.net - Access Gmail's IMAP using AssertionFlowClient and service account -
is possible use assertionflowclient , service account access mailbox of user in domain through imap. same 2-legged oauth 1.0.
here's code:
x509certificate2 certificate = new x509certificate2(...) authorizationserverdescription server = new authorizationserverdescription {...}; list<string> scope = new list<string> { "https://mail.google.com/", "https://www.googleapis.com/auth/userinfo#email" }; assertionflowclient provider = new assertionflowclient(server, certificate) { serviceaccountid = service_account_email, scope = string.join(" ",scope.toarray()), }; iauthorizationstate grantedaccess = assertionflowclient.getstate(provider); accesstoken = grantedaccess.accesstoken; using (imap client = new imap()) { client.connectssl("imap.gmail.com"); client.loginoauth2("user@mydomain.com", accesstoken); ... }
i'm able retrieve valid accesstoken accounts.google.com server (although assertionflowclient/dotnetopenauth has bug , use debugger , watch window retrieve it).
i'm sure accesstoken correct, can query www.googleapis.com/userinfo/email api endpoint using - returns same value service_account_email.
gmail's imap server returns following error however:
{"status":"400","schemes":"bearer","scope":"https://mail.google.com/"}
"manage api client access" service account configured "email (read/write/send) https://mail.google.com/" on cpanel.
assertionflowclient/dotnetopenauth bug indicates no-one has ever tried this.
is possible @ all?
so seems google forgot include little detail in documentation:
assertionflowclient provider = new assertionflowclient(server, certificate) { serviceaccountid = service_account_email, scope = "https://mail.google.com/", serviceaccountuser = "user@mydomain.com", // <- important };
it seems requesting access multiple scopes (space separated) fails.
Comments
Post a Comment