Update: things have changed since I wrote this post in January: MSFT released their official OpenID connect client middleware and I worked hard with @manfredsteyer to adapt the OAuth2 authorization server built in Katana to OpenID connect. This combination results in a far easier and far more powerful solution that doesn’t require any custom client … Read more
As pointed out in the comments by @Kuba Šimonovský the accepted answer is missing other important factors: Actually, it is much much much more complicated. TL;DR One can infer that the refresh token lifespan will be equal to the smallest value among (SSO Session Idle, Client Session Idle, SSO Session Max, and Client Session Max). … Read more
It’s in lib/devise/controllers/helpers.rb1 and is generated dynamically (user being only one of the possible suffixes): def self.define_helpers(mapping) #:nodoc: mapping = mapping.name class_eval <<-METHODS, __FILE__, __LINE__ + 1 def authenticate_#{mapping}!(opts={}) opts[:scope] = :#{mapping} warden.authenticate!(opts) if !devise_controller? || opts.delete(:force) end def #{mapping}_signed_in? !!current_#{mapping} end def current_#{mapping} @current_#{mapping} ||= warden.authenticate(:scope => :#{mapping}) end def #{mapping}_session current_#{mapping} && warden.session(:#{mapping}) … Read more
I had the same question as the question 1 here, and did some research myself recently, and my conclusion is that it is ok to not keep “client secret” a secret. The type of clients that do not keep confidentiality of client secret is called “public client” in the OAuth2 spec. The possibility of someone … Read more
As it turns out, my suspicions were right. The audience aud claim in a JWT is meant to refer to the Resource Servers that should accept the token. As this post simply puts it: The audience of a token is the intended recipient of the token. The audience value is a string — typically, the … Read more
Indeed there’s the possibility to save your credentials object the first time running successfully an OAuth authorization/authentication flow; then to load the credentials object from that file each time running the program for the n-th time, where n >= 2. Here is how I recommend to structure your code: import os, pickle from google_auth_oauthlib.flow import … Read more
String WEB_APPLICATION_CLIENT_ID = “656631023202-9jsg9faqe87n1uo7f5g6iupti1jl2nps.apps.googleusercontent.com”; String scopes = String.format(“audience:server:client_id:” + WEB_APPLICATION_CLIENT_ID ); Log.e(getClass().getSimpleName(), “email =”+email); String code = null; try { code = GoogleAuthUtil.getToken( LoginActivity.this, // Context context email, // String accountName scopes ); mGoogleCoordinatetoken = code; } catch (IOException transientEx) { // network or server error, the call is expected to succeed if you try … Read more
The following code, corrected from my original question, is based on the example provided by Ian Fraser at: https://groups.google.com/forum/#!msg/google-search-api-for-shopping/4uUGirzH4Rw/__c0e4hj0ekJ His code addressed three issues: It appears as though AnalyticsService.Scopes.AnalyticsReadonly does not work, at least not for me or the way I am doing it. For some reason, the ServiceAccountUser must be assigned to the ServiceAccountId … Read more
You are not getting the multi user selection screen because of the following parameter: authuser=0 This automatically selects the first account you are signed-in with (authuser=1 would select the second etc…). It’s currently not possible to remove that param using the client library because the client library sets it automatically to 0 (this is why … Read more