Obtaining a basic google auth-token from AccountManager

Question

I want to obtain a Google Authtoken from the AccountManager that I can send to my Webservice (not hosted on App Engine) to authenticate the User (I just need the email address and eventually his name, if no permission is required for this).

What do I have to use for the "authTokenType" Paramter of the "getAuthToken" method?

And which google Api do I have to use to get the Users Email?

Yajairayajurveda

just found another answer on Stackoverflow that seems suitable: stackoverflow.com/a/6680837 – Yajairayajurveda

Answer 1

This is doable using OpenID Connect, however it's sort of experimental, so details could change in the future. If you get an OAuth token for the 'https://www.googleapis.com/auth/userinfo.email' or 'https://www.googleapis.com/auth/userinfo.profile' scope you can use it to get user info from https://www.googleapis.com/oauth2/v1/userinfo (including email). Of course the user needs to authorize this.

You should theoretically be able to get the token from AcccountManager using the "oauth2:https://www.googleapis.com/auth/userinfo.profile" as the token type, but that doesn't appear to work on my device (Galaxy Nexus with stock 4.0.4). Since getting a token via the AccountManager doesn't work (at least for now), the only reliable way is to use a WebView and get one via the browser as described here: https://developers.google.com/accounts/docs/MobileApps

There is a demo web app here that does this: https://oauthssodemo.appspot.com

(late) Update: Google Play Services has been released and it is the preferred way to get an OAuth token. It should be available on all devices with Android 2.2 and later. Getting a profile token does work with it, in fact they use it in the demo app

Pansypant

Is there an alias I can use for googleapis.com/auth/userinfo.email or googleapis.com/auth/userinfo.profile (Otherwise this url will be shown in the permission request which I don't think is very user-friendly)? – Yajairayajurveda

None that I know of. Did you manage to get a token? As I said, it doesn't seem to work on, at least on my device. – Pansypant

Ok thanks for the info, very interesting. I need a solution that works cross all devices so this approach does not really make sense for the. The only possible solution I can think of right now is obtaining an app engine token and having an additional app engine backend that will just offer an authentification service. I really dislike this approach though. – Yajairayajurveda

Use a WebView and have the user authenticate to Google to get the token. That will work on all devices. – Pansypant

You're right, a webview is probably the way to go. I also found the folowing document, maybe you will want to add that to your answer: developers.google.com/accounts/docs/MobileApps – Yajairayajurveda

Yes this is so far the 'official' way to get a token, the AcountManager oauth2: thing being temporary/experimental. Let's hope they will announce something better at this years I/O. I'll add it to my answer. – Pansypant

@NikolayElenkov can you please try 'oauth2:...' and see if it works on your device now? May be the problem has been with Google oauth backend. It works for me right now. – Proselytize

Meanwhile Google Play Services has been released and it is the preferred way to get an OAuth token. It should be available on all devices with Android 2.2 and later. It does work with it, in fact they use it in the demo app. – Pansypant

Answer 2

I have had problems with this as well, since I was not able to find anything like a reference. Perhaps this can help you (code copied from an Android example on using the account manager):

1. Somewhere in an event handler of your Android app, issue a request for an auth token to get the user's email address in Android:

   _accountMgr = AccountManager.get(this);
   Account [] accounts = _accountMgr.getAccounts();                
   Account account = accounts[0];   // For me this is Google, still need to figure out how to get it by name.
   _accountMgr.getAuthToken(account, AUTH_TOKEN_TYPE, false, new GetAuthTokenCallback(), null);
   

2. In the callback, extract the access token:

   private class GetAuthTokenCallback implements AccountManagerCallback<Bundle> {
       public void run(AccountManagerFuture<Bundle> result) {
           Bundle bundle;
           try {
               bundle = result.getResult();
               final String access_token = bundle.getString(AccountManager.KEY_AUTHTOKEN);
               // store token somewhere you can supply it to your web server.
           } catch (Exception e) {
               // do something here.
           }
       }
   }
   

3. Make some request to your web server, supplying the access token.

4. On the web server, validate the access token and obtain the email address:

   curl -d 'access_token=<this is the token the app sent you>' https://www.googleapis.com/oauth2/v1/tokeninfo
   

   You should get something like this:

   {
     "issued_to": "<something>.apps.googleusercontent.com",
     "audience": "<something>.apps.googleusercontent.com",
     "scope": "https://www.googleapis.com/auth/userinfo.email",
     "expires_in": 3562,
     "email": "<users email address>",
     "verified_email": true,
     "access_type": "online"
   }
   

   or if something went wrong:

   {
     "error": "invalid_token",
     "error_description": "Bad Request"
   }
   

Videogenic

Answer 3

You can get the User's name with the Google+ People API. (It will not provide the user's email address).

If this is OK, you can use "Know who you are on Google" as the authTokenType.

There is a sample application provided by Google that demonstrates how to use the AndroidAccountManager in conjunction with the Google+ APIs.

Link: http://code.google.com/p/google-plus-java-starter/source/browse/#hg%2Fandroid

Kochi

Thanks, but I need an token that I can use to get the user's email, since that is the way the backend is identifying users. – Yajairayajurveda