Configurazione dell'API Devices

In questa pagina viene spiegato come configurare l'API Cloud Identity Devices.

Attivazione dell'API e configurazione delle credenziali

1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

   Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

   Go to project selector

3. Make sure that billing is enabled for your Google Cloud project.

4. Enable the Cloud Identity API.

   Enable the API

5. Create a service account:

   1. In the Google Cloud console, go to the Create service account page.

      Go to Create service account
   2. Select your project.

   3. In the Service account name field, enter a name. The Google Cloud console fills in the Service account ID field based on this name.

      In the Service account description field, enter a description. For example, Service account for quickstart.

   4. Click Create and continue.

   5. Grant the Project > Owner role to the service account.

      To grant the role, find the Select a role list, then select Project > Owner.

      Note: The Role field affects which resources the service account can access in your project. You can revoke these roles or grant additional roles later. In production environments, do not grant the Owner, Editor, or Viewer roles. Instead, grant a predefined role or custom role that meets your needs.
   6. Click Continue.

   7. Click Done to finish creating the service account.

      Do not close your browser window. You will use it in the next step.

6. Create a service account key:

   1. In the Google Cloud console, click the email address for the service account that you created.
   2. Click Keys.
   3. Click Add key, and then click Create new key.
   4. Click Create. A JSON key file is downloaded to your computer.
   5. Click Close.

7. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

   Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

   Go to project selector

8. Make sure that billing is enabled for your Google Cloud project.

9. Enable the Cloud Identity API.

   Enable the API

10. Create a service account:

    1. In the Google Cloud console, go to the Create service account page.

       Go to Create service account
    2. Select your project.

    3. In the Service account name field, enter a name. The Google Cloud console fills in the Service account ID field based on this name.

       In the Service account description field, enter a description. For example, Service account for quickstart.

    4. Click Create and continue.

    5. Grant the Project > Owner role to the service account.

       To grant the role, find the Select a role list, then select Project > Owner.

       Note: The Role field affects which resources the service account can access in your project. You can revoke these roles or grant additional roles later. In production environments, do not grant the Owner, Editor, or Viewer roles. Instead, grant a predefined role or custom role that meets your needs.
    6. Click Continue.

    7. Click Done to finish creating the service account.

       Do not close your browser window. You will use it in the next step.

11. Create a service account key:

    1. In the Google Cloud console, click the email address for the service account that you created.
    2. Click Keys.
    3. Click Add key, and then click Create new key.
    4. Click Create. A JSON key file is downloaded to your computer.
    5. Click Close.

Autenticazione come account di servizio con delega a livello di dominio

Se sei un amministratore che gestisce i gruppi di identità o se vuoi fornire a un account i privilegi a livello di dominio in modo che possa gestire Google Gruppi per conto degli amministratori, devi autenticarti come account di servizio e poi concedergli i privilegi a livello di dominio.

Nota: poiché la delega a livello di dominio funziona consentendo all'account di servizio di assumere il ruolo di un utente amministratore, i log di controllo mostreranno le azioni dell'account di servizio come se fossero state eseguite dall'utente.

Per informazioni dettagliate sulla configurazione della delega a livello di dominio, consulta Controllare l'accesso all'API con la delega a livello di dominio.

Per eseguire l'autenticazione come account di servizio, consulta Utilizzo di OAuth 2.0 per applicazioni da server a server. Quando si inizializza la credenziale nel codice, specifica l'indirizzo e-mail su che l'account di servizio agisce chiamando with_subject() sulla credenziale. Ad esempio:

Python

credentials = service_account.Credentials.from_service_account_file(
  SERVICE_ACCOUNT_FILE, scopes=SCOPES).with_subject(delegated_email)

Associazione di un client

L'esempio seguente mostra come creare un'istanza di un client utilizzando le credenziali dell'account di servizio. Per eseguire l'autenticazione come utente finale, sostituisci l'oggetto credential dell'account di servizio con il credential ottenuto in precedenza nell'articolo Utilizzare OAuth 2.0 per applicazioni server web.

Python

from google.oauth2 import service_account
import googleapiclient.discovery

SCOPES = ['https://www.googleapis.com/auth/cloud-identity.devices']
SERVICE_ACCOUNT_FILE = '/path/to/service-account-file.json'

def create_service():
  credentials = service_account.Credentials.from_service_account_file(
    SERVICE_ACCOUNT_FILE, scopes=SCOPES)
  delegated_credentials = credentials.with_subject('[e-mail]')

  service_name = 'cloudidentity'
  api_version = 'v1'
  service = googleapiclient.discovery.build(
    service_name,
    api_version,
    credentials=credentials)

  return service

Ora puoi iniziare a effettuare chiamate all'API Devices.

Installazione della libreria client Python

Per installare la libreria client Python, esegui questo comando:

  pip install --upgrade google-api-python-client google-auth \
    google-auth-oauthlib google-auth-httplib2

Per ulteriori informazioni sulla configurazione dell'ambiente di sviluppo Python, consulta la Guida alla configurazione dell'ambiente di sviluppo Python.