设置 Devices API
本页面介绍如何设置 Cloud Identity Devices API。
启用 API 并设置凭据
- 登录您的 Google Cloud 账号。如果您是 Google Cloud 新手,请创建一个账号来评估我们的产品在实际场景中的表现。新客户还可获享 $300 赠金,用于运行、测试和部署工作负载。
-
In the Google Cloud console, on the project selector page, select or create a Google Cloud project.
-
Enable the Cloud Identity API.
-
Create a service account:
-
In the Google Cloud console, go to the Create service account page.
Go to Create service account - Select your project.
-
In the Service account name field, enter a name. The Google Cloud console fills in the Service account ID field based on this name.
In the Service account description field, enter a description. For example,
Service account for quickstart
. - Click Create and continue.
-
Grant the Project > Owner role to the service account.
To grant the role, find the Select a role list, then select Project > Owner.
- Click Continue.
-
Click Done to finish creating the service account.
Do not close your browser window. You will use it in the next step.
-
-
Create a service account key:
- In the Google Cloud console, click the email address for the service account that you created.
- Click Keys.
- Click Add key, and then click Create new key.
- Click Create. A JSON key file is downloaded to your computer.
- Click Close.
-
In the Google Cloud console, on the project selector page, select or create a Google Cloud project.
-
Enable the Cloud Identity API.
-
Create a service account:
-
In the Google Cloud console, go to the Create service account page.
Go to Create service account - Select your project.
-
In the Service account name field, enter a name. The Google Cloud console fills in the Service account ID field based on this name.
In the Service account description field, enter a description. For example,
Service account for quickstart
. - Click Create and continue.
-
Grant the Project > Owner role to the service account.
To grant the role, find the Select a role list, then select Project > Owner.
- Click Continue.
-
Click Done to finish creating the service account.
Do not close your browser window. You will use it in the next step.
-
-
Create a service account key:
- In the Google Cloud console, click the email address for the service account that you created.
- Click Keys.
- Click Add key, and then click Create new key.
- Click Create. A JSON key file is downloaded to your computer.
- Click Close.
以服务账号身份进行身份验证并进行全网域授权
如果您是管理身份群组的管理员,或者您希望向账号提供全网域权限以使其可以代表管理员管理 Google 群组,则应以服务账号身份进行身份验证,然后向其授予全网域权限。
如需详细了解如何设置全网域授权,请参阅使用全网域授权功能控制 API 访问权限。
如需以服务账号身份进行身份验证,请参阅为“服务器到服务器”应用使用 OAuth 2.0。在代码中初始化凭据时,通过对凭据调用 with_subject()
来指定服务账号要操作的电子邮件地址。例如:
Python
credentials = service_account.Credentials.from_service_account_file(
SERVICE_ACCOUNT_FILE, scopes=SCOPES).with_subject(delegated_email)
实例化客户端
以下示例展示了如何使用服务账号凭据对客户端进行实例化。要改为以最终用户身份进行身份验证,请将服务账号中的 credential
对象替换为您之前在为网络服务器应用使用 OAuth 2.0 中获得的 credential
。
Python
from google.oauth2 import service_account
import googleapiclient.discovery
SCOPES = ['https://www.googleapis.com/auth/cloud-identity.devices']
SERVICE_ACCOUNT_FILE = '/path/to/service-account-file.json'
def create_service():
credentials = service_account.Credentials.from_service_account_file(
SERVICE_ACCOUNT_FILE, scopes=SCOPES)
delegated_credentials = credentials.with_subject('user@example.org')
service_name = 'cloudidentity'
api_version = 'v1'
service = googleapiclient.discovery.build(
service_name,
api_version,
credentials=credentials)
return service
现在,您可以开始调用 Devices API。
安装 Python 客户端库
如需安装 Python 客户端库,请运行以下命令:
pip install --upgrade google-api-python-client google-auth \
google-auth-oauthlib google-auth-httplib2
如需详细了解如何设置 Python 开发环境,请参阅 Python 开发环境设置指南。