How credential and google cloud storage work? - google-app-engine

Question

I am just starting to develop GAE web application. I am trying to get a list of bucket of google cloud storage. I found some code from web site.
there are 3 ways on the web what I found.
using Google storage API
https://code.google.com/p/google-api-java-client/source/browse/storage-serviceaccount-appengine-sample/src/main/java/com/google/api/client/sample/storage/appengine/serviceaccount/StorageSample.java?repo=samples&r=f0c6982b3cde8629511346641bfe4bb5eb28d73f
using Json liblary
but thsi sample needs to configure domain verification for bucket.
using python
our exisiting application is developped by gae for Java. I do not think thie python way can include in Java application.
then I would like to fix No1 way.
It show credential error. Buckets are authorized to everyone (All Authenticated Users )for now. I think I need to understand how the credential works. I have read the google developer page about 0Auth2. I could find a sample of bigquery. if you have a sample or good web sites about credential and google cloud storage, it will be great helpful.
the errors;
Error: com.google.api.client.googleapis.extensions.appengine.auth.oauth2.AppIdentityCredential.(Ljava/util/Collection;)V
what i did at API console:
creating client id (web application, service account, installed application each)
creating Simple API Access ( new server key , new browser key)
what I did at local machine;
Set ACL with gsutil
my developing environment
eclipse 3.6 helios ( Japanese language pack)
gae java for eclipse
gae 1.8.0
java 1.6.31
google storage API
google client library
others(tomcat,maven)
windows 7 English with Japanese language pack

Answer 1

Your first attempt (number 1) is the best way to focus on getting this to work. The code sample Marc provided uses the built-in App Engine App Identity module to securely identify the App Engine app to other Google APIs: https://developers.google.com/appengine/docs/java/appidentity/#Asserting_Identity_to_Google_APIs
However, there are 2 gotchas to check:
The App Identity module will not work using the local devserver. When running locally there is no way for the local server to securely identity itself to Google production APIs - so you should either look at using a service account with a downloadable key for local testing, or, easiest option (and what I'd recommend for now), is to deploy into a production App Engine environment to test.
Make sure the App Engine service account email address is added to the access control list for the Google Cloud Storage bucket that you are trying to access. Get this email address by looking under the Admin Console (for your App Engine app) -> Application Settings:
Service Account Name:
xxxxxxx#appspot.gserviceaccount.com
To add this to a Google Cloud Storage access control list, either add it to the project team for the project that owns the Google Cloud Storage bucket, or, if you're not using the default access control settings, add it directly to an ACL:
https://developers.google.com/storage/docs/accesscontrol
Service accounts with downloadable key - use this for local testing if you can't test in a production App Engine environment:
https://developers.google.com/accounts/docs/OAuth2ServiceAccount