Google API : How to authenticate without redirection?

Question

We want to use Google Doc API to generate Document (In our own business account) when our end users do some actions on our site.

The problem is that we've tried to implement the OAuth 2.0 protocol, as suggested in the v3.0 protocol documentation. The apiClient::authentication method do a redirection. This is a major problem because our users doesn't know the access to our own business account.... and we don't want to give them access anyway ;)

(In other word, we're not creating an application that allow our users to edit their own data, but to interact with our data, like a database.)

I've read that the point of OAuth 2.0 was to avoid that we manage the credential of our users. I'm personally O.K. with the concept, but in our case, we don't want to get authenticated in the google account of our users ...

So, what would be the best approach to get a valid authentication without any interaction from the end user ?

Answer 1

What you describe is not how 3-legged OAuth was designed to be used.

3-legged OAuth is all about delegated authentication where a user (who knows his password) can grant limited and revokable resource access to application. That application never sees the user's password. There is a bunch of work involved to safely allow the application to impersonate the user.

What you probably want is to use the (2-legged) OAuth flow, where the consumer_id/consumer_secret credentials are embedded in your application. Here your application is not impersonating your end user and there would be no browser redirection involved.

Here's some further info on using 2-legged OAuth in Google Apps: http://googleappsdeveloper.blogspot.com/2011/07/using-2-legged-oauth-with-google-tasks.html

And this is a good description of 3- vs 2- legged OAuth: http://cakebaker.42dh.com/2011/01/10/2-legged-vs-3-legged-oauth/

Answer 2

You will need to use a SERVICE ACCOUNT. Basically you are hard coding access to this account into your server application. Then you use sharing to give access to the to account for the content you want. For example you can share a Google Doc or an Analytics profile with the SERVICE ACCOUNT.

Here is a complete example implementation of setting up a service account, logging and and then using it.

Updated 2018-12-12: https://gist.github.com/fulldecent/6728257