用于服务器到服务器应用程序的 Google OAuth 2.0

Question

我想从外部访问 GCP 存储分区。所以我使用了谷歌提供的以下步骤。

1. 创建了服务帐号
2. 使用为服务帐户提供的私钥生成 jwt 令牌。

当我通过提供 jwt 令牌调用上述 API 来获取访问令牌时，它会出现以下错误。

{
    "error": "invalid_scope",
    "error_description": "Empty or missing scope not allowed."
}

提前致谢！

https://developers.google.com/identity/protocols/OAuth2ServiceAccount

这是我用来生成 JWT 的 Java 代码

long now = System.currentTimeMillis();

try {

    GoogleCredential credential = GoogleCredential.fromStream(new FileInputStream("service.json"));
    PrivateKey privateKey = credential.getServiceAccountPrivateKey();
    String privateKeyId = credential.getServiceAccountPrivateKeyId();

    Algorithm algorithm = Algorithm.RSA256(null, (RSAPrivateKey) privateKey);
    String signedJwt = JWT.create()
        .withKeyId(privateKeyId)
        .withIssuer("***********@************-******.iam.gserviceaccount.com")
        .withSubject("***********@************-******.iam.gserviceaccount.com")
        .withAudience("https://www.googleapis.com/oauth2/v4/token")
        .withIssuedAt(new Date(now))
        .withExpiresAt(new Date(now + 3600 * 1000L))
        .sign(algorithm);

    System.out.println(signedJwt);
} catch(Exception e) {
    System.out.println(e);
}

Answer 1

我发现了这个问题。我传递的有效负载是用来生成 JWT 令牌的。 下面我附上了我用来生成 jwt 令牌的 python 代码。 我从 python 代码下面的https://www.jhanley.com/google-cloud-creating-oauth-access-tokens-for-rest-api-calls/ 得到了参考

import jwt
import time

# Permissions to request for Access Token
scopes = "https://www.googleapis.com/auth/devstorage.read_write"

# private key id
pkey_id = ""

# private key
pkey = ""

serviceid = ""

# Google Endpoint for creating OAuth 2.0 Access Tokens from Signed-JWT
auth_url = "https://www.googleapis.com/oauth2/v4/token"

# Set how long this token will be valid in seconds
expires_in = 3600  # Expires in 1 hour

issued = int(time.time())
expires = issued + expires_in  # expires_in is in seconds

# JWT Payload
payload = {
    "iss": serviceid,   # Issuer claim
    "sub": serviceid,   # Issuer claim
    "aud": auth_url,    # Audience claim
    "iat": issued,      # Issued At claim
    "exp": expires,     # Expire time
    "scope": scopes     # Permissions
}

# JWT Headers
additional_headers = {
    'kid': pkey_id,
    "alg": "RS256",
    "typ": "JWT"  # Google uses SHA256withRSA
}

sig = jwt.encode(payload, pkey, algorithm="RS256", headers=additional_headers)
print(sig)