In our last biweekly meeting, you recommended everyone use OAuth 2.0
As described in "Using OAuth 2.0 for Server to Server Applications" ( https://developers.google.com/accounts/docs/OAuth2ServiceAccount) " The mechanics of this interaction require applications to create and cryptographically sign JWTs. Developers are strongly encouraged to use an existing library to perform these tasks."
However, there is currently no support for this in .NET? Is there an ETA on the Crypto support in the .NET library? Is there a recommended alternative or is it best to wait until this support is present.
> In our last biweekly meeting, you recommended everyone use OAuth 2.0
> As described in "Using OAuth 2.0 for Server to Server Applications" (
> https://developers.google.com/accounts/docs/OAuth2ServiceAccount) " The
> mechanics of this interaction require applications to create and
> cryptographically sign JWTs. Developers are strongly encouraged to use an
> existing library to perform these tasks."
> However, there is currently no support for this in .NET? Is there an ETA
> on the Crypto support in the .NET library? Is there a recommended
> alternative or is it best to wait until this support is present.
> Thanks,
> Caroline
> --
> You received this message because you are subscribed to the Google Groups
> "Google Content API for Shopping" group.
> To view this discussion on the web visit
> https://groups.google.com/d/msg/google-content-api-for-shopping/-/IYd... > .
> To post to this group, send email to
> google-content-api-for-shopping@googlegroups.com.
> To unsubscribe from this group, send email to
> google-content-api-for-shopping+unsubscribe@googlegroups.com.
> For more options, visit this group at
> http://groups.google.com/group/google-content-api-for-shopping?hl=en.
> On Mon, May 14, 2012 at 7:52 AM, Caroline McLean <bbmcarol...@gmail.com>wrote:
>> Danny,
>> In our last biweekly meeting, you recommended everyone use OAuth 2.0
>> As described in "Using OAuth 2.0 for Server to Server Applications" ( >> https://developers.google.com/accounts/docs/OAuth2ServiceAccount) " The >> mechanics of this interaction require applications to create and >> cryptographically sign JWTs. Developers are strongly encouraged to use an >> existing library to perform these tasks."
>> However, there is currently no support for this in .NET? Is there an ETA >> on the Crypto support in the .NET library? Is there a recommended >> alternative or is it best to wait until this support is present.
>> Thanks, >> Caroline
>> -- >> You received this message because you are subscribed to the Google Groups >> "Google Content API for Shopping" group. >> To view this discussion on the web visit >> https://groups.google.com/d/msg/google-content-api-for-shopping/-/IYd... >> . >> To post to this group, send email to >> google-content-api-for-shopping@googlegroups.com. >> To unsubscribe from this group, send email to >> google-content-api-for-shopping+unsubscribe@googlegroups.com. >> For more options, visit this group at >> http://groups.google.com/group/google-content-api-for-shopping?hl=en.
Looks like the sample you referenced, addresses the installed Applications OAuth requirements. I need support for the server to server Oauth as described in my first message. The challenge being generating a JSON Web Token and appropriately signing it with the private key generated by Google. "When at all possible, a developer should not write the logic for creating and signing JWTs." However it does not list a .net library on that page. Is JWT support included in the current .net library?
>> On Mon, May 14, 2012 at 7:52 AM, Caroline McLean <bbmcarol...@gmail.com>wrote:
>>> Danny,
>>> In our last biweekly meeting, you recommended everyone use OAuth 2.0
>>> As described in "Using OAuth 2.0 for Server to Server Applications" ( >>> https://developers.google.com/accounts/docs/OAuth2ServiceAccount) " The >>> mechanics of this interaction require applications to create and >>> cryptographically sign JWTs. Developers are strongly encouraged to use an >>> existing library to perform these tasks."
>>> However, there is currently no support for this in .NET? Is there an >>> ETA on the Crypto support in the .NET library? Is there a recommended >>> alternative or is it best to wait until this support is present.
>>> Thanks, >>> Caroline
>>> -- >>> You received this message because you are subscribed to the Google >>> Groups "Google Content API for Shopping" group. >>> To view this discussion on the web visit >>> https://groups.google.com/d/msg/google-content-api-for-shopping/-/IYd... >>> . >>> To post to this group, send email to >>> google-content-api-for-shopping@googlegroups.com. >>> To unsubscribe from this group, send email to >>> google-content-api-for-shopping+unsubscribe@googlegroups.com. >>> For more options, visit this group at >>> http://groups.google.com/group/google-content-api-for-shopping?hl=en.
> Looks like the sample you referenced, addresses the installed Applications
> OAuth requirements. I need support for the server to server Oauth as
> described in my first message. The challenge being generating a JSON Web
> Token and appropriately signing it with the private key generated by
> Google. "When at all possible, a developer should not write the logic for
> creating and signing JWTs." However it does not list a .net library on that
> page. Is JWT support included in the current .net library?
> Thanks,
> Caroline
> On Monday, May 14, 2012 5:00:17 PM UTC-4, Caroline McLean wrote:
>> Thanks Danny!
>> On Monday, May 14, 2012 11:28:48 AM UTC-4, Daniel Hermes wrote:
>>> Caroline,
>>> There is support for it and I'll be posting in depth instructions
>>> hopefully sometime this week.
>>>> However, there is currently no support for this in .NET? Is there an
>>>> ETA on the Crypto support in the .NET library? Is there a recommended
>>>> alternative or is it best to wait until this support is present.
>>>> Thanks,
>>>> Caroline
>>>> --
>>>> You received this message because you are subscribed to the Google
>>>> Groups "Google Content API for Shopping" group.
>>>> To view this discussion on the web visit https://groups.google.com/d/** >>>> msg/google-content-api-for-**shopping/-/IYdHffEB1LUJ<https://groups.google.com/d/msg/google-content-api-for-shopping/-/IYd...>
>>>> .
>>>> To post to this group, send email to google-content-api-for-**
>>>> shopping@googlegroups.com<google-content-api-for-shopping@googlegroups.com>
>>>> .
>>>> To unsubscribe from this group, send email to google-content-api-for-**
>>>> shopping+unsubscribe@**googlegroups.com<google-content-api-for-shopping%2Bu nsubscribe@googlegroups.com>
>>>> .
>>>> For more options, visit this group at http://groups.google.com/** >>>> group/google-content-api-for-**shopping?hl=en<http://groups.google.com/group/google-content-api-for-shopping?hl=en>
>>>> .
> To post to this group, send email to
> google-content-api-for-shopping@googlegroups.com.
> To unsubscribe from this group, send email to
> google-content-api-for-shopping+unsubscribe@googlegroups.com.
> For more options, visit this group at
> http://groups.google.com/group/google-content-api-for-shopping?hl=en.
I just spoke with the maintainers and there are no plans to support this in
the library due to constraints of time.
Is there a particular reason you needed this with service accounts? You
should be able to accomplish just about anything you need with the standard
OAuth2 flow.
On Tue, May 15, 2012 at 1:02 PM, Daniel Hermes <dher...@google.com> wrote:
> Caroline,
> Sorry I missed that. I'll check with the developers of the library to see
> if there is a timeline.
> Regards,
> On Tue, May 15, 2012 at 10:24 AM, Caroline McLean <bbmcarol...@gmail.com>wrote:
>> Looks like the sample you referenced, addresses the installed
>> Applications OAuth requirements. I need support for the server to server
>> Oauth as described in my first message. The challenge being generating a
>> JSON Web Token and appropriately signing it with the private key generated
>> by Google. "When at all possible, a developer should not write the logic
>> for creating and signing JWTs." However it does not list a .net library on
>> that page. Is JWT support included in the current .net library?
>> Thanks,
>> Caroline
>> On Monday, May 14, 2012 5:00:17 PM UTC-4, Caroline McLean wrote:
>>> Thanks Danny!
>>> On Monday, May 14, 2012 11:28:48 AM UTC-4, Daniel Hermes wrote:
>>>> Caroline,
>>>> There is support for it and I'll be posting in depth instructions
>>>> hopefully sometime this week.
>>>>> However, there is currently no support for this in .NET? Is there an
>>>>> ETA on the Crypto support in the .NET library? Is there a recommended
>>>>> alternative or is it best to wait until this support is present.
>>>>> Thanks,
>>>>> Caroline
>>>>> --
>>>>> You received this message because you are subscribed to the Google
>>>>> Groups "Google Content API for Shopping" group.
>>>>> To view this discussion on the web visit https://groups.google.com/d/* >>>>> *msg/google-content-api-for-**shopping/-/IYdHffEB1LUJ<https://groups.google.com/d/msg/google-content-api-for-shopping/-/IYd...>
>>>>> .
>>>>> To post to this group, send email to google-content-api-for-**
>>>>> shopping@googlegroups.com<google-content-api-for-shopping@googlegroups.com>
>>>>> .
>>>>> To unsubscribe from this group, send email to google-content-api-for-*
>>>>> *shopping+unsubscribe@**googlegroups.com<google-content-api-for-shopping%2B unsubscribe@googlegroups.com>
>>>>> .
>>>>> For more options, visit this group at http://groups.google.com/** >>>>> group/google-content-api-for-**shopping?hl=en<http://groups.google.com/group/google-content-api-for-shopping?hl=en>
>>>>> .
>> To post to this group, send email to
>> google-content-api-for-shopping@googlegroups.com.
>> To unsubscribe from this group, send email to
>> google-content-api-for-shopping+unsubscribe@googlegroups.com.
>> For more options, visit this group at
>> http://groups.google.com/group/google-content-api-for-shopping?hl=en.
Hmm, maybe I am confused, it looked like the other Oauth2 flows required manual intervention to obtain the token, IE a physical user to hit the approve button, we are doing automated product feeds, through our web applications, that are not run with a user in the flow. Did I confuse something? The web server (vs the server to server Oauth) states the following: " The response will be sent to the redirect_uri as specified in an access token request. If the user approves the access request, then the response contains an authorization code and the state parameter (if included in the request). If the user does not approve the request the response contains an error message. All responses are returned to the web server on the query string, as shown below:"
On Tuesday, May 15, 2012 6:41:27 PM UTC-4, Daniel Hermes wrote:
> Caroline,
> I just spoke with the maintainers and there are no plans to support this > in the library due to constraints of time.
> Is there a particular reason you needed this with service accounts? You > should be able to accomplish just about anything you need with the standard > OAuth2 flow.
> Regards,
> On Tue, May 15, 2012 at 1:02 PM, Daniel Hermes <dher...@google.com> wrote:
>> Caroline,
>> Sorry I missed that. I'll check with the developers of the library to see >> if there is a timeline.
>> Regards,
>> On Tue, May 15, 2012 at 10:24 AM, Caroline McLean <bbmcarol...@gmail.com>wrote:
>>> Looks like the sample you referenced, addresses the installed >>> Applications OAuth requirements. I need support for the server to server >>> Oauth as described in my first message. The challenge being generating a >>> JSON Web Token and appropriately signing it with the private key generated >>> by Google. "When at all possible, a developer should not write the logic >>> for creating and signing JWTs." However it does not list a .net library on >>> that page. Is JWT support included in the current .net library?
>>> Thanks, >>> Caroline
>>> On Monday, May 14, 2012 5:00:17 PM UTC-4, Caroline McLean wrote:
>>>> Thanks Danny!
>>>> On Monday, May 14, 2012 11:28:48 AM UTC-4, Daniel Hermes wrote:
>>>>> Caroline,
>>>>> There is support for it and I'll be posting in depth instructions >>>>> hopefully sometime this week.
>>>>>> However, there is currently no support for this in .NET? Is there an >>>>>> ETA on the Crypto support in the .NET library? Is there a recommended >>>>>> alternative or is it best to wait until this support is present.
>>>>>> Thanks, >>>>>> Caroline
>>>>>> -- >>>>>> You received this message because you are subscribed to the Google >>>>>> Groups "Google Content API for Shopping" group. >>>>>> To view this discussion on the web visit https://groups.google.com/d/ >>>>>> **msg/google-content-api-for-**shopping/-/IYdHffEB1LUJ<https://groups.google.com/d/msg/google-content-api-for-shopping/-/IYd...> >>>>>> . >>>>>> To post to this group, send email to google-content-api-for-** >>>>>> shopping@googlegroups.com<google-content-api-for-shopping@googlegroups.com> >>>>>> . >>>>>> To unsubscribe from this group, send email to google-content-api-for- >>>>>> **shopping+unsubscribe@**googlegroups.com<google-content-api-for-shopping%2 Bunsubscribe@googlegroups.com> >>>>>> . >>>>>> For more options, visit this group at http://groups.google.com/** >>>>>> group/google-content-api-for-**shopping?hl=en<http://groups.google.com/group/google-content-api-for-shopping?hl=en> >>>>>> .
>>> To post to this group, send email to >>> google-content-api-for-shopping@googlegroups.com. >>> To unsubscribe from this group, send email to >>> google-content-api-for-shopping+unsubscribe@googlegroups.com. >>> For more options, visit this group at >>> http://groups.google.com/group/google-content-api-for-shopping?hl=en.
You will only need your users to "manually intervene" to accept the token
once. You can set the redirect uri to a page in your "web application" and
parse the returned code from there. (This is the parameters.AccessCode =
line in the sample).
[Sample:
http://code.google.com/p/google-gdata/source/browse/trunk/clients/cs/... ]
Once you obtain an access token and refresh token, you can use the access
token to sign requests until it expires (3600 second expiry usually). After
it expires, you can use the refresh token to get a new access token without
user intervention.
You don't have to worry about any of the refresh logic because the library
handles all of it.
> Hmm, maybe I am confused, it looked like the other Oauth2 flows required
> manual intervention to obtain the token, IE a physical user to hit the
> approve button, we are doing automated product feeds, through our web
> applications, that are not run with a user in the flow. Did I confuse
> something? The web server (vs the server to server Oauth) states the
> following: " The response will be sent to the redirect_uri as specified
> in an access token request. If the user approves the access request, then
> the response contains an authorization code and the state parameter (if
> included in the request). If the user does not approve the request the
> response contains an error message. All responses are returned to the web
> server on the query string, as shown below:"
> Thanks again for your help.
> Caroline
> On Tuesday, May 15, 2012 6:41:27 PM UTC-4, Daniel Hermes wrote:
>> Caroline,
>> I just spoke with the maintainers and there are no plans to support this
>> in the library due to constraints of time.
>> Is there a particular reason you needed this with service accounts? You
>> should be able to accomplish just about anything you need with the standard
>> OAuth2 flow.
>> Regards,
>> On Tue, May 15, 2012 at 1:02 PM, Daniel Hermes <dher...@google.com>wrote:
>>> Caroline,
>>> Sorry I missed that. I'll check with the developers of the library to
>>> see if there is a timeline.
>>> Regards,
>>> On Tue, May 15, 2012 at 10:24 AM, Caroline McLean <bbmcarol...@gmail.com
>>> > wrote:
>>>> Looks like the sample you referenced, addresses the installed
>>>> Applications OAuth requirements. I need support for the server to server
>>>> Oauth as described in my first message. The challenge being generating a
>>>> JSON Web Token and appropriately signing it with the private key generated
>>>> by Google. "When at all possible, a developer should not write the logic
>>>> for creating and signing JWTs." However it does not list a .net library on
>>>> that page. Is JWT support included in the current .net library?
>>>> Thanks,
>>>> Caroline
>>>> On Monday, May 14, 2012 5:00:17 PM UTC-4, Caroline McLean wrote:
>>>>> Thanks Danny!
>>>>> On Monday, May 14, 2012 11:28:48 AM UTC-4, Daniel Hermes wrote:
>>>>>> Caroline,
>>>>>> There is support for it and I'll be posting in depth instructions
>>>>>> hopefully sometime this week.
>>>>>>> However, there is currently no support for this in .NET? Is there
>>>>>>> an ETA on the Crypto support in the .NET library? Is there a recommended
>>>>>>> alternative or is it best to wait until this support is present.
>>>>>>> Thanks,
>>>>>>> Caroline
>>>>>>> --
>>>>>>> You received this message because you are subscribed to the Google
>>>>>>> Groups "Google Content API for Shopping" group.
>>>>>>> To view this discussion on the web visit
>>>>>>> https://groups.google.com/d/**ms**g/google-content-api-for-**shopp** >>>>>>> ing/-/IYdHffEB1LUJ<https://groups.google.com/d/msg/google-content-api-for-shopping/-/IYd...>
>>>>>>> .
>>>>>>> To post to this group, send email to google-content-api-for-**
>>>>>>> shoppin**g@googlegroups.com<google-content-api-for-shopping@googlegroups.co m>
>>>>>>> .
>>>>>>> To unsubscribe from this group, send email to
>>>>>>> google-content-api-for-**shoppin**g+unsubscribe@**googlegroups.com<google-c ontent-api-for-shopping%2Bunsubscribe@googlegroups.com>
>>>>>>> **.
>>>>>>> For more options, visit this group at http://groups.google.com/** >>>>>>> group**/google-content-api-for-**shoppi**ng?hl=en<http://groups.google.com/group/google-content-api-for-shopping?hl=en>
>>>>>>> .
>>>> To post to this group, send email to google-content-api-for-**
>>>> shopping@googlegroups.com<google-content-api-for-shopping@googlegroups.com>
>>>> .
>>>> To unsubscribe from this group, send email to google-content-api-for-**
>>>> shopping+unsubscribe@**googlegroups.com<google-content-api-for-shopping%2Bu nsubscribe@googlegroups.com>
>>>> .
>>>> For more options, visit this group at http://groups.google.com/** >>>> group/google-content-api-for-**shopping?hl=en<http://groups.google.com/group/google-content-api-for-shopping?hl=en>
>>>> .
> To post to this group, send email to
> google-content-api-for-shopping@googlegroups.com.
> To unsubscribe from this group, send email to
> google-content-api-for-shopping+unsubscribe@googlegroups.com.
> For more options, visit this group at
> http://groups.google.com/group/google-content-api-for-shopping?hl=en.
The service to service approach for us is probably most appropriate. The less we need our merchants to do the better. I think I am almost there. I set up the google service account and think I have the JWT generated and signed appropriately, but I am receiving "invalid_grant" back. I have verified I am using the correct email account in the payload (xxx @developer.gserviceaccount.com), is there someone that can look at the logs and give me more detail as to what exactly is failing. I know its by design that little info is returned.
On Tuesday, May 15, 2012 7:07:32 PM UTC-4, Daniel Hermes wrote:
> Caroline,
> You will only need your users to "manually intervene" to accept the token > once. You can set the redirect uri to a page in your "web application" and > parse the returned code from there. (This is the parameters.AccessCode = > line in the sample). > [Sample: > http://code.google.com/p/google-gdata/source/browse/trunk/clients/cs/... > ]
> Once you obtain an access token and refresh token, you can use the access > token to sign requests until it expires (3600 second expiry usually). After > it expires, you can use the refresh token to get a new access token without > user intervention.
> You don't have to worry about any of the refresh logic because the library > handles all of it.
> So it's enough to serialize the data in an OAuth2Parameters object somehow > and keep it around for your user after the initial acceptance:
> On Tue, May 15, 2012 at 3:54 PM, Caroline McLean <bbmcarol...@gmail.com>wrote:
>> Hmm, maybe I am confused, it looked like the other Oauth2 flows required >> manual intervention to obtain the token, IE a physical user to hit the >> approve button, we are doing automated product feeds, through our web >> applications, that are not run with a user in the flow. Did I confuse >> something? The web server (vs the server to server Oauth) states the >> following: " The response will be sent to the redirect_uri as specified >> in an access token request. If the user approves the access request, then >> the response contains an authorization code and the state parameter (if >> included in the request). If the user does not approve the request the >> response contains an error message. All responses are returned to the web >> server on the query string, as shown below:"
>> Thanks again for your help. >> Caroline
>> On Tuesday, May 15, 2012 6:41:27 PM UTC-4, Daniel Hermes wrote:
>>> Caroline,
>>> I just spoke with the maintainers and there are no plans to support this >>> in the library due to constraints of time.
>>> Is there a particular reason you needed this with service accounts? You >>> should be able to accomplish just about anything you need with the standard >>> OAuth2 flow.
>>> Regards,
>>> On Tue, May 15, 2012 at 1:02 PM, Daniel Hermes <dher...@google.com>wrote:
>>>> Caroline,
>>>> Sorry I missed that. I'll check with the developers of the library to >>>> see if there is a timeline.
>>>> Regards,
>>>> On Tue, May 15, 2012 at 10:24 AM, Caroline McLean < >>>> bbmcarol...@gmail.com> wrote:
>>>>> Looks like the sample you referenced, addresses the installed >>>>> Applications OAuth requirements. I need support for the server to server >>>>> Oauth as described in my first message. The challenge being generating a >>>>> JSON Web Token and appropriately signing it with the private key generated >>>>> by Google. "When at all possible, a developer should not write the logic >>>>> for creating and signing JWTs." However it does not list a .net library on >>>>> that page. Is JWT support included in the current .net library?
>>>>> Thanks, >>>>> Caroline
>>>>> On Monday, May 14, 2012 5:00:17 PM UTC-4, Caroline McLean wrote:
>>>>>> Thanks Danny!
>>>>>> On Monday, May 14, 2012 11:28:48 AM UTC-4, Daniel Hermes wrote:
>>>>>>> Caroline,
>>>>>>> There is support for it and I'll be posting in depth instructions >>>>>>> hopefully sometime this week.
>>>>>>>> However, there is currently no support for this in .NET? Is there >>>>>>>> an ETA on the Crypto support in the .NET library? Is there a recommended >>>>>>>> alternative or is it best to wait until this support is present.
>>>>>>>> Thanks, >>>>>>>> Caroline
>>>>>>>> -- >>>>>>>> You received this message because you are subscribed to the Google >>>>>>>> Groups "Google Content API for Shopping" group. >>>>>>>> To view this discussion on the web visit >>>>>>>> https://groups.google.com/d/**ms**g/google-content-api-for-**shopp* >>>>>>>> *ing/-/IYdHffEB1LUJ<https://groups.google.com/d/msg/google-content-api-for-shopping/-/IYd...> >>>>>>>> . >>>>>>>> To post to this group, send email to google-content-api-for-** >>>>>>>> shoppin**g@googlegroups.com<google-content-api-for-shopping@googlegroups.co m> >>>>>>>> . >>>>>>>> To unsubscribe from this group, send email to >>>>>>>> google-content-api-for-**shoppin**g+unsubscribe@**googlegroups.com<google-c ontent-api-for-shopping%2Bunsubscribe@googlegroups.com> >>>>>>>> **. >>>>>>>> For more options, visit this group at http://groups.google.com/** >>>>>>>> group**/google-content-api-for-**shoppi**ng?hl=en<http://groups.google.com/group/google-content-api-for-shopping?hl=en> >>>>>>>> .
>>>>> To post to this group, send email to google-content-api-for-** >>>>> shopping@googlegroups.com<google-content-api-for-shopping@googlegroups.com> >>>>> . >>>>> To unsubscribe from this group, send email to google-content-api-for-* >>>>> *shopping+unsubscribe@**googlegroups.com<google-content-api-for-shopping%2B unsubscribe@googlegroups.com> >>>>> . >>>>> For more options, visit this group at http://groups.google.com/** >>>>> group/google-content-api-for-**shopping?hl=en<http://groups.google.com/group/google-content-api-for-shopping?hl=en> >>>>> .
>> To post to this group, send email to >> google-content-api-for-shopping@googlegroups.com. >> To unsubscribe from this group, send email to >> google-content-api-for-shopping+unsubscribe@googlegroups.com. >> For more options, visit this group at >> http://groups.google.com/group/google-content-api-for-shopping?hl=en.
In response to "The less we need our merchants to do the better.":
As I said, the OAuth2 flow will only need user intervention for the very
first step. No matter how you slice it, you'll need their consent one way
another. Using a page on your site as your redirect uri, you will be able
to set up the OAuth2 flow completely on your site without having to write
any extra hacks.
On Wed, May 16, 2012 at 2:24 PM, Caroline McLean <bbmcarol...@gmail.com>wrote:
> The service to service approach for us is probably most appropriate. The
> less we need our merchants to do the better. I think I am almost there. I
> set up the google service account and think I have the JWT generated and
> signed appropriately, but I am receiving "invalid_grant" back. I have
> verified I am using the correct email account in the payload (xxx @
> developer.gserviceaccount.com), is there someone that can look at the
> logs and give me more detail as to what exactly is failing. I know its by
> design that little info is returned.
> Thanks,
> Caroline
> On Tuesday, May 15, 2012 7:07:32 PM UTC-4, Daniel Hermes wrote:
>> Once you obtain an access token and refresh token, you can use the access
>> token to sign requests until it expires (3600 second expiry usually). After
>> it expires, you can use the refresh token to get a new access token without
>> user intervention.
>> You don't have to worry about any of the refresh logic because the
>> library handles all of it.
>> On Tue, May 15, 2012 at 3:54 PM, Caroline McLean <bbmcarol...@gmail.com>wrote:
>>> Hmm, maybe I am confused, it looked like the other Oauth2 flows required
>>> manual intervention to obtain the token, IE a physical user to hit the
>>> approve button, we are doing automated product feeds, through our web
>>> applications, that are not run with a user in the flow. Did I confuse
>>> something? The web server (vs the server to server Oauth) states the
>>> following: " The response will be sent to the redirect_uri as specified
>>> in an access token request. If the user approves the access request, then
>>> the response contains an authorization code and the state parameter (if
>>> included in the request). If the user does not approve the request the
>>> response contains an error message. All responses are returned to the web
>>> server on the query string, as shown below:"
>>> Thanks again for your help.
>>> Caroline
>>> On Tuesday, May 15, 2012 6:41:27 PM UTC-4, Daniel Hermes wrote:
>>>> Caroline,
>>>> I just spoke with the maintainers and there are no plans to support
>>>> this in the library due to constraints of time.
>>>> Is there a particular reason you needed this with service accounts? You
>>>> should be able to accomplish just about anything you need with the standard
>>>> OAuth2 flow.
>>>> Regards,
>>>> On Tue, May 15, 2012 at 1:02 PM, Daniel Hermes <dher...@google.com>wrote:
>>>>> Caroline,
>>>>> Sorry I missed that. I'll check with the developers of the library to
>>>>> see if there is a timeline.
>>>>> Regards,
>>>>> On Tue, May 15, 2012 at 10:24 AM, Caroline McLean <
>>>>> bbmcarol...@gmail.com> wrote:
>>>>>> Looks like the sample you referenced, addresses the installed
>>>>>> Applications OAuth requirements. I need support for the server to server
>>>>>> Oauth as described in my first message. The challenge being generating a
>>>>>> JSON Web Token and appropriately signing it with the private key generated
>>>>>> by Google. "When at all possible, a developer should not write the logic
>>>>>> for creating and signing JWTs." However it does not list a .net library on
>>>>>> that page. Is JWT support included in the current .net library?
>>>>>> Thanks,
>>>>>> Caroline
>>>>>> On Monday, May 14, 2012 5:00:17 PM UTC-4, Caroline McLean wrote:
>>>>>>> Thanks Danny!
>>>>>>> On Monday, May 14, 2012 11:28:48 AM UTC-4, Daniel Hermes wrote:
>>>>>>>> Caroline,
>>>>>>>> There is support for it and I'll be posting in depth instructions
>>>>>>>> hopefully sometime this week.
>>>>>>>> On Mon, May 14, 2012 at 7:52 AM, Caroline McLean <
>>>>>>>> bbmcarol...@gmail.com> wrote:
>>>>>>>>> Danny,
>>>>>>>>> In our last biweekly meeting, you recommended everyone use OAuth
>>>>>>>>> 2.0
>>>>>>>>> As described in "Using OAuth 2.0 for Server to Server
>>>>>>>>> Applications" ( https://developers.google.com/******accounts/docs/ >>>>>>>>> **OAuth2ServiceAcc****ount<https://developers.google.com/accounts/docs/OAuth2ServiceAccount>)
>>>>>>>>> " The mechanics of this interaction require applications to
>>>>>>>>> create and cryptographically sign JWTs. Developers are strongly encouraged
>>>>>>>>> to use an existing library to perform these tasks."
>>>>>>>>> However, there is currently no support for this in .NET? Is there
>>>>>>>>> an ETA on the Crypto support in the .NET library? Is there a recommended
>>>>>>>>> alternative or is it best to wait until this support is present.
>>>>>>>>> Thanks,
>>>>>>>>> Caroline
>>>>>>>>> --
>>>>>>>>> You received this message because you are subscribed to the Google
>>>>>>>>> Groups "Google Content API for Shopping" group.
>>>>>>>>> To view this discussion on the web visit
>>>>>>>>> https://groups.google.com/d/**ms****g/google-content-api-for-** >>>>>>>>> shopp****ing/-/IYdHffEB1LUJ<https://groups.google.com/d/msg/google-content-api-for-shopping/-/IYd...>
>>>>>>>>> .
>>>>>>>>> To post to this group, send email to google-content-api-for-**
>>>>>>>>> shoppin****g@googlegroups.com<google-content-api-for-shopping@googlegroups. com>
>>>>>>>>> .
>>>>>>>>> To unsubscribe from this group, send email to
>>>>>>>>> google-content-api-for-**shoppin****g+unsubscribe@**
>>>>>>>>> googlegroups.com<google-content-api-for-shopping%2Bunsubscribe@googlegroups .com>
>>>>>>>>> ****.
>>>>>>>>> For more options, visit this group at http://groups.google.com/** >>>>>>>>> group****/google-content-api-for-**shoppi****ng?hl=en<http://groups.google.com/group/google-content-api-for-shopping?hl=en>
>>>>>>>>> .
>>>>>> To post to this group, send email to google-content-api-for-**shoppin
>>>>>> **g@googlegroups.com<google-content-api-for-shopping@googlegroups.com>
>>>>>> .
>>>>>> To unsubscribe from this group, send email to google-content-api-for-
>>>>>> **shoppin**g+unsubscribe@**googlegroups.com<google-content-api-for-shopping %2Bunsubscribe@googlegroups.com>
>>>>>> **.
>>>>>> For more options, visit this group at http://groups.google.com/** >>>>>> group**/google-content-api-for-**shoppi**ng?hl=en<http://groups.google.com/group/google-content-api-for-shopping?hl=en>
>>>>>> .
>>> To post to this group, send email to google-content-api-for-**
>>> shopping@googlegroups.com<google-content-api-for-shopping@googlegroups.com>
>>> .
>>> To unsubscribe from this group, send email to google-content-api-for-**
>>> shopping+unsubscribe@**googlegroups.com<google-content-api-for-shopping%2Bu nsubscribe@googlegroups.com>
>>> .
>>> For more options, visit this group at http://groups.google.com/** >>> group/google-content-api-for-**shopping?hl=en<http://groups.google.com/group/google-content-api-for-shopping?hl=en>
>>> .
Danny, I switched over to use the Oauth2 for web server applications. Using the sample app, I was able to receive a token and it works great to query the shopping api (after adding https://www.googleapis.com/auth/structuredcontent to the scope). However the refresh token comes back null, so when my hour is up, I have nothing. Here is the code from the sample app:
Looking at the parameters object in the debugger, the RefreshToken in null (AccessType is "offline") Is there a bug in the .net client or am I doing something wrong?
On Wednesday, May 16, 2012 10:38:23 AM UTC-4, Daniel Hermes wrote:
> In response to "The less we need our merchants to do the better.":
> As I said, the OAuth2 flow will only need user intervention for the very > first step. No matter how you slice it, you'll need their consent one way > another. Using a page on your site as your redirect uri, you will be able > to set up the OAuth2 flow completely on your site without having to write > any extra hacks.
> On Wed, May 16, 2012 at 2:24 PM, Caroline McLean <bbmcarol...@gmail.com>wrote:
>> The service to service approach for us is probably most appropriate. The >> less we need our merchants to do the better. I think I am almost there. I >> set up the google service account and think I have the JWT generated and >> signed appropriately, but I am receiving "invalid_grant" back. I have >> verified I am using the correct email account in the payload (xxx @ >> developer.gserviceaccount.com), is there someone that can look at the >> logs and give me more detail as to what exactly is failing. I know its by >> design that little info is returned.
>> Thanks, >> Caroline
>> On Tuesday, May 15, 2012 7:07:32 PM UTC-4, Daniel Hermes wrote:
>>> Once you obtain an access token and refresh token, you can use the >>> access token to sign requests until it expires (3600 second expiry >>> usually). After it expires, you can use the refresh token to get a new >>> access token without user intervention.
>>> You don't have to worry about any of the refresh logic because the >>> library handles all of it.
>>> On Tue, May 15, 2012 at 3:54 PM, Caroline McLean <bbmcarol...@gmail.com>wrote:
>>>> Hmm, maybe I am confused, it looked like the other Oauth2 flows >>>> required manual intervention to obtain the token, IE a physical user to hit >>>> the approve button, we are doing automated product feeds, through our web >>>> applications, that are not run with a user in the flow. Did I confuse >>>> something? The web server (vs the server to server Oauth) states the >>>> following: " The response will be sent to the redirect_uri as >>>> specified in an access token request. If the user approves the access >>>> request, then the response contains an authorization code and the state >>>> parameter (if included in the request). If the user does not approve the >>>> request the response contains an error message. All responses are returned >>>> to the web server on the query string, as shown below:"
>>>> Thanks again for your help. >>>> Caroline
>>>> On Tuesday, May 15, 2012 6:41:27 PM UTC-4, Daniel Hermes wrote:
>>>>> Caroline,
>>>>> I just spoke with the maintainers and there are no plans to support >>>>> this in the library due to constraints of time.
>>>>> Is there a particular reason you needed this with service accounts? >>>>> You should be able to accomplish just about anything you need with the >>>>> standard OAuth2 flow.
>>>>> Regards,
>>>>> On Tue, May 15, 2012 at 1:02 PM, Daniel Hermes <dher...@google.com>wrote:
>>>>>> Caroline,
>>>>>> Sorry I missed that. I'll check with the developers of the library to >>>>>> see if there is a timeline.
>>>>>> Regards,
>>>>>> On Tue, May 15, 2012 at 10:24 AM, Caroline McLean < >>>>>> bbmcarol...@gmail.com> wrote:
>>>>>>> Looks like the sample you referenced, addresses the installed >>>>>>> Applications OAuth requirements. I need support for the server to server >>>>>>> Oauth as described in my first message. The challenge being generating a >>>>>>> JSON Web Token and appropriately signing it with the private key generated >>>>>>> by Google. "When at all possible, a developer should not write the logic >>>>>>> for creating and signing JWTs." However it does not list a .net library on >>>>>>> that page. Is JWT support included in the current .net library?
>>>>>>> Thanks, >>>>>>> Caroline
>>>>>>> On Monday, May 14, 2012 5:00:17 PM UTC-4, Caroline McLean wrote:
>>>>>>>> Thanks Danny!
>>>>>>>> On Monday, May 14, 2012 11:28:48 AM UTC-4, Daniel Hermes wrote:
>>>>>>>>> Caroline,
>>>>>>>>> There is support for it and I'll be posting in depth instructions >>>>>>>>> hopefully sometime this week.
>>>>>>>>> On Mon, May 14, 2012 at 7:52 AM, Caroline McLean < >>>>>>>>> bbmcarol...@gmail.com> wrote:
>>>>>>>>>> Danny,
>>>>>>>>>> In our last biweekly meeting, you recommended everyone use OAuth >>>>>>>>>> 2.0
>>>>>>>>>> As described in "Using OAuth 2.0 for Server to Server >>>>>>>>>> Applications" ( https://developers.google.com/****** >>>>>>>>>> accounts/docs/**OAuth2ServiceAcc****ount<https://developers.google.com/accounts/docs/OAuth2ServiceAccount>) >>>>>>>>>> " The mechanics of this interaction require applications to >>>>>>>>>> create and cryptographically sign JWTs. Developers are strongly encouraged >>>>>>>>>> to use an existing library to perform these tasks."
>>>>>>>>>> However, there is currently no support for this in .NET? Is >>>>>>>>>> there an ETA on the Crypto support in the .NET library? Is there a >>>>>>>>>> recommended alternative or is it best to wait until this support is present.
>>>>>>>>>> Thanks, >>>>>>>>>> Caroline
>>>>>>>>>> -- >>>>>>>>>> You received this message because you are subscribed to the >>>>>>>>>> Google Groups "Google Content API for Shopping" group. >>>>>>>>>> To view this discussion on the web visit >>>>>>>>>> https://groups.google.com/d/**ms****g/google-content-api-for-** >>>>>>>>>> shopp****ing/-/IYdHffEB1LUJ<https://groups.google.com/d/msg/google-content-api-for-shopping/-/IYd...> >>>>>>>>>> . >>>>>>>>>> To post to this group, send email to google-content-api-for-** >>>>>>>>>> shoppin****g@googlegroups.com<google-content-api-for-shopping@googlegroups. com> >>>>>>>>>> . >>>>>>>>>> To unsubscribe from this group, send email to >>>>>>>>>> google-content-api-for-**shoppin****g+unsubscribe@** >>>>>>>>>> googlegroups.com<google-content-api-for-shopping%2Bunsubscribe@googlegroups .com> >>>>>>>>>> ****. >>>>>>>>>> For more options, visit this group at http://groups.google.com/** >>>>>>>>>> group****/google-content-api-for-**shoppi****ng?hl=en<http://groups.google.com/group/google-content-api-for-shopping?hl=en> >>>>>>>>>> .
>>>>>>> To post to this group, send email to google-content-api-for-** >>>>>>> shoppin**g@googlegroups.com<google-content-api-for-shopping@googlegroups.co m> >>>>>>> . >>>>>>> To unsubscribe from this group, send email to >>>>>>> google-content-api-for-**shoppin**g+unsubscribe@**googlegroups.com<google-c ontent-api-for-shopping%2Bunsubscribe@googlegroups.com> >>>>>>> **. >>>>>>> For more options, visit this group at http://groups.google.com/**
This part confused the heck out of me when I first started using OAuth.
I wrote a really long StackOverflow post [1] about this for the Python
side, but most of it just applies to the OAuth2 flow:
In particular, my Future Note 3 is helpful here:
"Also, if you lose your refresh token and would like to get another one
without having to go to the browser to revoke [2] the original, you can use
the approval_prompt parameter to get a new refresh token"
From another Google page [3] which I wouldn't have expected you to find:
"If your repeat this process, you will not see the consent screen. Google
remembers your consent, and simply issues a new access token to the site.
If, for some reason, you'd like to reprompt the user for consent, you can
add approval_prompt=force to the parameters in the request."
Most importantly, if you have already given consent, subsequent times
through the process you will just be issued a new access token. To get a
refresh token, you either need to revoke [2] the token or include
approval_prompt=force in the request query parameters (can be done in .NET
with ApprovalPrompt = "force"). By default approval_prompt is set to auto.
> Danny, I switched over to use the Oauth2 for web server applications.
> Using the sample app, I was able to receive a token and it works great to
> query the shopping api (after adding
> https://www.googleapis.com/auth/structuredcontent to the scope). However
> the refresh token comes back null, so when my hour is up, I have nothing.
> Here is the code from the sample app:
> Looking at the parameters object in the debugger, the RefreshToken in null
> (AccessType is "offline") Is there a bug in the .net client or am I doing
> something wrong?
> Thanks,
> Caroline
> On Wednesday, May 16, 2012 10:38:23 AM UTC-4, Daniel Hermes wrote:
>> In response to "The less we need our merchants to do the better.":
>> As I said, the OAuth2 flow will only need user intervention for the very
>> first step. No matter how you slice it, you'll need their consent one way
>> another. Using a page on your site as your redirect uri, you will be able
>> to set up the OAuth2 flow completely on your site without having to write
>> any extra hacks.
>> On Wed, May 16, 2012 at 2:24 PM, Caroline McLean <bbmcarol...@gmail.com>wrote:
>>> The service to service approach for us is probably most appropriate. The
>>> less we need our merchants to do the better. I think I am almost there. I
>>> set up the google service account and think I have the JWT generated and
>>> signed appropriately, but I am receiving "invalid_grant" back. I have
>>> verified I am using the correct email account in the payload (xxx @
>>> developer.gserviceaccount.com**), is there someone that can look at the
>>> logs and give me more detail as to what exactly is failing. I know its by
>>> design that little info is returned.
>>> Thanks,
>>> Caroline
>>> On Tuesday, May 15, 2012 7:07:32 PM UTC-4, Daniel Hermes wrote:
>>>> Once you obtain an access token and refresh token, you can use the
>>>> access token to sign requests until it expires (3600 second expiry
>>>> usually). After it expires, you can use the refresh token to get a new
>>>> access token without user intervention.
>>>> You don't have to worry about any of the refresh logic because the
>>>> library handles all of it.
>>>> On Tue, May 15, 2012 at 3:54 PM, Caroline McLean <bbmcarol...@gmail.com
>>>> > wrote:
>>>>> Hmm, maybe I am confused, it looked like the other Oauth2 flows
>>>>> required manual intervention to obtain the token, IE a physical user to hit
>>>>> the approve button, we are doing automated product feeds, through our web
>>>>> applications, that are not run with a user in the flow. Did I confuse
>>>>> something? The web server (vs the server to server Oauth) states the
>>>>> following: " The response will be sent to the redirect_uri as
>>>>> specified in an access token request. If the user approves the access
>>>>> request, then the response contains an authorization code and the state
>>>>> parameter (if included in the request). If the user does not approve the
>>>>> request the response contains an error message. All responses are returned
>>>>> to the web server on the query string, as shown below:"
>>>>> Thanks again for your help.
>>>>> Caroline
>>>>> On Tuesday, May 15, 2012 6:41:27 PM UTC-4, Daniel Hermes wrote:
>>>>>> Caroline,
>>>>>> I just spoke with the maintainers and there are no plans to support
>>>>>> this in the library due to constraints of time.
>>>>>> Is there a particular reason you needed this with service accounts?
>>>>>> You should be able to accomplish just about anything you need with the
>>>>>> standard OAuth2 flow.
>>>>>> Regards,
>>>>>> On Tue, May 15, 2012 at 1:02 PM, Daniel Hermes <dher...@google.com>wrote:
>>>>>>> Caroline,
>>>>>>> Sorry I missed that. I'll check with the developers of the library
>>>>>>> to see if there is a timeline.
>>>>>>> Regards,
>>>>>>> On Tue, May 15, 2012 at 10:24 AM, Caroline McLean <
>>>>>>> bbmcarol...@gmail.com> wrote:
>>>>>>>> Looks like the sample you referenced, addresses the installed
>>>>>>>> Applications OAuth requirements. I need support for the server to server
>>>>>>>> Oauth as described in my first message. The challenge being generating a
>>>>>>>> JSON Web Token and appropriately signing it with the private key generated
>>>>>>>> by Google. "When at all possible, a developer should not write the logic
>>>>>>>> for creating and signing JWTs." However it does not list a .net library on
>>>>>>>> that page. Is JWT support included in the current .net library?
>>>>>>>> Thanks,
>>>>>>>> Caroline
>>>>>>>> On Monday, May 14, 2012 5:00:17 PM UTC-4, Caroline McLean wrote:
>>>>>>>>> Thanks Danny!
>>>>>>>>> On Monday, May 14, 2012 11:28:48 AM UTC-4, Daniel Hermes wrote:
>>>>>>>>>> Caroline,
>>>>>>>>>> There is support for it and I'll be posting in depth instructions
>>>>>>>>>> hopefully sometime this week.
>>>>>>>>>> On Mon, May 14, 2012 at 7:52 AM, Caroline McLean <
>>>>>>>>>> bbmcarol...@gmail.com> wrote:
>>>>>>>>>>> Danny,
>>>>>>>>>>> In our last biweekly meeting, you recommended everyone use OAuth
>>>>>>>>>>> 2.0
>>>>>>>>>>> As described in "Using OAuth 2.0 for Server to Server
>>>>>>>>>>> Applications" ( https://developers.google.com/******** >>>>>>>>>>> accounts/docs/**OAuth2ServiceAcc******ount<https://developers.google.com/accounts/docs/OAuth2ServiceAccount>)
>>>>>>>>>>> " The mechanics of this interaction require applications to
>>>>>>>>>>> create and cryptographically sign JWTs. Developers are strongly encouraged
>>>>>>>>>>> to use an existing library to perform these tasks."
>>>>>>>>>>> However, there is currently no support for this in .NET? Is
>>>>>>>>>>> there an ETA on the Crypto support in the .NET library? Is there a
>>>>>>>>>>> recommended alternative or is it best to wait until this support is present.
>>>>>>>>>>> Thanks,
>>>>>>>>>>> Caroline
>>>>>>>>>>> --
>>>>>>>>>>> You received this message because you are subscribed to the
>>>>>>>>>>> Google Groups "Google Content API for Shopping" group.
>>>>>>>>>>> To view
On Thursday, May 17, 2012 10:23:05 AM UTC-4, Daniel Hermes wrote:
> Caroline,
> This part confused the heck out of me when I first started using OAuth.
> I wrote a really long StackOverflow post [1] about this for the Python > side, but most of it just applies to the OAuth2 flow:
> In particular, my Future Note 3 is helpful here: > "Also, if you lose your refresh token and would like to get another one > without having to go to the browser to revoke [2] the original, you can use > the approval_prompt parameter to get a new refresh token"
> From another Google page [3] which I wouldn't have expected you to find: > "If your repeat this process, you will not see the consent screen. Google > remembers your consent, and simply issues a new access token to the site. > If, for some reason, you'd like to reprompt the user for consent, you can > add approval_prompt=force to the parameters in the request."
> Most importantly, if you have already given consent, subsequent times > through the process you will just be issued a new access token. To get a > refresh token, you either need to revoke [2] the token or include > approval_prompt=force in the request query parameters (can be done in .NET > with ApprovalPrompt = "force"). By default approval_prompt is set to auto.
> On Thu, May 17, 2012 at 6:23 AM, Caroline McLean <bbmcarol...@gmail.com>wrote:
>> Danny, I switched over to use the Oauth2 for web server applications. >> Using the sample app, I was able to receive a token and it works great to >> query the shopping api (after adding >> https://www.googleapis.com/auth/structuredcontent to the scope). >> However the refresh token comes back null, so when my hour is up, I have >> nothing. Here is the code from the sample app:
>> Looking at the parameters object in the debugger, the RefreshToken in >> null (AccessType is "offline") Is there a bug in the .net client or am I >> doing something wrong?
>> Thanks, >> Caroline
>> On Wednesday, May 16, 2012 10:38:23 AM UTC-4, Daniel Hermes wrote:
>>> In response to "The less we need our merchants to do the better.":
>>> As I said, the OAuth2 flow will only need user intervention for the very >>> first step. No matter how you slice it, you'll need their consent one way >>> another. Using a page on your site as your redirect uri, you will be able >>> to set up the OAuth2 flow completely on your site without having to write >>> any extra hacks.
>>> On Wed, May 16, 2012 at 2:24 PM, Caroline McLean <bbmcarol...@gmail.com>wrote:
>>>> The service to service approach for us is probably most appropriate. >>>> The less we need our merchants to do the better. I think I am almost >>>> there. I set up the google service account and think I have the JWT >>>> generated and signed appropriately, but I am receiving "invalid_grant" >>>> back. I have verified I am using the correct email account in the payload >>>> (xxx @developer.gserviceaccount.com**), is there someone that can look >>>> at the logs and give me more detail as to what exactly is failing. I know >>>> its by design that little info is returned.
>>>> Thanks, >>>> Caroline
>>>> On Tuesday, May 15, 2012 7:07:32 PM UTC-4, Daniel Hermes wrote:
>>>>> Once you obtain an access token and refresh token, you can use the >>>>> access token to sign requests until it expires (3600 second expiry >>>>> usually). After it expires, you can use the refresh token to get a new >>>>> access token without user intervention.
>>>>> You don't have to worry about any of the refresh logic because the >>>>> library handles all of it.
>>>>> On Tue, May 15, 2012 at 3:54 PM, Caroline McLean < >>>>> bbmcarol...@gmail.com> wrote:
>>>>>> Hmm, maybe I am confused, it looked like the other Oauth2 flows >>>>>> required manual intervention to obtain the token, IE a physical user to hit >>>>>> the approve button, we are doing automated product feeds, through our web >>>>>> applications, that are not run with a user in the flow. Did I confuse >>>>>> something? The web server (vs the server to server Oauth) states the >>>>>> following: " The response will be sent to the redirect_uri as >>>>>> specified in an access token request. If the user approves the access >>>>>> request, then the response contains an authorization code and the state >>>>>> parameter (if included in the request). If the user does not approve the >>>>>> request the response contains an error message. All responses are returned >>>>>> to the web server on the query string, as shown below:"
>>>>>> Thanks again for your help. >>>>>> Caroline
>>>>>> On Tuesday, May 15, 2012 6:41:27 PM UTC-4, Daniel Hermes wrote:
>>>>>>> Caroline,
>>>>>>> I just spoke with the maintainers and there are no plans to support >>>>>>> this in the library due to constraints of time.
>>>>>>> Is there a particular reason you needed this with service accounts? >>>>>>> You should be able to accomplish just about anything you need with the >>>>>>> standard OAuth2 flow.
>>>>>>> Regards,
>>>>>>> On Tue, May 15, 2012 at 1:02 PM, Daniel Hermes <dher...@google.com>wrote:
>>>>>>>> Caroline,
>>>>>>>> Sorry I missed that. I'll check with the developers of the library >>>>>>>> to see if there is a timeline.
>>>>>>>> Regards,
>>>>>>>> On Tue, May 15, 2012 at 10:24 AM, Caroline McLean < >>>>>>>> bbmcarol...@gmail.com> wrote:
>>>>>>>>> Looks like the sample you referenced, addresses the installed >>>>>>>>> Applications OAuth requirements. I need support for the server to server >>>>>>>>> Oauth as described in my first message. The challenge being generating a >>>>>>>>> JSON Web Token and appropriately signing it with the private key generated >>>>>>>>> by Google. "When at all possible, a developer should not write the logic >>>>>>>>> for creating and signing JWTs." However it does not list a .net library on >>>>>>>>> that page. Is JWT support included in the current .net library?
>>>>>>>>> Thanks, >>>>>>>>> Caroline
>>>>>>>>> On Monday, May 14, 2012 5:00:17 PM UTC-4, Caroline McLean wrote:
>>>>>>>>>> Thanks Danny!
>>>>>>>>>> On Monday, May 14, 2012 11:28:48 AM UTC-4, Daniel Hermes wrote:
>>>>>>>>>>> Caroline,
>>>>>>>>>>> There is support for it and I'll be posting in depth >>>>>>>>>>> instructions hopefully sometime this week.
>>>>>>>>>>> On Mon, May 14, 2012 at 7:52 AM, Caroline McLean < >>>>>>>>>>> bbmcarol...@gmail.com> wrote:
>>>>>>>>>>>> Danny,
>>>>>>>>>>>> In our last biweekly meeting, you recommended everyone use >>>>>>>>>>>> OAuth 2.0
>>>>>>>>>>>> As described in "Using OAuth 2.0 for Server to Server >>>>>>>>>>>> Applications" ( https://developers.google.com/******** >>>>>>>>>>>> accounts/docs/**OAuth2ServiceAcc******ount<https://developers.google.com/accounts/docs/OAuth2ServiceAccount>) >>>>>>>>>>>> " The mechanics of this interaction require applications to >>>>>>>>>>>> create and cryptographically sign JWTs. Developers are strongly encouraged >>>>>>>>>>>> to use an existing library to perform these tasks."
>>>>>>>>>>>> However, there is currently no support for this in .NET? Is >>>>>>>>>>>> there an ETA on the Crypto support in the .NET library? Is there a >>>>>>>>>>>> recommended alternative or is it best to wait
> Awesome thanks, that did the trick!...Of course I need to wait an hour to
> make sure the refresh token works ;)
> On Thursday, May 17, 2012 10:23:05 AM UTC-4, Daniel Hermes wrote:
>> Caroline,
>> This part confused the heck out of me when I first started using OAuth.
>> I wrote a really long StackOverflow post [1] about this for the Python
>> side, but most of it just applies to the OAuth2 flow:
>> In particular, my Future Note 3 is helpful here:
>> "Also, if you lose your refresh token and would like to get another one
>> without having to go to the browser to revoke [2] the original, you can use
>> the approval_prompt parameter to get a new refresh token"
>> From another Google page [3] which I wouldn't have expected you to find:
>> "If your repeat this process, you will not see the consent screen. Google
>> remembers your consent, and simply issues a new access token to the site.
>> If, for some reason, you'd like to reprompt the user for consent, you can
>> add approval_prompt=force to the parameters in the request."
>> Most importantly, if you have already given consent, subsequent times
>> through the process you will just be issued a new access token. To get a
>> refresh token, you either need to revoke [2] the token or include
>> approval_prompt=force in the request query parameters (can be done in .NET
>> with ApprovalPrompt = "force"). By default approval_prompt is set to auto.
>> On Thu, May 17, 2012 at 6:23 AM, Caroline McLean <bbmcarol...@gmail.com>wrote:
>>> Danny, I switched over to use the Oauth2 for web server applications.
>>> Using the sample app, I was able to receive a token and it works great to
>>> query the shopping api (after adding https://www.googleapis.com/** >>> auth/structuredcontent<https://www.googleapis.com/auth/structuredcontent>to the scope). However the refresh token comes back null, so when my hour
>>> is up, I have nothing. Here is the code from the sample app:
>>> Looking at the parameters object in the debugger, the RefreshToken in
>>> null (AccessType is "offline") Is there a bug in the .net client or am I
>>> doing something wrong?
>>> Thanks,
>>> Caroline
>>> On Wednesday, May 16, 2012 10:38:23 AM UTC-4, Daniel Hermes wrote:
>>>> In response to "The less we need our merchants to do the better.":
>>>> As I said, the OAuth2 flow will only need user intervention for the
>>>> very first step. No matter how you slice it, you'll need their consent one
>>>> way another. Using a page on your site as your redirect uri, you will be
>>>> able to set up the OAuth2 flow completely on your site without having to
>>>> write any extra hacks.
>>>> On Wed, May 16, 2012 at 2:24 PM, Caroline McLean <bbmcarol...@gmail.com
>>>> > wrote:
>>>>> The service to service approach for us is probably most appropriate.
>>>>> The less we need our merchants to do the better. I think I am almost
>>>>> there. I set up the google service account and think I have the JWT
>>>>> generated and signed appropriately, but I am receiving "invalid_grant"
>>>>> back. I have verified I am using the correct email account in the payload
>>>>> (xxx @developer.gserviceaccount.com****), is there someone that can
>>>>> look at the logs and give me more detail as to what exactly is failing. I
>>>>> know its by design that little info is returned.
>>>>> Thanks,
>>>>> Caroline
>>>>> On Tuesday, May 15, 2012 7:07:32 PM UTC-4, Daniel Hermes wrote:
>>>>>> Once you obtain an access token and refresh token, you can use the
>>>>>> access token to sign requests until it expires (3600 second expiry
>>>>>> usually). After it expires, you can use the refresh token to get a new
>>>>>> access token without user intervention.
>>>>>> You don't have to worry about any of the refresh logic because the
>>>>>> library handles all of it.
>>>>>> On Tue, May 15, 2012 at 3:54 PM, Caroline McLean <
>>>>>> bbmcarol...@gmail.com> wrote:
>>>>>>> Hmm, maybe I am confused, it looked like the other Oauth2 flows
>>>>>>> required manual intervention to obtain the token, IE a physical user to hit
>>>>>>> the approve button, we are doing automated product feeds, through our web
>>>>>>> applications, that are not run with a user in the flow. Did I confuse
>>>>>>> something? The web server (vs the server to server Oauth) states the
>>>>>>> following: " The response will be sent to the redirect_uri as
>>>>>>> specified in an access token request. If the user approves the access
>>>>>>> request, then the response contains an authorization code and the state
>>>>>>> parameter (if included in the request). If the user does not approve the
>>>>>>> request the response contains an error message. All responses are returned
>>>>>>> to the web server on the query string, as shown below:"
>>>>>>> Thanks again for your help.
>>>>>>> Caroline
>>>>>>> On Tuesday, May 15, 2012 6:41:27 PM UTC-4, Daniel Hermes wrote:
>>>>>>>> Caroline,
>>>>>>>> I just spoke with the maintainers and there are no plans to support
>>>>>>>> this in the library due to constraints of time.
>>>>>>>> Is there a particular reason you needed this with service accounts?
>>>>>>>> You should be able to accomplish just about anything you need with the
>>>>>>>> standard OAuth2 flow.
>>>>>>>> Regards,
>>>>>>>> On Tue, May 15, 2012 at 1:02 PM, Daniel Hermes <dher...@google.com>wrote:
>>>>>>>>> Caroline,
>>>>>>>>> Sorry I missed that. I'll check with the developers of the library
>>>>>>>>> to see if there is a timeline.
>>>>>>>>> Regards,
>>>>>>>>> On Tue, May 15, 2012 at 10:24 AM, Caroline McLean <
>>>>>>>>> bbmcarol...@gmail.com> wrote:
>>>>>>>>>> Looks like the sample you referenced, addresses the installed
>>>>>>>>>> Applications OAuth requirements. I need support for the server to server
>>>>>>>>>> Oauth as described in my first message. The challenge being generating a
>>>>>>>>>> JSON Web Token and appropriately signing it with the private key generated
>>>>>>>>>> by Google. "When at all possible, a developer should not write the logic
>>>>>>>>>> for creating and signing JWTs." However it does not list a .net library on
>>>>>>>>>> that page. Is JWT support included in the current .net library?
>>>>>>>>>> Thanks,
>>>>>>>>>> Caroline
>>>>>>>>>> On Monday, May 14, 2012 5:00:17 PM UTC-4, Caroline McLean wrote:
>>>>>>>>>>> Thanks Danny!
>>>>>>>>>>> On Monday, May 14, 2012 11:28:48 AM UTC-4, Daniel Hermes wrote:
>>>>>>>>>>>> Caroline,
>>>>>>>>>>>> There is support for it and I'll be posting in depth
>>>>>>>>>>>> instructions hopefully sometime this week.
hmm, I literally appended silly to my auth token and received an exception on the service.query call Token invalid - Invalid token: Invalid stateless token: ya29.AHES6ZQYtvTknx1HxOhBLe2dDKXypKXXXXXXXXXXXXXXXXXXsilly 3 - Error 401
My code is as follows (do I have to catch the exception and manually call a refresh token?):
GOAuth2RequestFactory requestFactory = new GOAuth2RequestFactory("apps", "UniteU", parameters); service.RequestFactory = requestFactory;
// Retrieve the list of all existing products string projection = "schema"; ProductQuery query = new ProductQuery(projection, accountId); ProductFeed feed = service.Query(query);
On Thursday, May 17, 2012 10:36:35 AM UTC-4, Daniel Hermes wrote:
> No. You can set the access_token to something silly and use the refresh > token right away.
> On Thu, May 17, 2012 at 7:34 AM, Caroline McLean <bbmcarol...@gmail.com>wrote:
>> Awesome thanks, that did the trick!...Of course I need to wait an hour to >> make sure the refresh token works ;)
>> On Thursday, May 17, 2012 10:23:05 AM UTC-4, Daniel Hermes wrote:
>>> Caroline,
>>> This part confused the heck out of me when I first started using OAuth.
>>> I wrote a really long StackOverflow post [1] about this for the Python >>> side, but most of it just applies to the OAuth2 flow:
>>> In particular, my Future Note 3 is helpful here: >>> "Also, if you lose your refresh token and would like to get another one >>> without having to go to the browser to revoke [2] the original, you can use >>> the approval_prompt parameter to get a new refresh token"
>>> From another Google page [3] which I wouldn't have expected you to find: >>> "If your repeat this process, you will not see the consent screen. >>> Google remembers your consent, and simply issues a new access token to the >>> site. If, for some reason, you'd like to reprompt the user for consent, you >>> can add approval_prompt=force to the parameters in the request."
>>> Most importantly, if you have already given consent, subsequent times >>> through the process you will just be issued a new access token. To get a >>> refresh token, you either need to revoke [2] the token or include >>> approval_prompt=force in the request query parameters (can be done in .NET >>> with ApprovalPrompt = "force"). By default approval_prompt is set to auto.
>>> On Thu, May 17, 2012 at 6:23 AM, Caroline McLean <bbmcarol...@gmail.com>wrote:
>>>> Danny, I switched over to use the Oauth2 for web server applications. >>>> Using the sample app, I was able to receive a token and it works great to >>>> query the shopping api (after adding https://www.googleapis.com/** >>>> auth/structuredcontent<https://www.googleapis.com/auth/structuredcontent>to the scope). However the refresh token comes back null, so when my hour >>>> is up, I have nothing. Here is the code from the sample app:
>>>> Looking at the parameters object in the debugger, the RefreshToken in >>>> null (AccessType is "offline") Is there a bug in the .net client or am I >>>> doing something wrong?
>>>> Thanks, >>>> Caroline
>>>> On Wednesday, May 16, 2012 10:38:23 AM UTC-4, Daniel Hermes wrote:
>>>>> In response to "The less we need our merchants to do the better.":
>>>>> As I said, the OAuth2 flow will only need user intervention for the >>>>> very first step. No matter how you slice it, you'll need their consent one >>>>> way another. Using a page on your site as your redirect uri, you will be >>>>> able to set up the OAuth2 flow completely on your site without having to >>>>> write any extra hacks.
>>>>> On Wed, May 16, 2012 at 2:24 PM, Caroline McLean < >>>>> bbmcarol...@gmail.com> wrote:
>>>>>> The service to service approach for us is probably most appropriate. >>>>>> The less we need our merchants to do the better. I think I am almost >>>>>> there. I set up the google service account and think I have the JWT >>>>>> generated and signed appropriately, but I am receiving "invalid_grant" >>>>>> back. I have verified I am using the correct email account in the payload >>>>>> (xxx @developer.gserviceaccount.com****), is there someone that can >>>>>> look at the logs and give me more detail as to what exactly is failing. I >>>>>> know its by design that little info is returned.
>>>>>> Thanks, >>>>>> Caroline
>>>>>> On Tuesday, May 15, 2012 7:07:32 PM UTC-4, Daniel Hermes wrote:
>>>>>>> Once you obtain an access token and refresh token, you can use the >>>>>>> access token to sign requests until it expires (3600 second expiry >>>>>>> usually). After it expires, you can use the refresh token to get a new >>>>>>> access token without user intervention.
>>>>>>> You don't have to worry about any of the refresh logic because the >>>>>>> library handles all of it.
>>>>>>> On Tue, May 15, 2012 at 3:54 PM, Caroline McLean < >>>>>>> bbmcarol...@gmail.com> wrote:
>>>>>>>> Hmm, maybe I am confused, it looked like the other Oauth2 flows >>>>>>>> required manual intervention to obtain the token, IE a physical user to hit >>>>>>>> the approve button, we are doing automated product feeds, through our web >>>>>>>> applications, that are not run with a user in the flow. Did I confuse >>>>>>>> something? The web server (vs the server to server Oauth) states the >>>>>>>> following: " The response will be sent to the redirect_uri as >>>>>>>> specified in an access token request. If the user approves the access >>>>>>>> request, then the response contains an authorization code and the state >>>>>>>> parameter (if included in the request). If the user does not approve the >>>>>>>> request the response contains an error message. All responses are returned >>>>>>>> to the web server on the query string, as shown below:"
>>>>>>>> Thanks again for your help. >>>>>>>> Caroline
>>>>>>>> On Tuesday, May 15, 2012 6:41:27 PM UTC-4, Daniel Hermes wrote:
>>>>>>>>> Caroline,
>>>>>>>>> I just spoke with the maintainers and there are no plans to >>>>>>>>> support this in the library due to constraints of time.
>>>>>>>>> Is there a particular reason you needed this with service >>>>>>>>> accounts? You should be able to accomplish just about anything you need >>>>>>>>> with the standard OAuth2 flow.
>>>>>>>>> Regards,
>>>>>>>>> On Tue, May 15, 2012 at 1:02 PM, Daniel Hermes <dher...@google.com >>>>>>>>> > wrote:
>>>>>>>>>> Caroline,
>>>>>>>>>> Sorry I missed that. I'll check with the developers of the >>>>>>>>>> library to see if there is a timeline.
>>>>>>>>>> Regards,
>>>>>>>>>> On Tue, May 15, 2012 at 10:24 AM, Caroline McLean < >>>>>>>>>> bbmcarol...@gmail.com> wrote:
>>>>>>>>>>> Looks like the sample you referenced, addresses the installed >>>>>>>>>>> Applications OAuth requirements. I need support for the server to server >>>>>>>>>>> Oauth as described in my first message. The challenge being generating a >>>>>>>>>>> JSON Web Token and appropriately signing it with the private key generated >>>>>>>>>>> by Google. "When at all possible, a developer should not write the logic >>>>>>>>>>> for creating and
On Thursday, May 17, 2012 11:31:27 AM UTC-4, Caroline McLean wrote:
> hmm, I literally appended silly to my auth token and received an exception > on the service.query call > Token invalid - Invalid token: Invalid stateless token: > ya29.AHES6ZQYtvTknx1HxOhBLe2dDKXypKXXXXXXXXXXXXXXXXXXsilly 3 - Error 401
> My code is as follows (do I have to catch the exception and manually call > a refresh token?):
> // Retrieve the list of all existing products > string projection = "schema"; > ProductQuery query = new ProductQuery(projection, accountId); > ProductFeed feed = service.Query(query);
> On Thursday, May 17, 2012 10:36:35 AM UTC-4, Daniel Hermes wrote:
>> No. You can set the access_token to something silly and use the refresh >> token right away.
>> On Thu, May 17, 2012 at 7:34 AM, Caroline McLean <bbmcarol...@gmail.com>wrote:
>>> Awesome thanks, that did the trick!...Of course I need to wait an hour >>> to make sure the refresh token works ;)
>>> On Thursday, May 17, 2012 10:23:05 AM UTC-4, Daniel Hermes wrote:
>>>> Caroline,
>>>> This part confused the heck out of me when I first started using OAuth.
>>>> I wrote a really long StackOverflow post [1] about this for the Python >>>> side, but most of it just applies to the OAuth2 flow:
>>>> In particular, my Future Note 3 is helpful here: >>>> "Also, if you lose your refresh token and would like to get another one >>>> without having to go to the browser to revoke [2] the original, you can use >>>> the approval_prompt parameter to get a new refresh token"
>>>> From another Google page [3] which I wouldn't have expected you to find: >>>> "If your repeat this process, you will not see the consent screen. >>>> Google remembers your consent, and simply issues a new access token to the >>>> site. If, for some reason, you'd like to reprompt the user for consent, you >>>> can add approval_prompt=force to the parameters in the request."
>>>> Most importantly, if you have already given consent, subsequent times >>>> through the process you will just be issued a new access token. To get a >>>> refresh token, you either need to revoke [2] the token or include >>>> approval_prompt=force in the request query parameters (can be done in .NET >>>> with ApprovalPrompt = "force"). By default approval_prompt is set to auto.
>>>> On Thu, May 17, 2012 at 6:23 AM, Caroline McLean <bbmcarol...@gmail.com >>>> > wrote:
>>>>> Danny, I switched over to use the Oauth2 for web server applications. >>>>> Using the sample app, I was able to receive a token and it works great to >>>>> query the shopping api (after adding https://www.googleapis.com/** >>>>> auth/structuredcontent<https://www.googleapis.com/auth/structuredcontent>to the scope). However the refresh token comes back null, so when my hour >>>>> is up, I have nothing. Here is the code from the sample app:
>>>>> Looking at the parameters object in the debugger, the RefreshToken in >>>>> null (AccessType is "offline") Is there a bug in the .net client or am I >>>>> doing something wrong?
>>>>> Thanks, >>>>> Caroline
>>>>> On Wednesday, May 16, 2012 10:38:23 AM UTC-4, Daniel Hermes wrote:
>>>>>> In response to "The less we need our merchants to do the better.":
>>>>>> As I said, the OAuth2 flow will only need user intervention for the >>>>>> very first step. No matter how you slice it, you'll need their consent one >>>>>> way another. Using a page on your site as your redirect uri, you will be >>>>>> able to set up the OAuth2 flow completely on your site without having to >>>>>> write any extra hacks.
>>>>>> On Wed, May 16, 2012 at 2:24 PM, Caroline McLean < >>>>>> bbmcarol...@gmail.com> wrote:
>>>>>>> The service to service approach for us is probably most appropriate. >>>>>>> The less we need our merchants to do the better. I think I am almost >>>>>>> there. I set up the google service account and think I have the JWT >>>>>>> generated and signed appropriately, but I am receiving "invalid_grant" >>>>>>> back. I have verified I am using the correct email account in the payload >>>>>>> (xxx @developer.gserviceaccount.com****), is there someone that can >>>>>>> look at the logs and give me more detail as to what exactly is failing. I >>>>>>> know its by design that little info is returned.
>>>>>>> Thanks, >>>>>>> Caroline
>>>>>>> On Tuesday, May 15, 2012 7:07:32 PM UTC-4, Daniel Hermes wrote:
>>>>>>>> Caroline,
>>>>>>>> You will only need your users to "manually intervene" to accept the >>>>>>>> token once. You can set the redirect uri to a page in your "web >>>>>>>> application" and parse the returned code from there. (This is >>>>>>>> the parameters.AccessCode = line in the sample). >>>>>>>> [Sample: http://code.google.**co****m/p/google-gdata/source/** >>>>>>>> browse****/trunk/clients/cs/**samples/**oaut**h2_sample/** >>>>>>>> oauth2demo.cs<http://code.google.com/p/google-gdata/source/browse/trunk/clients/cs/...> >>>>>>>> ]
>>>>>>>> Once you obtain an access token and refresh token, you can use the >>>>>>>> access token to sign requests until it expires (3600 second expiry >>>>>>>> usually). After it expires, you can use the refresh token to get a new >>>>>>>> access token without user intervention.
>>>>>>>> You don't have to worry about any of the refresh logic because the >>>>>>>> library handles all of it.
>>>>>>>> On Tue, May 15, 2012 at 3:54 PM, Caroline McLean < >>>>>>>> bbmcarol...@gmail.com> wrote:
>>>>>>>>> Hmm, maybe I am confused, it looked like the other Oauth2 flows >>>>>>>>> required manual intervention to obtain the token, IE a physical user to hit >>>>>>>>> the approve button, we are doing automated product feeds, through our web >>>>>>>>> applications, that are not run with a user in the flow. Did I confuse >>>>>>>>> something? The web server (vs the server to server Oauth) states the >>>>>>>>> following: " The response will be sent to the redirect_uri as >>>>>>>>> specified in an access token request. If the user approves the access >>>>>>>>> request, then the response contains an authorization code and the state >>>>>>>>> parameter (if included in the request). If the user does not approve the >>>>>>>>> request the response contains an error message. All responses are returned >>>>>>>>> to the web server on the query string, as shown below:"
>>>>>>>>> Thanks again for your help. >>>>>>>>> Caroline
>>>>>>>>> On Tuesday, May 15, 2012 6:41:27 PM UTC-4, Daniel Hermes wrote:
>>>>>>>>>> Caroline,
>>>>>>>>>> I just spoke with the maintainers and there are no plans to >>>>>>>>>> support this in the library due to constraints of time.
>>>>>>>>>> Is there a particular reason you needed this with service >>>>>>>>>> accounts? You should be able to accomplish just about anything you need >>>>>>>>>> with the standard OAuth2 flow.
>>>>>>>>>> Regards,
>>>>>>>>>> On Tue, May 15, 2012 at 1:02 PM, Daniel Hermes < >>>>>>>>>> dher...@google.com> wrote:
>>>>>>>>>>> Caroline,
>>>>>>>>>>> Sorry I missed that. I'll check with the developers of the >>>>>>>>>>> library to see if there is a timeline.
>>>>>>>>>>> Regards,
>>>>>>>>>>> On Tue, May 15, 2012 at 10:24 AM, Caroline McLean < >>>>>>>>>>> bbmcarol...@gmail.com> wrote:
> I got the same response, restoring the token to its original value once
> the hour had passed, I must be missing one more thing :)
> On Thursday, May 17, 2012 11:31:27 AM UTC-4, Caroline McLean wrote:
>> hmm, I literally appended silly to my auth token and received an
>> exception on the service.query call
>> Token invalid - Invalid token: Invalid stateless token: ya29.**
>> AHES6ZQYtvTknx1HxOhBLe2dDKXypK**XXXXXXXXXXXXXXXXXXsilly 3 - Error 401
>> My code is as follows (do I have to catch the exception and manually call
>> a refresh token?):
>> // Retrieve the list of all existing products
>> string projection = "schema";
>> ProductQuery query = new ProductQuery(projection, accountId);
>> ProductFeed feed = service.Query(query);
>> On Thursday, May 17, 2012 10:36:35 AM UTC-4, Daniel Hermes wrote:
>>> No. You can set the access_token to something silly and use the refresh
>>> token right away.
>>> On Thu, May 17, 2012 at 7:34 AM, Caroline McLean <bbmcarol...@gmail.com>wrote:
>>>> Awesome thanks, that did the trick!...Of course I need to wait an hour
>>>> to make sure the refresh token works ;)
>>>> On Thursday, May 17, 2012 10:23:05 AM UTC-4, Daniel Hermes wrote:
>>>>> Caroline,
>>>>> This part confused the heck out of me when I first started using OAuth.
>>>>> I wrote a really long StackOverflow post [1] about this for the Python
>>>>> side, but most of it just applies to the OAuth2 flow:
>>>>> In particular, my Future Note 3 is helpful here:
>>>>> "Also, if you lose your refresh token and would like to get another
>>>>> one without having to go to the browser to revoke [2] the original, you can
>>>>> use the approval_prompt parameter to get a new refresh token"
>>>>> From another Google page [3] which I wouldn't have expected you to
>>>>> find:
>>>>> "If your repeat this process, you will not see the consent screen.
>>>>> Google remembers your consent, and simply issues a new access token to the
>>>>> site. If, for some reason, you'd like to reprompt the user for consent, you
>>>>> can add approval_prompt=force to the parameters in the request."
>>>>> Most importantly, if you have already given consent, subsequent times
>>>>> through the process you will just be issued a new access token. To get a
>>>>> refresh token, you either need to revoke [2] the token or include
>>>>> approval_prompt=force in the request query parameters (can be done in .NET
>>>>> with ApprovalPrompt = "force"). By default approval_prompt is set to auto.
>>>>> On Thu, May 17, 2012 at 6:23 AM, Caroline McLean <
>>>>> bbmcarol...@gmail.com> wrote:
>>>>>> Danny, I switched over to use the Oauth2 for web server applications.
>>>>>> Using the sample app, I was able to receive a token and it works great to
>>>>>> query the shopping api (after adding https://www.googleapis.com/**aut >>>>>> **h/structuredcontent<https://www.googleapis.com/auth/structuredcontent>to the scope). However the refresh token comes back null, so when my hour
>>>>>> is up, I have nothing. Here is the code from the sample app:
>>>>>> Looking at the parameters object in the debugger, the RefreshToken in
>>>>>> null (AccessType is "offline") Is there a bug in the .net client or am I
>>>>>> doing something wrong?
>>>>>> Thanks,
>>>>>> Caroline
>>>>>> On Wednesday, May 16, 2012 10:38:23 AM UTC-4, Daniel Hermes wrote:
>>>>>>> In response to "The less we need our merchants to do the better.":
>>>>>>> As I said, the OAuth2 flow will only need user intervention for the
>>>>>>> very first step. No matter how you slice it, you'll need their consent one
>>>>>>> way another. Using a page on your site as your redirect uri, you will be
>>>>>>> able to set up the OAuth2 flow completely on your site without having to
>>>>>>> write any extra hacks.
>>>>>>> On Wed, May 16, 2012 at 2:24 PM, Caroline McLean <
>>>>>>> bbmcarol...@gmail.com> wrote:
>>>>>>>> The service to service approach for us is probably most
>>>>>>>> appropriate. The less we need our merchants to do the better. I think I am
>>>>>>>> almost there. I set up the google service account and think I have the JWT
>>>>>>>> generated and signed appropriately, but I am receiving "invalid_grant"
>>>>>>>> back. I have verified I am using the correct email account in the payload
>>>>>>>> (xxx @developer.gserviceaccount.com******), is there someone that
>>>>>>>> can look at the logs and give me more detail as to what exactly is failing.
>>>>>>>> I know its by design that little info is returned.
>>>>>>>> Thanks,
>>>>>>>> Caroline
>>>>>>>> On Tuesday, May 15, 2012 7:07:32 PM UTC-4, Daniel Hermes wrote:
>>>>>>>>> Caroline,
>>>>>>>>> You will only need your users to "manually intervene" to accept
>>>>>>>>> the token once. You can set the redirect uri to a page in your "web
>>>>>>>>> application" and parse the returned code from there. (This is
>>>>>>>>> the parameters.AccessCode = line in the sample).
>>>>>>>>> [Sample: http://code.google.**co******m/p/google-gdata/source/** >>>>>>>>> browse******/trunk/clients/cs/**samples/**oaut****h2_sample/**
>>>>>>>>> oauth2demo.cs<http://code.google.com/p/google-gdata/source/browse/trunk/clients/cs/...>
>>>>>>>>> ]
>>>>>>>>> Once you obtain an access token and refresh token, you can use the
>>>>>>>>> access token to sign requests until it expires (3600 second expiry
>>>>>>>>> usually). After it expires, you can use the refresh token to get a new
>>>>>>>>> access token without user intervention.
>>>>>>>>> You don't have to worry about any of the refresh logic because the
Sorry I think my example was not complete enough. I am using two separate apps to request the token and then to use the token to get products. I store the auth token and the refresh token from the first app and use it in my second app. This is very close to how it will be used when implemented. BTW there is no ContentForShoppingService(userAgent); that takes two parameters in the .net wrapper, at least not in my version.
So to secure the auth token I do the following (sample code essentially) --------------------------------------------------------------------------- --------------------------------------------------------------------------- ----------------------------------------------------------- private static string redirectUri = "https://localhost/oauth2callback.ashx"; // the magic url you suggested in the meeting the other day is not
// acceptable for web applications - only installed non web apps
string url = OAuthUtil.CreateOAuth2AuthorizationUrl(parameters); // code parameter gained from pasting the above url into a browser Console.WriteLine("Authorize URI: " + url); parameters.AccessCode = Console.ReadLine(); // in the query string copy and past the code parameter value here
// this populates the parameter object - copy the values of the authentication and refresh tokens to use for your authorization later OAuthUtil.GetAccessToken(parameters);
--------------------------------------------------------------------------- --------------------------------------------------------------------------- ----------------------------------------------------- // in a separate app I run the following code ContentForShoppingService service = new ContentForShoppingService(userAgent);
OAuth2Parameters parameters = new OAuth2Parameters(); parameters.AccessToken = authToken; // gained from first app parameters.RefreshToken = refreshToken; // gained from first app
// Retrieve the list of all existing products string projection = "schema"; ProductQuery query = new ProductQuery(projection, accountId); ProductFeed feed = service.Query(query);
This works great for exactly one hour until the token expires and then it fails. The example you showed is doing it all in the same context, perhaps there is more information I need to preserve from the parameters object from the first application? Does it work if you separate the auth process into a separate application. Essentially customers set up their google accounts in one web application and then the scheduled job will be running in a different context. Besides that you dont want to be trading a token for a url code everytime right? Once you have an auth token, you can continue to use that without another code request, right? Or am I mistaken here?
On Monday, May 14, 2012 10:52:25 AM UTC-4, Caroline McLean wrote:
> Danny,
> In our last biweekly meeting, you recommended everyone use OAuth 2.0
> As described in "Using OAuth 2.0 for Server to Server Applications" ( > https://developers.google.com/accounts/docs/OAuth2ServiceAccount) " The > mechanics of this interaction require applications to create and > cryptographically sign JWTs. Developers are strongly encouraged to use an > existing library to perform these tasks."
> However, there is currently no support for this in .NET? Is there an ETA > on the Crypto support in the .NET library? Is there a recommended > alternative or is it best to wait until this support is present.
> Sorry I think my example was not complete enough. I am using two separate
> apps to request the token and then to use the token to get products. I
> store the auth token and the refresh token from the first app and use it in
> my second app. This is very close to how it will be used when implemented.
> BTW there is no ContentForShoppingService(userAgent); that takes two
> parameters in the .net wrapper, at least not in my version.
> So to secure the auth token I do the following (sample code essentially)
> --------------------------------------------------------------------------- --------------------------------------------------------------------------- -----------------------------------------------------------
> private static string redirectUri = "
> https://localhost/oauth2callback.ashx"; // the magic url you suggested in
> the meeting the other day is not
> // acceptable for web applications -
> only installed non web apps
> string url =
> OAuthUtil.CreateOAuth2AuthorizationUrl(parameters);
> // code parameter gained from pasting the above url into a
> browser
> Console.WriteLine("Authorize URI: " + url);
> parameters.AccessCode = Console.ReadLine(); // in the query
> string copy and past the code parameter value here
> // this populates the parameter object - copy the values of
> the authentication and refresh tokens to use for your authorization later
> OAuthUtil.GetAccessToken(parameters);
> --------------------------------------------------------------------------- --------------------------------------------------------------------------- -----------------------------------------------------
> // in a separate app I run the following code
> ContentForShoppingService service = new
> ContentForShoppingService(userAgent);
> OAuth2Parameters parameters = new OAuth2Parameters();
> parameters.AccessToken = authToken; // gained from first app
> parameters.RefreshToken = refreshToken; // gained from first
> app
> // Retrieve the list of all existing products
> string projection = "schema";
> ProductQuery query = new ProductQuery(projection, accountId);
> ProductFeed feed = service.Query(query);
> This works great for exactly one hour until the token expires and then it
> fails. The example you showed is doing it all in the same context, perhaps
> there is more information I need to preserve from the parameters object
> from the first application? Does it work if you separate the auth process
> into a separate application. Essentially customers set up their google
> accounts in one web application and then the scheduled job will be running
> in a different context. Besides that you dont want to be trading a token
> for a url code everytime right? Once you have an auth token, you can
> continue to use that without another code request, right? Or am I mistaken
> here?
> Thanks again for all of your help.
> Caroline
> On Monday, May 14, 2012 10:52:25 AM UTC-4, Caroline McLean wrote:
>> Danny,
>> In our last biweekly meeting, you recommended everyone use OAuth 2.0
>> However, there is currently no support for this in .NET? Is there an ETA
>> on the Crypto support in the .NET library? Is there a recommended
>> alternative or is it best to wait until this support is present.
> To post to this group, send email to
> google-content-api-for-shopping@googlegroups.com.
> To unsubscribe from this group, send email to
> google-content-api-for-shopping+unsubscribe@googlegroups.com.
> For more options, visit this group at
> http://groups.google.com/group/google-content-api-for-shopping?hl=en.
> 2) You also need your account data to do the refresh. In particular > ClientSecret and ClientId
> If you trickle down the call stack, we have > - GOAuth2RequestFactory.CreateRequest returns GOAuth2Request
> - In GOAuth2Request.Execute if HttpStatusCode is > Unauthorized, OAuthUtil.RefreshAccessToken is called
> - RefreshAccessToken, OAuthBase.GetOAuth2AccessToken > and OAuthBase.GetRefreshAccessTokenRequestBody are called
> - In OAuthBase.GetRefreshAccessTokenRequestBody, the client id and client > secret are used along with the refresh token
> 3) You should serialize every property you can/are comfortable with from > the OAuth2Parameters object and then reconstruct it
> Regards,
> On Thu, May 17, 2012 at 12:20 PM, Caroline McLean <bbmcarol...@gmail.com>wrote:
>> Sorry I think my example was not complete enough. I am using two >> separate apps to request the token and then to use the token to get >> products. I store the auth token and the refresh token from the first app >> and use it in my second app. This is very close to how it will be used >> when implemented. >> BTW there is no ContentForShoppingService(userAgent); that takes two >> parameters in the .net wrapper, at least not in my version.
>> So to secure the auth token I do the following (sample code essentially)
>> --------------------------------------------------------------------------- --------------------------------------------------------------------------- ----------------------------------------------------------- >> private static string redirectUri = " >> https://localhost/oauth2callback.ashx"; // the magic url you suggested >> in the meeting the other day is not
>> // acceptable for web applications - >> only installed non web apps
>> string url = >> OAuthUtil.CreateOAuth2AuthorizationUrl(parameters); >> // code parameter gained from pasting the above url into a >> browser >> Console.WriteLine("Authorize URI: " + url); >> parameters.AccessCode = Console.ReadLine(); // in the query >> string copy and past the code parameter value here
>> // this populates the parameter object - copy the values of >> the authentication and refresh tokens to use for your authorization later >> OAuthUtil.GetAccessToken(parameters);
>> --------------------------------------------------------------------------- --------------------------------------------------------------------------- ----------------------------------------------------- >> // in a separate app I run the following code >> ContentForShoppingService service = new >> ContentForShoppingService(userAgent);
>> OAuth2Parameters parameters = new OAuth2Parameters(); >> parameters.AccessToken = authToken; // gained from first app >> parameters.RefreshToken = refreshToken; // gained from first >> app
>> // Retrieve the list of all existing products >> string projection = "schema"; >> ProductQuery query = new ProductQuery(projection, accountId); >> ProductFeed feed = service.Query(query);
>> This works great for exactly one hour until the token expires and then it >> fails. The example you showed is doing it all in the same context, perhaps >> there is more information I need to preserve from the parameters object >> from the first application? Does it work if you separate the auth process >> into a separate application. Essentially customers set up their google >> accounts in one web application and then the scheduled job will be running >> in a different context. Besides that you dont want to be trading a token >> for a url code everytime right? Once you have an auth token, you can >> continue to use that without another code request, right? Or am I mistaken >> here?
>> Thanks again for all of your help. >> Caroline
>> On Monday, May 14, 2012 10:52:25 AM UTC-4, Caroline McLean wrote:
>>> Danny,
>>> In our last biweekly meeting, you recommended everyone use OAuth 2.0
>>> However, there is currently no support for this in .NET? Is there an >>> ETA on the Crypto support in the .NET library? Is there a recommended >>> alternative or is it best to wait until this support is present.
>> To post to this group, send email to >> google-content-api-for-shopping@googlegroups.com. >> To unsubscribe from this group, send email to >> google-content-api-for-shopping+unsubscribe@googlegroups.com. >> For more options, visit this group at >> http://groups.google.com/group/google-content-api-for-shopping?hl=en.
>> 2) You also need your account data to do the refresh. In particular >> ClientSecret and ClientId
>> If you trickle down the call stack, we have >> - GOAuth2RequestFactory.CreateRequest returns GOAuth2Request
>> - In GOAuth2Request.Execute if HttpStatusCode is >> Unauthorized, OAuthUtil.RefreshAccessToken is called
>> - RefreshAccessToken, OAuthBase.GetOAuth2AccessToken >> and OAuthBase.GetRefreshAccessTokenRequestBody are called
>> - In OAuthBase.GetRefreshAccessTokenRequestBody, the client id and client >> secret are used along with the refresh token
>> 3) You should serialize every property you can/are comfortable with from >> the OAuth2Parameters object and then reconstruct it
>> Regards,
>> On Thu, May 17, 2012 at 12:20 PM, Caroline McLean <bbmca...@gmail.com<javascript:> >> > wrote:
>>> Sorry I think my example was not complete enough. I am using two >>> separate apps to request the token and then to use the token to get >>> products. I store the auth token and the refresh token from the first app >>> and use it in my second app. This is very close to how it will be used >>> when implemented. >>> BTW there is no ContentForShoppingService(userAgent); that takes two >>> parameters in the .net wrapper, at least not in my version.
>>> So to secure the auth token I do the following (sample code essentially)
>>> --------------------------------------------------------------------------- --------------------------------------------------------------------------- ----------------------------------------------------------- >>> private static string redirectUri = " >>> https://localhost/oauth2callback.ashx"; // the magic url you suggested >>> in the meeting the other day is not
>>> // acceptable for web applications >>> - only installed non web apps
>>> string url = >>> OAuthUtil.CreateOAuth2AuthorizationUrl(parameters); >>> // code parameter gained from pasting the above url into a >>> browser >>> Console.WriteLine("Authorize URI: " + url); >>> parameters.AccessCode = Console.ReadLine(); // in the query >>> string copy and past the code parameter value here
>>> // this populates the parameter object - copy the values of >>> the authentication and refresh tokens to use for your authorization later >>> OAuthUtil.GetAccessToken(parameters);
>>> --------------------------------------------------------------------------- --------------------------------------------------------------------------- ----------------------------------------------------- >>> // in a separate app I run the following code >>> ContentForShoppingService service = new >>> ContentForShoppingService(userAgent);
>>> OAuth2Parameters parameters = new OAuth2Parameters(); >>> parameters.AccessToken = authToken; // gained from first app >>> parameters.RefreshToken = refreshToken; // gained from first >>> app
>>> // Retrieve the list of all existing products >>> string projection = "schema"; >>> ProductQuery query = new ProductQuery(projection, accountId); >>> ProductFeed feed = service.Query(query);
>>> This works great for exactly one hour until the token expires and then >>> it fails. The example you showed is doing it all in the same context, >>> perhaps there is more information I need to preserve from the parameters >>> object from the first application? Does it work if you separate the auth >>> process into a separate application. Essentially customers set up their >>> google accounts in one web application and then the scheduled job will be >>> running in a different context. Besides that you dont want to be trading a >>> token for a url code everytime right? Once you have an auth token, you can >>> continue to use that without another code request, right? Or am I mistaken >>> here?
>>> Thanks again for all of your help. >>> Caroline
>>> On Monday, May 14, 2012 10:52:25 AM UTC-4, Caroline McLean wrote:
>>>> Danny,
>>>> In our last biweekly meeting, you recommended everyone use OAuth 2.0
>>>> However, there is currently no support for this in .NET? Is there an >>>> ETA on the Crypto support in the .NET library? Is there a recommended >>>> alternative or is it best to wait until this support is present.
>>> To post to this group, send email to >>> google-content-api-for-shopping@googlegroups.com <javascript:>. >>> To unsubscribe from this group, send email to >>> google-content-api-for-shopping+unsubscribe@googlegroups.com<javascript:> >>> . >>> For more options, visit this group at >>> http://groups.google.com/group/google-content-api-for-shopping?hl=en.