asp.net-mvc - "Access_Denied"用于谷歌分析

Question

我正在我的 asp.net webapi 2 中实现 oAuth 流。我必须获得用户的许可才能访问他们的 google 分析数据。为此，我在向 google oAuth2.0 流程发送身份验证请求时添加了以下范围。为此，即使用户单击同意屏幕上的“允许访问”按钮，我总是收到“Access_Denied”错误。

如果我不在范围内添加 Google Analytic，相同的代码可以正常工作并获取外部访问 token 。

此外，我还在 Google 开发者控制台中启用了 Google 分析 API。

Google 分析范围:

googleAuthOptions.Scope.Add(AnalyticsService.Scope.Analytics);
googleAuthOptions.Scope.Add(AnalyticsService.Scope.AnalyticsReadonly);
googleAuthOptions.Scope.Add(AnalyticsService.Scope.AnalyticsManageUsers);

WebApi的startup.cs文件中编写的代码:

//Configure Google External Login
GoogleOAuth2AuthenticationOptions googleAuthOptions = new GoogleOAuth2AuthenticationOptions()
{
    ClientId = ConfigurationManager.AppSettings["GoogleClientID"],
    ClientSecret = ConfigurationManager.AppSettings["GoogleClientSecret"],
    Provider = new GoogleAuthProvider()
};

//1st trial=> 
//googleAuthOptions.Scope.Add("https://www.googleapis.com/auth/analytics");

//2nd trial
//googleAuthOptions.Scope.Add(AnalyticsService.Scope.Analytics);
//googleAuthOptions.Scope.Add(AnalyticsService.Scope.AnalyticsReadonly);            
//googleAuthOptions.Scope.Add(AnalyticsService.Scope.AnalyticsManageUsers);

app.UseGoogleAuthentication(googleAuthOptions);

WebAPI Controller [ExternalLogin] 中的方法:

[OverrideAuthentication]    
[HostAuthentication(DefaultAuthenticationTypes.ExternalCookie)]
    [AllowAnonymous]
    [Route("ExternalLogin", Name = "ExternalLogin")]
    public async Task<IHttpActionResult> GetExternalLogin(string provider, string error = null)
    {
        string redirectUri = string.Empty;

        if (error != null)
        {
            return BadRequest(Uri.EscapeDataString(error));
        }

        if (!User.Identity.IsAuthenticated)
        {
            return new ChallengeResult(provider, this);
        }

        var redirectUriValidationResult = ValidateClientAndRedirectUri(this.Request, ref redirectUri);

        if (!string.IsNullOrWhiteSpace(redirectUriValidationResult))
        {
            return BadRequest(redirectUriValidationResult);
        }

        ExternalLoginData externalLogin = ExternalLoginData.FromIdentity(User.Identity as ClaimsIdentity);

        if (externalLogin == null)
        {
            return InternalServerError();
        }

        if (externalLogin.LoginProvider != provider)
        {
            Authentication.SignOut(DefaultAuthenticationTypes.ExternalCookie);
            return new ChallengeResult(provider, this);
        }

        //IdentityUser user = await _repo.FindAsync(new UserLoginInfo(externalLogin.LoginProvider, externalLogin.ProviderKey));

        int profileID = Convert.ToInt32(HttpContext.Current.Request.QueryString["profile_id"]);

        var user = new UserRepository().SearchProfileByID(profileID);

        bool hasRegistered = user != null;

        redirectUri = string.Format("{0}#external_access_token={1}&provider={2}&haslocalaccount={3}&external_user_name={4}",
                                        redirectUri,
                                        externalLogin.ExternalAccessToken,
                                        externalLogin.LoginProvider,
                                        hasRegistered.ToString(),
                                        externalLogin.UserName);

        return Redirect(redirectUri);

    }

我已关注this实现 oAuth 功能的链接。

请帮我解决这个问题。

谢谢

Answer 1

终于我的问题得到了解决，我们还需要添加“电子邮件”范围。我添加了以下 2 个范围以使其正常工作:

googleAuthOptions.Scope.Add("email");  
googleAuthOptions.Scope.Add("https://www.googleapis.com/auth/analytics.readonly");

现在，这将返回具有 google analytic api 访问权限的外部 token

谢谢

维杰