带有ServiceAccount错误401的Gmail

Question

我正在尝试从后端java中使用Gmail。从maven依赖项开始

    <dependency>
        <groupId>com.google.apis</groupId>
        <artifactId>google-api-services-gmail</artifactId>
        <version>v1-rev20200406-1.30.9</version>

    </dependency>
    <dependency>
        <groupId>com.google.auth</groupId>
        <artifactId>google-auth-library-oauth2-http</artifactId>
        <version>0.20.0</version>
    </dependency>  

我已经从google管理器下载了一个p12 Keystore，并创建了一个服务帐户。

PrivateKey key = (PrivateKey)keystore.getKey("privatekey", "somepass".toCharArray()); 
ServiceAccountCredentials serviceAccountCredentials = ServiceAccountCredentials.newBuilder()
                 .setClientEmail("somestuff@developer.gserviceaccount.com")                                                                                         
                 .setServiceAccountUser("somestuff@developer.gserviceaccount.com")                                                                                                
                 .setClientId("somenumber")                                                                                                  
                 .setScopes(SCOPES)                                                                                                  
                 .setPrivateKey(key).build();

现在看来这起作用了

serviceAccountCredentials.refresh();

的形式上生成一个令牌。

ya29.c.Ko8BygeNYc2Onx2IZpK-ocaHKTiCxOcYYK7nbTg8uE0gyqc8rXROuiVJ7oXCfnYD1pDOyHXiy_K5Eyk3aV3epgjtnr2WVCP_xpWCxq-BExh4i1aIXW9m7gkkUtbteXaD1nETUwIc6n9Uz2oCJSU4jrodFv4n4drxlSGd7my0LcxrMk_E5cFY7jo-Vt40i58g5QY

现在我无法工作的部分

HttpRequestInitializer requestInitializer = new HttpCredentialsAdapter(serviceAccountCredentials);

Gmail service = new Gmail.Builder(new NetHttpTransport(), JacksonFactory.getDefaultInstance(), requestInitializer).setApplicationName(APPLICATION_NAME).build();
Gmail.Users.Labels.List list = service.users().labels().list("b@someemail")
                               .setAccessToken(credential.getAccessToken().getTokenValue());

我还完成了Gmail REST : 400坏请求+失败的先决条件建议的所有gmail配置

但我一直想得到

com.google.api.client.googleapis.json.GoogleJsonResponseException: 401 Unauthorized
{
  "code" : 401,
  "errors" : [ {
    "domain" : "global",
    "location" : "Authorization",
    "locationType" : "header",
    "message" : "Invalid Credentials",
    "reason" : "authError"
  } ],
  "message" : "Invalid Credentials"
}

问候

Answer 1

备注

您正在使用域委托，您应该按照这指南授权服务帐户使用这个特定范围的Gmail。

方法

一旦创建了从服务帐户键开始的凭据对象，就可以这样创建Gmail服务构建器了：

private static final JsonFactory JSON_FACTORY = JacksonFactory.getDefaultInstance();
private static final String SERVICE_ACCOUNT_ID = "your-service-account-id";
private static final String APPLICATION_NAME = "your-app-name";

PrivateKey key = (PrivateKey)keystore.getKey("privatekey", "somepass".toCharArray()); 

HttpTransport httpTransport = GoogleNetHttpTransport.newTrustedTransport();

GoogleCredential credential = new GoogleCredential.Builder()
                .setTransport(httpTransport)
                .setJsonFactory(JSON_FACTORY)
                .setServiceAccountId(SERVICE_ACCOUNT_ID)
                .setServiceAccountScopes(SCOPES)
                .setServiceAccountPrivateKey(key)
                .setServiceAccountEmail("user@email")
                .build();

Gmail service =  new Gmail.Builder(httpTransport, JSON_FACTORY, credential)
                .setApplicationName(APPLICATION_NAME).build();

现在，您可以直接使用Gmail服务，而无需再次指定访问令牌或凭据。就像这样：

ListLabelsResponse listResponse = service.users().labels().list("b@somemail").execute();

参考文献

Java Gmail

服务帐户Java