Question

我试图让Google Identity Toolkit API适用于基于PHP的应用程序。

我一直在关注Google提供的快速入门指南： https://developers.google.com/identity/toolkit/web/quickstart/php

我完全按照步骤（并检查并仔细检查）。

登录按钮显示在index.php页面上。点击此按钮会重定向到widget.php页面。我可以选择要登录的帐户，然后在返回到成功登录页面（再次index.php）时收到以下错误消息：

致命错误：未捕获的异常＆＃39; Google_Auth_Exception＆＃39;有消息＆＃39;错误刷新OAuth2令牌，消息：＆＃39; {＆＃34;错误＆＃34; ：＆＃34; invalid_client＆＃34;，＆＃34; error_description＆＃34; ：＆＃34; OAuth客户端是。无效＆＃34; }＆＃39;

我尝试在Google Developer Console中重新创建OAuth客户端。检查电子邮件和项目名称字段时提到的一些搜索结果已在OAuth同意屏幕上完成，我已经完成了所有这些。

任何帮助＆amp;建议将不胜感激。注意：我只使用＆＃34; Google＆＃34;在Identity Toolkit API设置下的可用提供程序之外。

我的index.php页面：

<!DOCTYPE html>
<html>
<head>

<!-- 1: Load the Google Identity Toolkit helpers -->
<?php
  set_include_path(get_include_path() . PATH_SEPARATOR . __DIR__ .'/vendor/google/apiclient/src');
  require_once __DIR__ . '/vendor/autoload.php';

  $gitkitClient = Gitkit_Client::createFromFile(dirname(__FILE__) . '/gitkit-server-config.json');
  $gitkitUser = $gitkitClient->getUserInRequest();
?>
<!-- End modification 1 -->

<script type="text/javascript" src="//www.gstatic.com/authtoolkit/js/gitkit.js"></script>
<link type=text/css rel=stylesheet href="//www.gstatic.com/authtoolkit/css/gitkit.css" />

<script type=text/javascript>
  window.google.identitytoolkit.signInButton(
    '#navbar',
    {
      widgetUrl: "/gitkit",
      signOutUrl: "/index"
    }
  );
</script>
</head>
<body>
<div id="navbar"></div>

<!-- 2: Print the user information if a signed in user is present -->
<p>
  <?php if ($gitkitUser) { ?>
    Welcome back!<br><br>
    Email: <?= $gitkitUser->getEmail() ?><br>
    Id: <?= $gitkitUser->getUserId() ?><br>
    Name: <?= $gitkitUser->getDisplayName() ?><br>
    Identity provider: <?= $gitkitUser->getProviderId() ?><br>
  <?php } else { ?>
    You are not logged in yet.
  <?php } ?>
</p>
<!-- End modification 2 -->

</body>
</html>

我的gitkit.php页面：

<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">

<!-- Copy and paste here the client configuration from Developer Console into the config variable -->
<script type="text/javascript" src="//www.gstatic.com/authtoolkit/js/gitkit.js"></script>
<link type="text/css" rel="stylesheet" href="//www.gstatic.com/authtoolkit/css/gitkit.css" />
<script type="text/javascript">
  var config =
    {
  "widgetUrl": "http://local.myfakedomain.com/gitkit",
  "signInSuccessUrl": "/",
  "signOutUrl": "/",
  "oobActionUrl": "/",
  "apiKey": "<my-api-key-here>",
  "siteName": "this site",
  "signInOptions": ["password","google"]
}
  ;
  // The HTTP POST body should be escaped by the server to prevent XSS
  window.google.identitytoolkit.start(
      '#gitkitWidgetDiv', // accepts any CSS selector
      config,
      JSON.parse('<?php echo json_encode(file_get_contents("php://input")); ?>')
  );
</script>
<!-- End modification -->

</head>
<body>

<!-- Include the sign in page widget with the matching 'gitkitWidgetDiv' id -->
<div id="gitkitWidgetDiv"></div>
<!-- End identity toolkit widget -->

</body>
</html>

我的gitkit-server-config.json文件：

{
  "clientId": "<my-client-id-here>",
  "projectId": "<my-project-id-here>",
  "serviceAccountEmail": "<my-serviceAccountEmail-here>",
  "serviceAccountPrivateKeyFile": "<my-p12-KeyFile-location-here>",
  "widgetUrl": "http://local.myfakedomain.com/gitkit",
  "cookieName": "gtoken"
}

Answer 1

我有同样的问题我通过在服务器配置代码中插入“正确的”服务帐户电子邮件来解决它：

{
  "clientId": "<my-client-id-here>",
  "projectId": "<my-project-id-here>",
  "serviceAccountEmail": "<Correct-serviceAccountEmail-here>",
  "serviceAccountPrivateKeyFile": "<my-p12-KeyFile-location-here>",
  "widgetUrl": "http://local.myfakedomain.com/gitkit",
  "cookieName": "gtoken"
}

诀窍是 serviceAccountEmail 不是您的Google电子邮件，要查找正确的电子邮件，请转到凭据，然后在服务帐户密钥下单击< strong>管理服务帐户链接到右侧，转到正在使用的服务并记下电子邮件字段。电子邮件很长，格式类似于 service-name@project-name.xxx.xxxxxxxxx.xxx

Answer 2

在你的gitkit-server-config.json文件中，serviceAccountEmail应该为空。您可以从Google Developers Console项目设置页面复制服务帐户电子邮件。

Answer 3

除了服务帐户电子邮件（类似“app-example-com@appname.example.com.iam.gserviceaccount.com”之外），项目ID也引发了我的问题。

我找到的解决方案是，如果google说你的projectId是“example.com:appname”，请将其更改为“appname”

适用于PHP的Google Identity Toolkit API会返回INVALID_CLIENT

3 个答案: