使用 OAuth 連結 Google 帳戶

帳戶連結使用業界標準 OAuth 2.0 隱含與授權碼流程。您的服務必須支援符合 OAuth 2.0 規定的授權和憑證交換端點。

In the implicit flow, Google opens your authorization endpoint in the user's browser. After successful sign in, you return a long-lived access token to Google. This access token is now included in every request sent from Google.

In the authorization code flow, you need two endpoints:

  • The authorization endpoint, which presents the sign-in UI to your users that aren't already signed in. The authorization endpoint also creates a short-lived authorization code to record users' consent to the requested access.

  • The token exchange endpoint, which is responsible for two types of exchanges:

    1. Exchanges an authorization code for a long-lived refresh token and a short-lived access token. This exchange happens when the user goes through the account linking flow.
    2. Exchanges a long-lived refresh token for a short-lived access token. This exchange happens when Google needs a new access token because the one it had expired.

Choose an OAuth 2.0 flow

Although the implicit flow is simpler to implement, Google recommends that access tokens issued by the implicit flow never expire. This is because the user is forced to link their account again after a token expires with the implicit flow. If you need token expiration for security reasons, we strongly recommend that you use the authorization code flow instead.

Design guidelines

This section describes the design requirements and recommendations for the user screen that you host for OAuth linking flows. After it's called by Google's app, your platform displays a sign in to Google page and account linking consent screen to the user. The user is directed back to Google's app after giving their consent to link accounts.

This figure shows the steps for a user to link their Google account to your authentication system. The first screenshot shows user-initiated linking from your platform. The second image shows user sign-in to Google, while the third shows the user consent and confirmation for linking their Google account with your app. The final screenshot shows a successfully linked user account in the Google app.
Figure 1. Account linking user sign in to Google and consent screens.

Requirements

  1. You must communicate that the user’s account will be linked to Google, not a specific Google product like Google Home or Google Assistant.

Recommendations

We recommend that you do the following:

  1. Display Google's Privacy Policy. Include a link to Google’s Privacy Policy on the consent screen.

  2. Data to be shared. Use clear and concise language to tell the user what data of theirs Google requires and why.

  3. Clear call-to-action. State a clear call-to-action on your consent screen, such as “Agree and link.” This is because users need to understand what data they're required to share with Google to link their accounts.

  4. Ability to cancel. Provide a way for users to go back or cancel, if they choose not to link.

  5. Clear sign-in process. Ensure that users have clear method for signing in to their Google account, such as fields for their username and password or Sign in with Google.

  6. Ability to unlink. Offer a mechanism for users to unlink, such as a URL to their account settings on your platform. Alternatively, you can include a link to Google Account where users can manage their linked account.

  7. Ability to change user account. Suggest a method for users to switch their account(s). This is especially beneficial if users tend to have multiple accounts.

    • If a user must close the consent screen to switch accounts, send a recoverable error to Google so the user can sign in to the desired account with OAuth linking and the implicit flow.

  8. Include your logo. Display your company logo on the consent screen. Use your style guidelines to place your logo. If you wish to also display Google's logo, see Logos and trademarks.

Create the project

To create your project to use account linking:

  1. Go to the Google API Console.
  2. 單擊創建項目 。
  3. 輸入名稱或接受生成的建議。
  4. 確認或編輯所有剩餘字段。
  5. 點擊創建 。

要查看您的項目ID：

  1. Go to the Google API Console.
  2. 在登錄頁面的表格中找到您的項目。項目ID出現在ID列中。

The Google Account Linking process includes a consent screen which tells users the application requesting access to their data, what kind of data they are asking for and the terms that apply. You will need to configure your OAuth consent screen before generating a Google API client ID.

  1. Open the OAuth consent screen page of the Google APIs console.
  2. If prompted, select the project you just created.

  3. On the "OAuth consent screen" page, fill out the form and click the “Save” button.

    Application name: The name of the application asking for consent. The name should accurately reflect your application and be consistent with the application name users see elsewhere. The application name will be shown on the Account Linking consent screen.

    Application logo: An image on the consent screen that will help users recognize your app. The logo is shown on Account linking consent screen and on account settings

    Support email: For users to contact you with questions about their consent.

    Scopes for Google APIs: Scopes allow your application to access your user's private Google data. For the Google Account Linking use case, default scope (email, profile, openid) is sufficient, you don’t need to add any sensitive scopes. It is generally a best practice to request scopes incrementally, at the time access is required, rather than up front. Learn more.

    Authorized domains: To protect you and your users, Google only allows applications that authenticate using OAuth to use Authorized Domains. Your applications' links must be hosted on Authorized Domains. Learn more.

    Application Homepage link: Home page for your application. Must be hosted on an Authorized Domain.

    Application Privacy Policy link: Shown on Google Account Linking consent screen. Must be hosted on an Authorized Domain.

    Application Terms of Service link (Optional): Must be hosted on an Authorized Domain.

    Figure 1. Google Account Linking Consent Screen for a fictitious Application, Tunery

  4. Check "Verification Status", if your application needs verification then click the "Submit For Verification" button to submit your application for verification. Refer to OAuth verification requirements for details.

實作 OAuth 伺服器

為了支持OAuth 2.0已隱含流，你的服務使可通過HTTPS授權端點。此端點負責身份驗證並獲得用戶對數據訪問的同意。授權端點向尚未登錄的用戶顯示登錄 UI，並記錄對請求訪問的同意。

當 Google 應用程序需要調用您的服務的授權 API 之一時，Google 會使用此端點來獲得您的用戶的許可，以代表他們調用這些 API。

一個典型的由 Google 發起的 OAuth 2.0 隱式流會話具有以下流程：

  1. Google 在用戶的瀏覽器中打開您的授權端點。用戶登錄（如果尚未登錄）並授予 Google 使用您的 API 訪問其數據的權限（如果他們尚未授予權限）。
  2. 您的服務創建的訪問令牌並將其返回給谷歌。為此，請使用附加到請求的訪問令牌將用戶的瀏覽器重定向回 Google。
  3. Google 會調用您服務的 API 並在每個請求中附加訪問令牌。您的服務會驗證訪問令牌授予 Google 訪問 API 的授權，然後完成 API 調用。

處理授權請求

當 Google 應用程序需要通過 OAuth 2.0 隱式流程執行帳戶鏈接時，Google 會將用戶發送到您的授權端點，並包含以下參數的請求：

授權端點參數
client_id您分配給 Google 的客戶端 ID。
redirect_uri您向其發送對此請求的響應的 URL。
state傳遞回 Google 的簿記值在重定向 URI 中保持不變。
response_type要在響應中返回的值的類型。對於的OAuth 2.0隱式流程中，響應類型總是token 。
user_locale在谷歌帳戶語言設置RFC5646格式用於本地化用戶的首選語言內容。

例如，如果您的授權端點可在https://myservice.example.com/auth ，請求看起來像下面這樣：

GET https://myservice.example.com/auth?client_id=GOOGLE_CLIENT_ID&redirect_uri=REDIRECT_URI&state=STATE_STRING&response_type=token&user_locale=LOCALE

對於處理登錄請求的授權端點，請執行以下步驟：

  1. 驗證client_id和redirect_uri值，以防止授權訪問意外或錯誤配置的客戶端應用程序：

    • 確認該client_id你分配給谷歌的客戶ID相匹配。
    • 確認URL指定由redirect_uri參數有以下形式：
      https://oauth-redirect.googleusercontent.com/r/YOUR_PROJECT_ID
https://oauth-redirect-sandbox.googleusercontent.com/r/YOUR_PROJECT_ID

  2. 檢查用戶是否已登錄您的服務。如果用戶未登錄，請完成服務的登錄或註冊流程。

  3. 生成供 Google 用來訪問您的 API 的訪問令牌。訪問令牌可以是任何字符串值，但它必須唯一地代表該令牌所針對的用戶和客戶端，並且不能被猜測。

  4. 發送用戶的瀏覽器重定向到被指定的URL的HTTP響應redirect_uri參數。在 URL 片段中包含以下所有參數：

    • access_token ：剛才生成的令牌，你的訪問
    • token_type ：字符串bearer
    • state ：從原始請求的未修改的狀態值

    以下是所得的URL的一個示例：

    https://oauth-redirect.googleusercontent.com/r/YOUR_PROJECT_ID#access_token=ACCESS_TOKEN&token_type=bearer&state=STATE_STRING

谷歌的OAuth 2.0重定向處理接收的令牌的訪問並確認state的值並沒有改變。在 Google 為您的服務獲取訪問令牌後，Google 會將令牌附加到對您的服務 API 的後續調用中。

Handle userinfo requests

The userinfo endpoint is an OAuth 2.0 protected resource that return claims about the linked user. Implementing and hosting the userinfo endpoint is optional, except for the following use cases:

After the access token has been successfully retrieved from your token endpoint, Google sends a request to your userinfo endpoint to retrieve basic profile information about the linked user.

userinfo endpoint request headers
Authorization header The access token of type Bearer.

For example, if your userinfo endpoint is available at https://myservice.example.com/userinfo, a request might look like the following:

GET /userinfo HTTP/1.1
Host: myservice.example.com
Authorization: Bearer ACCESS_TOKEN

For your userinfo endpoint to handle requests, do the following steps:

  1. Extract access token from the Authorization header and return information for the user associated with the access token.
  2. If the access token is invalid, return an HTTP 401 Unauthorized error with using the WWW-Authenticate Response Header. Below is an example of a userinfo error response: 
    HTTP/1.1 401 Unauthorized
WWW-Authenticate: error="invalid_token",
error_description="The Access Token expired"
    If a 401 Unauthorized, or any other unsuccessful error response is returned during the linking process, the error will be non-recoverable, the retrieved token will be discarded and the user will have to initiate the linking process again.

  3. If the access token is valid, return and HTTP 200 response with the following JSON object in the body of the HTTPS response: 

    {
"sub": "USER_UUID",
"email": "EMAIL_ADDRESS",
"given_name": "FIRST_NAME",
"family_name": "LAST_NAME",
"name": "FULL_NAME",
"picture": "PROFILE_PICTURE",
}
    If your userinfo endpoint returns an HTTP 200 success response, the retrieved token and claims are registered against the user's Google account.

    userinfo endpoint response
    sub A unique ID that identifies the user in your system.
    email Email address of the user.
    given_name Optional: First name of the user.
    family_name Optional: Last name of the user.
    name Optional: Full name of the user.
    picture Optional: Profile picture of the user.

驗證實作

您可以通過使用驗證實現的OAuth 2.0遊樂場工具。

在工具中，執行以下步驟：

  1. 單擊配置打開的OAuth 2.0配置窗口。
  2. 在OAuth流場中，選擇客戶端。
  3. 在OAuth端點字段中，選擇自定義。
  4. 在相應字段中指定您的 OAuth 2.0 端點和您分配給 Google 的客戶端 ID。
  5. 在步驟1部分，不要選擇任何谷歌範圍。相反，將此字段留空或鍵入對您的服務器有效的範圍（如果不使用 OAuth 範圍，則輸入任意字符串）。當您完成後，單擊授權的API。
  6. 在步驟2和步驟3段，完成OAuth 2.0流程和驗證每個步驟按預期工作。

您可以通過驗證您的實現谷歌帳戶鏈接演示工具。

在工具中，執行以下步驟：

  1. 點擊登錄在與谷歌按鈕。
  2. 選擇您要關聯的帳戶。
  3. 輸入服務標識。
  4. （可選）輸入您將請求訪問的一個或多個範圍。
  5. 單擊開始演示。
  6. 出現提示時，確認您可以同意並拒絕鏈接請求。
  7. 確認您被重定向到您的平台。