How can I pass custom information from an App Engine Authenticator to the Endpoint?

Question

I am referencing @MinWan 's awesome answer in this post Google Cloud Endpoints and user's authentication, where he describes a way to add custom headers to a request against App Engine's Cloud Endpoints.

It becomes clear that we can add a custom header and write an authenticator per each service (e.g. Google, Twitter, Facebook) against which we want to authenicate, where each authenticator reads a specific header and authenticates against the service. If the token is valid, a service typically returns a response with an email address or user id, plus some extra information [A], from which we generate a com.google.api.server.spi.auth.common.User, which is later passed into the endpoint method as com.google.appengine.api.users.User.

First question: Why do we have two different User entities, e.g. users with different namespaces? As it seems, these are neither sub/superclasses, so they are possibly explicitly cast behind the scenes.

Second question: The problem that comes with the explicitly cast User entity and that there is no custom field where I could put the extra information [A] returned by the service, is that the extra information is lost. Such extra information may be helpful for matching the oauth2 user of the external service to a local user or to oauth2 users returned by other services.

Any input? What's the suggested way of handling multiple authentication services?

Answer 1

Just tested, and you can definitely subclass User to contain whichever private fields you want. Just use class inheritance polymorphism to return an object of that type from the Authenticator method, without changing the type from default User in the method signature.

import javax.servlet.http.HttpServletRequest;
import com.google.api.server.spi.auth.common.User;
import com.google.api.server.spi.config.Authenticator;

public class BazUser extends User {
        private String secret; // extra piece of data held by this User
        public BazUser(String email) {
                super(email);
                this.secret = "notasecret";
        }
        public BazUser (String email, String secret) {
                super (email);
                this.secret = secret;
        }
}

public class BazAuthenticator implements Authenticator {
        public User authenticate(HttpServletRequest req) {
                return new BazUser ("userid@baz.com", "secret");
        }
}

Answer 2

Functionally, everything works with:

import com.google.api.server.spi.auth.common.User;

even with gradle:

compile 'com.google.endpoints:endpoints-framework:2.0.0-beta.11'

The IDE warning can be cleared by including @SuppressWarnings("ResourceParameter") as follows:

/**
 * Adds a new PmpUser.
 *
 * @param pmpUser  pmpUser object
 */
@SuppressWarnings("ResourceParameter")
@ApiMethod(
        name = "pmpUser.post",
        path = "pmpUser",
        httpMethod = ApiMethod.HttpMethod.POST)
...