带有 ServiceAccount 错误 401 的 Gmail Java API

Question

我正在尝试从后端 java 使用 Gmail API。从我的 Maven 依赖项开始

    <dependency>
        <groupId>com.google.apis</groupId>
        <artifactId>google-api-services-gmail</artifactId>
        <version>v1-rev20200406-1.30.9</version>

    </dependency>
    <dependency>
        <groupId>com.google.auth</groupId>
        <artifactId>google-auth-library-oauth2-http</artifactId>
        <version>0.20.0</version>
    </dependency>  

我从谷歌 API 管理器下载了一个 p12 密钥库并创建了一个服务帐户

PrivateKey key = (PrivateKey)keystore.getKey("privatekey", "somepass".toCharArray()); 
ServiceAccountCredentials serviceAccountCredentials = ServiceAccountCredentials.newBuilder()
                 .setClientEmail("somestuff@developer.gserviceaccount.com")                                                                                         
                 .setServiceAccountUser("somestuff@developer.gserviceaccount.com")                                                                                                
                 .setClientId("somenumber")                                                                                                  
                 .setScopes(SCOPES)                                                                                                  
                 .setPrivateKey(key).build();

现在这似乎工作了

serviceAccountCredentials.refresh();

以

的形式生成令牌

ya29.c.Ko8BygeNYc2Onx2IZpK-ocaHKTiCxOcYYK7nbTg8uE0gyqc8rXROuiVJ7oXCfnYD1pDOyHXiy_K5Eyk3aV3epgjtnr2WVCP_xpWCxq-BExh4i1aIXW9m7gkkUtbteXaD1nETUwIc6n9Uz2oCJSU4jrodFv4n4drxlSGd7my0LcxrMk_E5cFY7jo-Vt40i58g5QY 强>

现在我无法工作的部分

HttpRequestInitializer requestInitializer = new HttpCredentialsAdapter(serviceAccountCredentials);

Gmail service = new Gmail.Builder(new NetHttpTransport(), JacksonFactory.getDefaultInstance(), requestInitializer).setApplicationName(APPLICATION_NAME).build();
Gmail.Users.Labels.List list = service.users().labels().list("b@someemail")
                               .setAccessToken(credential.getAccessToken().getTokenValue());

我也完成了Gmail REST API : 400 Bad Request + Failed Precondition建议的所有gmail配置

但我坚持得到

com.google.api.client.googleapis.json.GoogleJsonResponseException: 401 Unauthorized
{
  "code" : 401,
  "errors" : [ {
    "domain" : "global",
    "location" : "Authorization",
    "locationType" : "header",
    "message" : "Invalid Credentials",
    "reason" : "authError"
  } ],
  "message" : "Invalid Credentials"
}

问候

Answer 1

注意

您正在使用域委托，您应该按照this 指南授权服务帐户在此特定范围内使用 Gmail 服务。

方法

从服务帐户密钥开始创建凭据对象后，只需继续以这种方式创建 Gmail 服务构建器：

private static final JsonFactory JSON_FACTORY = JacksonFactory.getDefaultInstance();
private static final String SERVICE_ACCOUNT_ID = "your-service-account-id";
private static final String APPLICATION_NAME = "your-app-name";

PrivateKey key = (PrivateKey)keystore.getKey("privatekey", "somepass".toCharArray()); 

HttpTransport httpTransport = GoogleNetHttpTransport.newTrustedTransport();

GoogleCredential credential = new GoogleCredential.Builder()
                .setTransport(httpTransport)
                .setJsonFactory(JSON_FACTORY)
                .setServiceAccountId(SERVICE_ACCOUNT_ID)
                .setServiceAccountScopes(SCOPES)
                .setServiceAccountPrivateKey(key)
                .setServiceAccountEmail("user@email")
                .build();

Gmail service =  new Gmail.Builder(httpTransport, JSON_FACTORY, credential)
                .setApplicationName(APPLICATION_NAME).build();

现在您可以直接使用 Gmail 服务，而无需再次指定访问令牌或凭据。就像这样：

ListLabelsResponse listResponse = service.users().labels().list("b@somemail").execute();

参考

Java Gmail

Service Account Java