I am writing an app to interact with our Google Apps for Education domain using Zend Gdata framework and 3-legged OAuth.
So far I am only able to gain read-only access to Groups. It works fine and I have access to all information. However, write access does not work for me.
I end up with "Domain cannot use API"
$client = new Zend_Gdata_Gapps($httpClient, "domain.edu");
This works fine:
$client->retrieveAllGroups('https://apps-apis.google.com/a/feeds/group/2.0/domain.edu/');
This does not and results in "Domain cannot use API"
$client->createGroup('test-group', 'Test Group');
I found this page and it mentions something about Groups being Read-Only?
Groups Rosters HTTPS Read Only Scope:
https://apps-apis.google.com/a/feeds/group/#readonly
Is this true?
Edit: My Provisioning API is definitely enabled.
Drop the #readonly from the URL to get write-access to group feeds. What you picked up was meant for marketplace developers to access domain information when an admin installs the app.
A more generic scope for Apps APIs is documented here which allows access to all Google Apps Domain Information and management APIs:
It turns out that while i was testing someone else turned off Provisioning API because they did not like the scary warning message that told them about data not being synced between Google Apps and 3rd party management tools.
Related
I use Google OAuth to sign in my Web Application which was created as a project in Google Cloud Platform i.e. Project1.
I have a user with custom role in this project. After I logged in with my Google account, I'm able to get userinfo using Google_Client (PHP library - google/apiclient). However, I'm having a hard time figuring out how to get the custom role for the logged in user. I tried using Google_Service_iam but get Uncaught Google_Service_Exception: 404 Not Found.
Is this a correct way of building a role based control web app utilizing Google IAM?
Although it would be somehow possible by building it yourself, I would not directly use IAM as an authentication provider. Instead, use the Identity Platform or something like Auth0 or Okta. Myself, I prefer Firebase Authentication, which integrates easily with all popular languages and frameworks.
IAM is meant to authorize users within GCP, and not in a custom web-app. In your setup, you would have to add every future user to Gsuite and IAM, which is very costly and not designed for this purpose.
I would recommend taking a look at the Authentication Strategies for application developers.
Since you need to grant to Google Cloud APIs on behalf of an end user, you may use the protocol OAuth 2.0 protocol. The application initiates an OAuth consent flow where you application will receive the user's credentials. With these credentials, it can call Google Cloud APIs on behalf of the user.
Another solutino as Nebulastic also suggested, is the Cloud Identity Platform, where you can configure custom claims to restrict a user's access to a resource depending on their role.
Seeking for guidance on the subject as I'm really stuck on this, I have a internal URL for an App made on PHP and I want to connect to Azure Active Directory.
So far I've reviewed an example from Microsoft using SimpleSAML but it's really outdated and I'm having troubles adapting it for the newer SimpleSAMl code.
Is there a better way to integrate a web application with Azure AD? I read somewhere that I may use Get started with Mobile Services but I would like to hear from previous experiences on what is the best/current method for using Azure AD for login on PHP?.
-- EDIT --
By integrate I mean to allow people authenticate and retrieve the email address or EmployeeID from the Azure AD to provide SSO support.
There are several scenarios Azure AD supports, depend on what you use Azure AD for. Basically, to access the resources via Azure AD from PHP web application, you can refer to Web Application to Web API section to understand this scenario and get started.
To integrate Azure AD in PHP web applications, we need to follow authorization code grant flow steps to build several custom HTTP requests. E.G. To get access token via OAuth 2.0 protocol, we should refer to the steps on Authorization Code Grant Flow, generally, we will build 2 HTTP requests to get access token:
1,Request an authorization code
The build-up URL will redirect to the sso page, after login we can get the code value which will be used in next step.
2,Use the Authorization Code to Request an Access Token:
Then we can use the access token to add the JWT string with a “Bearer” designation in the Authorization header of the request to the resource web API.
Here is a PHP test project provided by Azure for your reference.
we are migrating our AD to Azure AD and we would like to have SSO support for the internal web apps, so that when they log in into their PCs the use the azure app proxy and they're signed automatically on the PHP web apps. Is this possible?
#Vladimir, Base on my experience, it is possible. There are some scenarios you can refer to. You may need use Azure AD Connect to sync your local AD to Azure AD, and enable Azure AD SSO to integrate with you php application in your scenario.
Firstly, If you wants to integrate your On-premise AD on Azure AD, you should use the tool -- Azure AD Connect, which is used to sync up your AD into Azure AD. Please see this tutorials and video. For this action, you need have the IT administrator permission.
Secondly, you need use Federated Single Sign-On and other methods for your application on Azure Portal. You may need to configure your PHP application like this video:https://channel9.msdn.com/Blogs/Open/Using-SimpleSAML-to-authenticate-PHP-applications-with-Azure-AD.
And if you wants to get the users information, you may need use Azure Graph API as Gary's post.
I am new to OpenID and have been requested to build a login system to work with the company's Google account. They want to restrict logins to users of their domain. They login into Gmail using their domain and they want this feature to allow access to their systems.
Let's say the domain is example.com. They would log into Gmail as user#example.com or go to their domain login page to access their accounts.
I have been doing some research and it seems that the Google Federated Login is what I should be working with. I downloaded the Google APIs Client Library for PHP and have been playing with the examples but I still cannot get it to restrict access to whom logs in. Currently anyone with a google account seems to be able to login. Also, the API wants to access certain information... I only want to authenticate the user to ensure they are a valid user of the domain and eventually allow SpreadSheet Access in Google Docs so that another script (in the same system) can create SpreadSheets while the user is updating the system.
So my questions are:
1) Which service do I need to enable in the Google API console? Enterprise License Manager API is the only service that is enabled.... I'm starting to think maybe I should disable it.. Do any services have to be enabled? I'm not really sure about this.
2) Is there anything special about the PHP Google APIs that would require me to use Google's API or is this functionality available with any OpenID library? If the latter, which libraries are good for what I am trying to accomplish? (PHP)
3) I have found a few examples for allowing login with a Google account but I haven't found a single one for restricting it to a single domain. I am sure this is possible but am starting to feel that it's very difficult to implement... Any information on this would be very beneficial.
Thanks for any information you can toss my way.
I'm looking for a solution to create and configure Facebook Apps via the Facebook APIs.
It doens't matter if its Graph API / FQL or REST API but I couldn't find any way to do this.
You didn't find because this is not possible.
Facebook decided not to support app management and creation using the API, in order to avoid applications created or edited by bots.
Only a few actions are possible using the API:
Migration (like migrating to OAuth2, ...)
Restriction (Geographical, age...)
User ban (add/remove)
Test User Creation/edition/deletion
See http://developers.facebook.com/docs/reference/api/application/ for more info.
You'll notice one of the first sentence: "To create, administer or delete applications developers must go to the Developer Application."
You can use the Legacy REST API to set (and get) application properties:
https://developers.facebook.com/docs/reference/rest/admin.setAppProperties/
But no create API exists, and probably never will due to dirty spammers...
Hi guys I'm working on my google apps application - currently I've build the authentication upon the example available at google namely this url
The problem is that the session seems to time out and that everytime I am logged into my google apps account and go to my application I need to authenticate again and go through the screen where google asks me if I should allow the application to access the services like GMAIL, Docs etc listed in the manifest xml file. I don't think I'm doing it right as other applications allow instant access.
Any ideas
you should store and reuse the oauth access & secret key. this should avoid the re-authentication with google (or other oauth based services) - unless your access key has been revoked of course.
Cheers!