App engine has by default an integrated google sign in features, which gives back the current authenticated user email and ID (permission is asked to the user before).
I was wondering if the app engine has an option to extend to permissions asked to the user to include more scopes for examples (contact information, manage youtube account).
Or is it only possible via oauth authentication?
No, you can only do this via OAuth.
User API uses OpenID which does not support "scopes". OAuth does support scopes so you should use it if you need broader access to users profile.
Related
I'm new to web dev, and trying to build an application using google app engine's java standard environment, which will require user authentication. I'd like to provide authentication which requires only a username and password of the user, as opposed to a phone number or social account.
As I look through the options listed in app engine's auth tutorial, if I'm understanding them correctly, none of them allow login without a phone number or social account? https://cloud.google.com/appengine/docs/standard/java/oauth/
If so, are there alternatives available while still using app engine? I've read some about 'web container managed authentication' but I'm not sure if its something app engine will support, or if its a full solution.
Is it possible/feasible to roll fully custom authentication in the app engine standard environment? As I search for custom authentication tutorials I see a lot of articles recommending against this, but it's not clear to me what the alternative is.
Thanks for any information
As it's mention on the OpenID Connect documents of Google Cloud, it's important for you and your users security to authenticate using well proven and debugged code. Google offers Firebase Authentication which let's users log in with an Email and password.
If you still want to implement the authorize part on your own, you can use your preferred web framework and probably it will have an authorizing process.
For example, in python you can use Django authorize system to provide users for a custom way to log in.
But, as I said before, I highly recommend you to use the Google APIs for authorizing as they are OpenID certificated.
I used "gae.api.users" to check if the logged users was me (users.is_current_user_admin());-)
But this api is no more available. How can I do the same kind of thing with GAE/py37 ?
From the Users section of the Understanding differences between Python 2 and Python 3 on the App Engine standard environment guide:
The Users service is not available in Python 3. You can use any
HTTP-based authentication mechanism, such as:
Google Identity Platform, which provides many options for authentication and authorization of Google user accounts.
Firebase Authentication, which provides authentication using username/password and federated identity using Google, Facebook,
Twitter, and more.
Note: Because the Users service is not available, it is not possible to use app.yaml to make URLs accessible only by
administrators.
I want to add social sign-in feature to my Google App Engine based application and hence want to add Google's authentication mechanism along with FB log-in.
I am confused because Google has provided at least 3 different ways to do this.
Google+ sign-in (https://developers.google.com/+/web/signin/server-side-flow)
Users service provided on Google App Engine
Federated Authentication (https://developers.google.com/appengine/articles/openid)
I would like to know which method is the most recent and which method is used widely?
Thanks,
Chandrashekhar
#1 Google+ Sign In allows users to log in via OAuth 2.0, but requires users to have Google Plus enabled. Google+ Sign In also provides additional functionality to the Google+ APIs such as sharing and social integration. However, you could just use standard OAuth 2.0 for login, which removes the Google+ requirement.
#2 Users Service is a Google App Engine API. It allows any user with a Google Account to login. This is different to OAuth 2.0 - it uses Googles standard login pages and you can use it right out of the box without having to configure any OAuth scopes etc. You can get going with this very quickly.
#3 Federated Login integrates the Open ID standard with the Google App Engine Users API. This allows your users to log in with an Open ID (ie credentials they have registered with an 'Open ID provider'), and you to use the standard Users Service API. There are many Open ID providers out there, including Google.
Your question states that you want to add a "social sign-in feature" along with "FB log-in". So, that basically rules #1 & #2 out. Unfortunately, Facebook (and Twitter) are not Open ID providers, so that kind of rules #3 out too. For these, you will need to implement their own authentication mechanisms (Facebook Login and Sign in with Twitter). There is a great boilerplate repo on GitHub that has some code (in python) to help you get going.
I'm looking at migrating a JBOSS 4 application to Google's App Engine.
We have a role based login system at the moment, with administrators, domain admins and users.
Is it possible to migrate out user, password ,roles based system to GAE?
I can't find any documentation about it.
As outlined in the documentation, handlers can be protected by requiring login or admin user when Google accounts auth is used. Endpoints can be protected with OAuth.
Taking into account your app is using role based authentication, you should take care of its implementation to protect handlers. You may find this article useful to go ahead with your implementation.
I have an application hosted on Google AppEngine. This app requires users authentication. I know that users can be authenticaded through OpenId, Google Accounts and so on. However, some user don't have any of these accounts. Thus, i have to suggest that they create an OpenId or a Google Account before they can be able to access my application.
I was wondering if it's possible to host an OpenId provider inside AppEngine, this way, instead of suggesting user to go away, create an OpenId and later get back, i could simply display a simple form. In this form, that user could create they new account and, at same time, create an OpenId, since the application would also be an OpenId Provider.
I'm not sure if i could host and OpenId provider inside appengine . Would I?
Thanks a lot
http://code.google.com/p/google-app-engine-samples/ contains a sample OpenID provider application. It uses Google accounts to authenticate, but it shouldn't be too difficult to use it to create your own accounts.
Of course, it's a bit bizarre that you want to create accounts on your service for the users but then use openID to authenticate them from that service to itself; why not just have a non-OpenID login in addition to OpenID if you want to manage some users' accounts yourself?