Google Authentication Extension

Get an access token

In the following example, the extension's getOauth2AccessToken action retrieves a token for use in requests to the Cloud Translation API.

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<ConnectorCallout async="false" continueOnError="true" enabled="true" name="Get-Access-Token">
    <DisplayName>Get Access Token</DisplayName>
    <Connector>google-auth</Connector>
    <Action>getOauth2AccessToken</Action>
    <Input><![CDATA[{
      "scope" : [
        "https://www.googleapis.com/auth/cloud-translation"
      ]
    }]]></Input>
    <Output>google.credentials</Output>
</ConnectorCallout>

The response value looks something like this:

{
  "access_token":"ya29.c.ElpSB...BMgkALBJ0kou-8",
  "token_type":"Bearer",
  "expiresInSec": 3600
}

The following AssignMessage policy retrieves the response value from the ExtensionCallout policy above and copies it in the response payload. This can be useful for debugging. In actual practice, you might not want to return the token to the client.

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<AssignMessage async="false" continueOnError="false" enabled="true" name="Retrieve-Auth-Token">
    <DisplayName>Retrieve Auth Token</DisplayName>
    <AssignTo type="response" createNew="false"/>
    <Set>
        <Payload contentType="application/json">{google.credentials.access_token}</Payload>
    </Set>
</AssignMessage>

Cache an access token

To avoid making unnecessary calls to retrieve a token, consider caching the token you receive. For subsquent calls requiring a token, retrieving the token from the Apigee Edge cache will be faster than getting a new token. When the cached token expires, retrieve a new token and refresh the cache with it.

The following code from an example API proxy illustrate how to set and use a cached token to call the Google Translation API with a ServiceCallout policy. Each code example here is for a different policy in the flow.

The following policies are executed in the sequence described by the following flow XML:

  <Request>
    <!-- Attempt to get a token from the cache. -->
    <Step>
        <Name>Get-Cached-Auth-Token</Name>
    </Step>
    <!-- Only execute the following ExtensionCallout policy if the call to the
      cache couldn't retrieve a cached token. -->
    <Step>
        <Name>Google-Auth-Callout</Name>
        <Condition>lookupcache.Get-Cached-Auth-Token.cachehit is false</Condition>
    </Step>
    <!-- Only execute the following PopulateCache policy if the call to the
      cache couldn't retrieve a cached token. -->
    <Step>
        <Name>Cache-Auth-Token</Name>
        <Condition>lookupcache.Get-Cached-Auth-Token.cachehit is false</Condition>
    </Step>
    <!-- Use the ServiceCallout policy to call the translate API. -->
    <Step>
        <Name>Translate-Text</Name>
    </Step>
</Request>

1. The following LookupCache policy attempts to get a token from the cache. If the token has already been obtained and cached, this policy will get it for use by the API proxy.

     <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
     <LookupCache async="false" continueOnError="false" enabled="true" name="Get-Cached-Auth-Token">
         <DisplayName>Get Cached Auth Token</DisplayName>
         <!-- Give cache key and scope to specify the entry for the cached token. -->
         <CacheKey>
             <Prefix/>
             <KeyFragment>gcp_translate_token_</KeyFragment>
         </CacheKey>
         <Scope>Exclusive</Scope>
         <!-- Assign the retrieved token (if any) to a variable, where it
          can be retrieved by policies. -->
         <AssignTo>cloud.translation.auth.token</AssignTo>
     </LookupCache>
   

2. If the cache lookup doesn't retrieve a cached token, the following ExtensionCallout policy retrieves a new OAuth token, specifying the Google Cloud Translation API as the scope for the token. Google Cloud returns a valid token if the service account credentials used when configuring the Google-Auth-Callout extension represent a project member that has access to the API.

     <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
     <ConnectorCallout async="false" continueOnError="true" enabled="true" name="Google-Auth-Callout">
         <DisplayName>Google-Auth-Callout</DisplayName>
         <Connector>example-auth-extension</Connector>
         <Action>getOauth2AccessToken</Action>
         <Input><![CDATA[{
           "scope" : ["https://www.googleapis.com/auth/cloud-translation"]
         }]]></Input>
         <Output parsed="false">cloud.translation.auth.token</Output>
     </ConnectorCallout>
   

3. After the ExtensionCallout policy has retrieved a new token, the PopulateCache policy caches it for use later by policies in the API proxy.

     <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
     <PopulateCache async="false" continueOnError="false" enabled="true" name="Cache-Auth-Token">
         <DisplayName>Cache Auth Token</DisplayName>
         <Properties/>
         <!-- Set cache key information to specify a unique key for this entry. -->
         <CacheKey>
             <Prefix/>
             <KeyFragment>gcp_translate_token_</KeyFragment>
         </CacheKey>
         <Scope>Exclusive</Scope>
         <ExpirySettings>
             <TimeoutInSec>5</TimeoutInSec>
         </ExpirySettings>
         <!-- Get the token to cache from the variable where the ExtensionCallout put it. -->
         <Source>cloud.translation.auth.token</Source>
     </PopulateCache>
   

Syntax

<Action>getOauth2AccessToken</Action>
<Input><![CDATA[{
  "scope" : [
    "scope1",
    "scope2"
  ]
}]]></Input>

Example

In the following example, the extension's getOauth2AccessToken action retrieves a token for use in requests to the Cloud Translation API.

<Action>getOauth2AccessToken</Action>
<Input><![CDATA[{
    "scope" : [
      "https://www.googleapis.com/auth/cloud-translation"
  ]
}]]></Input>

Syntax

<Action>getJWTAccessToken</Action>
<Input><![CDATA[{
    "audience" : "audience"
}]]></Input>

Example: Cloud Function URL

In the following example, the extension's getOauth2AccessToken action retrieves a token for use in requests to the Cloud Translation API.

<Action>getJWTAccessToken</Action>
<Input><![CDATA[{
  "audience" : "https://YOUR_REGION-YOUR_PROJECT_ID.cloudfunctions.net/FUNCTION_NAME"
}]]></Input>

Example: Cloud IAP-secured client ID

In the following example, the extension's getOauth2AccessToken action retrieves a token for use in requests to the Cloud Translation API.

<Action>getJWTAccessToken</Action>
<Input><![CDATA[{
  "audience" : "Cloud-IAP-secured-client-ID"
}]]></Input>