如何使用https://appengine.google.com/_ah/logout和签名的URL登出Google用户?

时间:2019-06-26 15:17:39

标签: c# google-app-engine google-cloud-platform google-oauth2

在我的iOS应用程序中,我为用户添加了退出该Google帐户的功能。为此,我将在以下地址启动SFSafariViewController的新实例,如本question所述:

https://www.google.com/accounts/Logout?continue=https://appengine.google.com/_ah/logout?continue=https://myapp.mycompany.ca/api/v1/logout/google

除了谷歌显示了一个烦人的重定向通知外,它确实起作用:

Redirection Notice

this问题中所述,它是Google设计的intended behavior,需要对URL进行签名。我构建了以下客户端应用程序,使我能够对自己的URL进行签名:

try
{
    using (Stream certJsonStream = Assembly.GetExecutingAssembly().GetManifestResourceStream(ServiceAccountKeyFile))
    {
        var certDefinition = new {client_email = "", private_key = ""};

        using (var streamReader = new StreamReader(certJsonStream))
        {
            var jsonAsObject = JsonConvert.DeserializeAnonymousType(await streamReader.ReadToEndAsync(), certDefinition);

            // Create an explicit ServiceAccountCredential credential
            var xCred = new ServiceAccountCredential(new ServiceAccountCredential.Initializer(jsonAsObject.client_email)
            {
                Scopes = new[]
                {
                    IAMCredentialsService.Scope.CloudPlatform
                }

            }.FromPrivateKey(jsonAsObject.private_key));

            var iamCredentialsService = new IAMCredentialsService(
                new BaseClientService.Initializer()
                {
                    HttpClientInitializer = xCred,
                });

            var signBlobRequest = new SignBlobRequest
            {
                Payload = Convert.ToBase64String(Encoding.UTF8.GetBytes(Url)),
            };

            ProjectsResource.ServiceAccountsResource.SignBlobRequest signBlobRequest1 = iamCredentialsService.Projects.ServiceAccounts.SignBlob(signBlobRequest, "projects/-/serviceAccounts/*service-account-name*@appspot.gserviceaccount.com");
            SignBlobResponse response = await signBlobRequest1.ExecuteAsync();

            Console.WriteLine($"Blob to sign: {Url}");
            Console.WriteLine($" Signed data: {response.SignedBlob}");
        }
    }
}
catch (Exception exc)
{
    Console.WriteLine();
    Console.WriteLine($"The following error has been thrown: {exc}");
}

Console.WriteLine();
Console.WriteLine($" -= PRESS A KEY TO EXIT =-");
Console.ReadLine();

其中:

  • ServiceAccountKeyFile指向包含为我的服务帐户生成的私钥的JSON文件;
  • Url要签名的URL;

问题

如何使用签名的Blob?是否应该将其嵌入https://appengine.google.com/_ah/logout URL中?我尚未找到有关此部分的任何文档。

0 个答案:

没有答案