服务应用程序的Google oAuth 2.0(JWT令牌请求)

Question

我正在尝试为此处描述的服务帐户实施Google oAuth 2:在UnityScript上使用https://developers.google.com/accounts/docs/OAuth2ServiceAccount(或C# - 这无关紧要,因为它们都使用相同的Mono .NET类).

我在这里找到了类似的主题:C#中是否有JSON Web Token(JWT)示例？ web-token-jwt-example-in-c但我仍然没有成功.

首先,我已生成标题和声明集(就像在谷歌文档中一样)

var header: String = GetJWTHeader();
var claimset: String = GetJWTClaimSet();

结果是(为清楚起见,用新行分隔):

{ "ALG": "RS256", "典型": "智威汤逊"}

{ "ISS": "425466719070-1dg2rebp0a8fn9l02k9ntr6u5o4a8lp2.apps.googleusercontent.com"

"范围":" https://www.googleapis.com/auth/prediction ",

"aud":" https://accounts.google.com/o/oauth2/token ",

"EXP":1340222315,

"IAT":1340218715}

Base-64编码方法:

public static function Base64Encode(b: byte[]): String {
    var s: String = Convert.ToBase64String(b);
    s = s.Replace("+", "-");
    s = s.Replace("/", "_");
    s = s.Split("="[0])[0]; // Remove any trailing '='s
    return s;
}

public static function Base64Encode(s: String): String {    
    return Base64Encode(Encoding.UTF8.GetBytes(s));
}

然后我正在签名.

var to_sign: byte[] = 
     Encoding.UTF8.GetBytes(Base64Encode(header) + "." + Base64Encode(claimset));
var cert: X509Certificate2 = 
     new X509Certificate2(google_pvt_key.ToArray(), "notasecret");
var rsa: RSACryptoServiceProvider = cert.PrivateKey;
var sgn: String = Base64Encode(rsa.SignData(to_sign, "SHA256"));

var jwt: String = Base64Encode(header) + "." + Base64Encode(claimset) + 
                     "." + sgn;

然后形成请求:

var url: String = "https://accounts.google.com/o/oauth2/token";
var form: WWWForm = new WWWForm();
form.AddField("grant_type", "assertion");
form.AddField("assertion_type", "http://oauth.net/grant_type/jwt/1.0/bearer");
form.AddField("assertion", jwt);
var headers: Hashtable = form.headers;
headers["Content-Type"] = "application/x-www-form-urlencoded";

var www: WWW = new WWW(url, form.data, headers);

我得到的只是" 错误400:错误请求 ".

编码数据看起来像(为清晰起见添加了换行符):

eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.

eyJpc3MiOiI0MjU0NjY3MTkwNzAtMWRnMnJlYnAwYThmbjlsMDJrOW50cjZ1NW80YThscDIuYXBwcy5nb29nbGV1c2VyY29udGVudC5jb20iLCJzY29wZSI6Imh0dHBzOi8vd3d3Lmdvb2dsZWFwaXMuY29tL2F1dGgvcHJlZGljdGlvbiIsImF1ZCI6Imh0dHBzOi8vYWNjb3VudHMuZ29vZ2xlLmNvbS9vL29hdXRoMi90b2tlbiIsImV4cCI6MTM0MDIyMjMxNSwiaWF0IjoxMzQwMjE4NzE1fQ.

lIFg7-Og_BcC5qpICLt7USwGIHUOz-vV4ADNq0AWhuRtsvFrbZn5mxk4n9r5qU66q4reTVVAtuW06DeGsdcBMNgEdIMvN6VuYQybs64p9mqrfECBYxO1FWHbUG-2On1IpowybEsRRUjZfp0jFuEY7SLE3XRaXan0k5zmejcvLQo

我花了两天时间试图弄清楚出了什么问题,但我看不出来.

另外,我找不到任何合适的文档和示例.

我只想收到一个令牌.

1. 我是以正确的方式签署字节的吗？
2. claimset中的"scope"参数应该是什么样的？我尝试过" https://www.googleapis.com/auth/devstorage.readonly "和" https://www.googleapis.com/auth/prediction ".
3. 什么"iss"参数应该等于？客户端ID或电子邮件地址？(试过两个)
4. 找出错误的方法有哪些？
5. 服务应用程序是否有任何C#库(不适用于已安装的应用程序或客户端登录)？

我疯了......它必须工作,但它没有......: - /

Answer 1

解决方案是在请求代码中所有斜杠都必须被反斜杠

错误:

"scope":"https://www.googleapis.com/auth/prediction",
"aud":"https://accounts.google.com/o/oauth2/token",

正确:

"scope":"https:\\/\\/www.googleapis.com\\/auth\\/prediction",
"aud":"https:\\/\\/accounts.google.com\\/o\\/oauth2\\/token",