使用带有 oauth 的 bash curl 返回谷歌应用程序用户帐户数据？ [关闭]

Posted 2023-02-23

【中文标题】使用带有 oauth 的 bash curl 返回谷歌应用程序用户帐户数据？ [关闭]

【英文标题】：Use bash curl with oauth to return google apps user account data? [closed]

【发布时间】：2013-08-17 03:16:09

【问题描述】：

我正在寻找一种相当简单的方法来使用 curl 返回有关 google Apps 中的一批用户帐户（如 createddate 或 lastlogin）的信息。我对 curl 和 Google Apps api 非常缺乏经验。

有没有人知道一篇关于如何使用 curl 和 Oauth 来请求用户帐户数据的很好的介绍性文章？

提前感谢您！

【参考方案1】：

这并不容易实现，因为 Bash 不容易处理 OAuth 2.0 和 JSON。话虽如此，这是一个基本版本，可为您提供所需的数据。 grep 可以使用一些清理，但话又说回来，用 grep 解释 JSON 是 a really bad idea 无论如何。这是为什么Google API Libraries 存在并且应该被使用的一个完美的例子。

# Store our credentials in our home directory with a file called .
my_creds=~/.`basename $0`

# create your own client id/secret
# https://developers.google.com/identity/protocols/OAuth2InstalledApp#creatingcred
client_id='YOUR OWN CLIENT ID'
client_secret='YOUR OWN SECRET'

if [ -s $my_creds ]; then
  # if we already have a token stored, use it
  . $my_creds
  time_now=`date +%s`
else
  scope='https://www.googleapis.com/auth/admin.directory.user.readonly'
  # Form the request URL
  # https://developers.google.com/identity/protocols/OAuth2InstalledApp#step-2-send-a-request-to-googles-oauth-20-server
  auth_url="https://accounts.google.com/o/oauth2/v2/auth?client_id=$client_id&scope=$scope&response_type=code&redirect_uri=urn:ietf:wg:oauth:2.0:oob"

  echo "Please go to:"
  echo
  echo "$auth_url"
  echo
  echo "after accepting, enter the code you are given:"
  read auth_code

  # exchange authorization code for access and refresh tokens
  # https://developers.google.com/identity/protocols/OAuth2InstalledApp#exchange-authorization-code
  auth_result=$(curl -s "https://www.googleapis.com/oauth2/v4/token" \
    -H "Content-Type: application/x-www-form-urlencoded" \
    -d code=$auth_code \
    -d client_id=$client_id \
    -d client_secret=$client_secret \
    -d redirect_uri=urn:ietf:wg:oauth:2.0:oob \
    -d grant_type=authorization_code)
  access_token=$(echo -e "$auth_result" | \
                 grep -Po '"access_token" *: *.*?[^\\]",' | \
                 awk -F'"' ' print $4 ')
  refresh_token=$(echo -e "$auth_result" | \
                  grep -Po '"refresh_token" *: *.*?[^\\]",*' | \
                  awk -F'"' ' print $4 ')
  expires_in=$(echo -e "$auth_result" | \
               grep -Po '"expires_in" *: *.*' | \
               awk -F' ' ' print $3 ' | awk -F',' ' print $1')
  time_now=`date +%s`
  expires_at=$((time_now + expires_in - 60))
  echo -e "access_token=$access_token\nrefresh_token=$refresh_token\nexpires_at=$expires_at" > $my_creds
fi

# if our access token is expired, use the refresh token to get a new one
# https://developers.google.com/identity/protocols/OAuth2InstalledApp#offline
if [ $time_now -gt $expires_at ]; then
  refresh_result=$(curl -s "https://www.googleapis.com/oauth2/v4/token" \
   -H "Content-Type: application/x-www-form-urlencoded" \
   -d refresh_token=$refresh_token \
   -d client_id=$client_id \
   -d client_secret=$client_secret \
   -d grant_type=refresh_token)
  access_token=$(echo -e "$refresh_result" | \
                 grep -Po '"access_token" *: *.*?[^\\]",' | \
                 awk -F'"' ' print $4 ')
  expires_in=$(echo -e "$refresh_result" | \
               grep -Po '"expires_in" *: *.*' | \
               awk -F' ' ' print $3 ' | awk -F',' ' print $1 ')
  time_now=`date +%s`
  expires_at=$(($time_now + $expires_in - 60))
  echo -e "access_token=$access_token\nrefresh_token=$refresh_token\nexpires_at=$expires_at" > $my_creds
fi

# call the Directory API list users endpoint, may be multiple pages
# https://developers.google.com/admin-sdk/directory/v1/reference/users/list
while :
do
  api_data=$(curl -s --get https://www.googleapis.com/admin/directory/v1/users \
    -d customer=my_customer \
    -d prettyPrint=true \
    `if [ -n "$next_page" ]; then echo "-d pageToken=$next_page"; fi` \
    -d maxResults=500 \
    -d "fields=users(primaryEmail,creationTime,lastLoginTime),nextPageToken" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer $access_token")
  echo -e "$api_data" | grep -v 'nextPageToken'
  next_page=$(echo $api_data | \
    grep -Po '"nextPageToken" *: *.*?[^\\]"' | \
    awk -F'"' ' print $4 ')
  if [ -z "$next_page" ]
  then
    break
  fi
done

【讨论】：

谢谢，这对我有帮助，直到我可以花几天时间深入了解 Python 或 Java。

grep 可以在您的脚本中替换为 jq。 jq 虽然不是替代品，但它是 Linux 上的一个实用程序，擅长解析 JSON 格式的文件并提取字段，即 access_token=$(jq ".access_token" ./cachedCredentials.json)

这是一个救生员！太感谢了。在轻量级物联网设备的世界中，我们不能总是依赖打包的库。

【参考方案2】：

谢谢李杰， 我想分享一个修改后的脚本来访问常规用户信息（没有谷歌应用程序）。 请记住在 google API 控制台上打开 Google+ API：

# Store our credentials in our home directory with a file called .<script name>
my_creds=~/.`basename $0`
client_id='********PUT YOURS**********.apps.googleusercontent.com'
client_secret='' # not really a secret
if [ -s $my_creds ]; then
  # if we already have a token stored, use it
  . $my_creds
  time_now=`date +%s`
else
  scope='profile'
  # Form the request URL
  # http://goo.gl/U0uKEb
  auth_url="https://accounts.google.com/o/oauth2/auth?client_id=$client_id&scope=$scope&response_type=code&redirect_uri=urn:ietf:wg:oauth:2.0:oob"

  echo "Please go to:"
  echo
  echo "$auth_url"
  echo
  echo "after accepting, enter the code you are given:"
  read auth_code

  # swap authorization code for access and refresh tokens
  # http://goo.gl/Mu9E5J
  auth_result=$(curl -s https://accounts.google.com/o/oauth2/token \
    -H "Content-Type: application/x-www-form-urlencoded" \
    -d code=$auth_code \
    -d client_id=$client_id \
    -d client_secret=$client_secret \
    -d redirect_uri=urn:ietf:wg:oauth:2.0:oob \
    -d grant_type=authorization_code)
  access_token=$(echo -e "$auth_result" | \
                 grep -Po '"access_token" *: *.*?[^\\]",' | \
                 awk -F'"' ' print $4 ')
  refresh_token=$(echo -e "$auth_result" | \
                  grep -Po '"refresh_token" *: *.*?[^\\]",*' | \
                  awk -F'"' ' print $4 ')
  expires_in=$(echo -e "$auth_result" | \
               grep -Po '"expires_in" *: *.*' | \
               awk -F' ' ' print $3 ' | awk -F',' ' print $1')
  time_now=`date +%s`
  expires_at=$((time_now + expires_in - 60))
  echo -e "access_token=$access_token\nrefresh_token=$refresh_token\nexpires_at=$expires_at" > $my_creds
fi

# if our access token is expired, use the refresh token to get a new one
# http://goo.gl/71rN6V
if [ $time_now -gt $expires_at ]; then
  refresh_result=$(curl -s https://accounts.google.com/o/oauth2/token \
   -H "Content-Type: application/x-www-form-urlencoded" \
   -d refresh_token=$refresh_token \
   -d client_id=$client_id \
   -d client_secret=$client_secret \
   -d grant_type=refresh_token)
  access_token=$(echo -e "$refresh_result" | \
                 grep -Po '"access_token" *: *.*?[^\\]",' | \
                 awk -F'"' ' print $4 ')
  expires_in=$(echo -e "$refresh_result" | \
               grep -Po '"expires_in" *: *.*' | \
               awk -F' ' ' print $3 ' | awk -F',' ' print $1 ')
  time_now=`date +%s`
  expires_at=$(($time_now + $expires_in - 60))
  echo -e "access_token=$access_token\nrefresh_token=$refresh_token\nexpires_at=$expires_at" > $my_creds
fi

# call the Directory API list users endpoint, may be multiple pages
# http://goo.gl/k0jnQJ
  api_data=$(curl -s --get https://www.googleapis.com/plus/v1/people/me \
    -d prettyPrint=true \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer $access_token")
  echo -e "$api_data" 

【讨论】：

这是一个救生员！太感谢了。在轻量级物联网设备的世界中，我们不能总是依赖打包的库。