdSm-cH2vFZZ iVcOOEOq4Yt8C3jzBl3kzNt2N882icP0G6vmwdFljOdhY ')) OUTPUT(*BOTH) DCMCLIENT(MYCLIENT) RECVLOG('/home/btpl/CAdriverecv.log') SENTLOG('/home/btpl/CAdrivesent.log') AUTHMETHOD(*NONE) { "accounts": [ { "name": "projects/client-flow-example/serviceAccounts/i2restserv@client-flow-example.iam.gserviceaccount.com", "projectId": "client-flow-example", "uniqueId": "117967955212758073044", "email": "i2restserv@client-flow-example.iam.gserviceaccount.com", "displayName": "i2restserv", "etag": "MDEwMjE5MjA=", "description": "Example to i2rest client flow", "oauth2ClientId": "117967955212758073044" }, { "name": "projects/client-flow-example/serviceAccounts/i2restcreated@client-flow-example.iam.gserviceaccount.com", "projectId": "client-flow-example", "uniqueId": "104934312932229503067", "email": "i2restcreated@client-flow-example.iam.gserviceaccount.com", "displayName": "example one", "etag": "MDEwMjE5MjA=", "description": "created via i2rest client", "oauth2ClientId": "104934312932229503067" } ] }