为什么 ServiceAccountCredential 会因凭据无效而失败？答案

【问题标题】：Why does ServiceAccountCredential fail with invalid credentials?为什么 ServiceAccountCredential 会因凭据无效而失败？
【发布时间】：2015-02-16 18:37:06
【问题描述】：

基于这个先前的问题： where can i find ServiceAccountCredential

我创建了自己的服务帐户，下载了 .p12 密钥，启用了数据存储。

但我仍然收到此错误：

Unhandled Exception: Google.GoogleApiException: Google.Apis.Requests.RequestErro
r
Invalid Credentials [401]
Errors [
        Message[Invalid Credentials] Location[Authorization - header] Reason[aut
hError] Domain[global]
]

   at Google.Apis.Requests.ClientServiceRequest`1.Execute() in c:\code\google.co
m\google-api-dotnet-client\default\Tools\Google.Apis.Release\bin\Debug\test\defa
ult\Src\GoogleApis\Apis\Requests\ClientServiceRequest.cs:line 93
   at TestDotNet.Program.Main(String[] args) in C:\Users\jeff\rgs\udemy\TestDotN
et\Program.cs:line 42

代码如下：

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;

// Install-Package Google.Apis.Datastore.v1beta2
using Google.Apis.Auth.OAuth2;
using Google.Apis.Http;
using Google.Apis.Services;
using Google.Apis.Datastore.v1beta2;
using Google.Apis.Datastore.v1beta2.Data;
using System.Security.Cryptography.X509Certificates;

namespace TestDotNet
{
    class Program
    {
        static void Main(string[] args)
        {
            var certificate = new X509Certificate2(
                @"surferjeffEasyBates-ce8b875830c2.p12",
                "notasecret", X509KeyStorageFlags.Exportable);
            var serviceAccountEmail = "340967622364-pls45ap9lu4u6ivtivpus62tm8sgtodg@developer.gserviceaccount.com";
            ServiceAccountCredential credential = new ServiceAccountCredential(
               new ServiceAccountCredential.Initializer(serviceAccountEmail)
               {
                   Scopes = new[] { DatastoreService.Scope.Datastore }
               }.FromCertificate(certificate));
            var service = new DatastoreService(new BaseClientService.Initializer
            {
                ApplicationName = "surferjeffEasyBates",
                HttpClientInitializer = credential, 
            });
            var lookup_body = new LookupRequest()
            {
                Keys = new Key[] { new Key() { Path = new KeyPathElement[] { new KeyPathElement() {
                    Id = 1,
                    Kind = "Thing"
                }}}}
            };
            var lookup = new DatasetsResource.LookupRequest(service, lookup_body, "surferjeff-easybates");
            var response = lookup.Execute();
            var found = response.Found[0];
            var entity = found.Entity;
        }
    }
}

无论我是在 google 计算引擎实例还是本地机器上运行，我都会遇到同样的错误。

【问题讨论】：

标签： c# google-compute-engine google-api-dotnet-client

【解决方案1】：

您只是缺少 Cloud Datastore 所需的范围。除了数据存储 SCOPE，它还需要 'userinfo.email'

如果您真的想在 GCE 中运行，您可以简单地使用“ComputeCredentials”，如 here 所示。

记得在创建实例时设置数据存储和用户信息范围

按照Google Compute Engine documentation 中启动实例的说明添加并启动 Google Compute Engine 实例。除了项目 ID 和实例名称之外，您还必须指定数据存储和 userinfo.email 范围，如 here 所示。

范围行应如下所示：

Scopes = new[] { DatastoreService.Scope.Datastore ,"https://www.googleapis.com/auth/userinfo.email"}

【讨论】：