Cannot get oAuth2 Access Token for Google Analytics API

Question

I am using Rails + Garb Gem (Sija Branch) + omniauth-google-oauth2 Gem and I can successfully authenticate with the Google Analytics API and extract data that our app is generating when using a user login, e.g.:

Garb::Session.login('USERNAME', '<PASSWORD>')

I can then use Garb to connect to the Analytics Profile I want and pull the data from it and display some charts on a webpage. This all works fine.

However, I want to use oAuth2 to authenticate with Analytics which is why I had to install the Sija branch of the Garb Gem from Github (it supports oAuth2) and I also installed the omniauth-google-oauth2 Gem. Now in theory I should be able to authenticate using the following code:

Garb::Session.access_token = access_token # an instance of OAuth2::Client

It's at this point that it gets a little hazy for me and I would greatly appreciate some guidance. Here's how far I have gotten:

1) I created a Project in the Google API console and turned on Analytics API under Services

2) This provided me with a Client ID and Client Secret

3) I came across this code which I could populate with the ID and Secret above:

client = OAuth2::Client.new(
GOOGLE_CLIENT_ID,
GOOGLE_CLIENT_SECRET,
{
    :site          => 'https://accounts.google.com',
    :authorize_url => '/o/oauth2/auth',
    :token_url     => '/o/oauth2/token'
})

4) Then there is the next bit of code:

response = OAuth2::AccessToken.new(
    client,
    STORED_TOKEN, {
    refresh_token: STORED_REFRESH_TOKEN,
    expires_at: STORED_EXPIRES_AT
})

5) and then in theory connect with:

Garb::Session.access_token = response

The problem I have is I don't have the token information in Point (4) above. It seems to me that with oAuth2 I need to do a "handshake" once and print out the return token values? Perhaps through Rails code which prints the values returned out and then paste the token values into a constant in the Rails app so that I can use them in the above code? I really am confused. As I mentioned earlier, the web app works fine using the user login authentication. All the web app is doing is authenticating with analytics, pulling down some data and drawing a chart. But I am stuck converting it over to oAuth2 as I just do not know how to get the Access Token that the Garb Gem is looking for. I should also note that this is not a public website with multiple users authenticating, this is a CMS website that is connecting to our own Analytics data.

I have seen some partial snippets of aspects of this but not a fully explained or working example. I would really appreciate any guidance and help with this question.

Many thanks in advance,

JR

Answer 1

I've soldiered through this over the last few weeks, so let me share what worked:

To use Oauth2 you need to get a 'refresh token' that you use to 're-authenticate' with google each time you make an API call. The steps for this are as follows:

1) Setup your account in the API console - https://code.google.com/apis/console/b/0/ (seems like you've done that well) 2) In your API account, make sure you have a redirect URI pointing back to your application:

http://some-url.com/auth/google_oauth2/callback
http://localhost:3000/auth/google_oauth2/callback

Note here that google won't let you call back to your local machine as 0.0.0.0:3000... so you'll need to use localhost explicitly

3) In your route file, tie that redirect url to an action in the controller where you're going to create the project or authentication

match '/auth/:provider/callback' => 'authentications#create'

The ':provider' simply lets you match on multiple types of oauth, but you could just put 'google_oauth2' there as well.

4) Now create that action in your controller

def create
  auth = request.env["omniauth.auth"] 
  params = request.env["omniauth.params"]
  project = Project.find(params['project_id'])

  Authentication.create(:project_id => project.id, :provider => auth['provider'], :uid => auth['uid'], :access_token => auth['credentials']['refresh_token'])
  flash[:notice] = "Authentication successful."
  redirect_to owner_view_project_path(project)
end

5) The controller action should retrieve the relevant fields from the response object (details of response object here: https://github.com/zquestz/omniauth-google-oauth2) - in particular, you need to get the 'refresh_token' and save that to your project or authentication object - if you haven't added an 'access_token' attribute to the desired object, go do that now with a migration, then start saving the refresh token to that attribute

6) Now when you're ready to call that particular authentication and get API data for it, you can load up that object where you saved the access token, and use that to get a new session with the google API as follows:

  @authentication = Authentications.find(params[:id])

  client = OAuth2::Client.new GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET,
                                  {
                                    :site => 'https://accounts.google.com',
                                    :authorize_url => "/o/oauth2/auth",
                                    :token_url => "/o/oauth2/token",
                                  }
  response = OAuth2::AccessToken.from_hash(client, :refresh_token => @authentication.access_token).refresh!
  Garb::Session.access_token = response
  @profiles = Garb::Management::Profile.all

What this code did was create an OAuth2 access token (response) by specifying the client and then a refresh_token, then calling 'refresh!' to get a refreshed access token... then use that access token to establish your Garb session, then call down all the profiles for a given account using the Gard::Management::Profile.all

Hope this helps - let me know if you have questions!

Answer 2

Just a note on what worked for me in:

For steps 3, 4 & 5 I used cURL instead to retrieve the Access/Refresh token. Step 6 is then the same for me (using the Sija branch of the Garb Gem). So using cURL:

Using the details associated with your Google app POST the following using cURL:

curl --data "code=<APP_CODE>&redirect_uri=http://localhost:3000/oauth2callback&client_id=<CLIENT_ID>.apps.googleusercontent.com&scope=&client_secret=<CLIENT_SECRET>&grant_type=authorization_code" https://accounts.google.com/o/oauth2/token

The response takes the form:

{
  "access_token" : "<ACCESS_TOKEN>",
  "token_type" : "Bearer",
  "expires_in" : 3600,
  "refresh_token" : "<REFRESH_TOKEN>"
}

which you can plug into the Garb Gem as per part 6.

Answer 3

The answer by @CamNorgate is valid.

If you don't have a "refresh_token" back from Omniauth on the callback make sure you are correctly initializing :google_oauth2

Rails.application.config.middleware.use OmniAuth::Builder do
  provider :google_oauth2, ENV["GOOGLE_CLIENT_ID"], ENV["GOOGLE_CLIENT_SECRET"],
    { :scope=>"https://www.google.com/m8/feeds, https://www.googleapis.com/auth/userinfo.email, https://www.googleapis.com/auth/userinfo.profile",
      :approval_prompt=>"force", access_type="offline"
    }

end

Make sure to include :approval_prompt=>"force", access_type="offline" in order for the refresh_token to be sent back. The refresh_token is only provided on the first authorization from the user.