Configura la API de dispositivos

En esta página, se explica cómo configurar la API de Cloud Identity Devices.

Habilita la API y configura credenciales

1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

   Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

   Go to project selector

3. Make sure that billing is enabled for your Google Cloud project.

4. Enable the Cloud Identity API.

   Enable the API

5. Create a service account:

   1. In the Google Cloud console, go to the Create service account page.

      Go to Create service account
   2. Select your project.

   3. In the Service account name field, enter a name. The Google Cloud console fills in the Service account ID field based on this name.

      In the Service account description field, enter a description. For example, Service account for quickstart.

   4. Click Create and continue.

   5. Grant the Project > Owner role to the service account.

      To grant the role, find the Select a role list, then select Project > Owner.

      Note: The Role field affects which resources the service account can access in your project. You can revoke these roles or grant additional roles later. In production environments, do not grant the Owner, Editor, or Viewer roles. Instead, grant a predefined role or custom role that meets your needs.
   6. Click Continue.

   7. Click Done to finish creating the service account.

      Do not close your browser window. You will use it in the next step.

6. Create a service account key:

   1. In the Google Cloud console, click the email address for the service account that you created.
   2. Click Keys.
   3. Click Add key, and then click Create new key.
   4. Click Create. A JSON key file is downloaded to your computer.
   5. Click Close.

7. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

   Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

   Go to project selector

8. Make sure that billing is enabled for your Google Cloud project.

9. Enable the Cloud Identity API.

   Enable the API

10. Create a service account:

    1. In the Google Cloud console, go to the Create service account page.

       Go to Create service account
    2. Select your project.

    3. In the Service account name field, enter a name. The Google Cloud console fills in the Service account ID field based on this name.

       In the Service account description field, enter a description. For example, Service account for quickstart.

    4. Click Create and continue.

    5. Grant the Project > Owner role to the service account.

       To grant the role, find the Select a role list, then select Project > Owner.

       Note: The Role field affects which resources the service account can access in your project. You can revoke these roles or grant additional roles later. In production environments, do not grant the Owner, Editor, or Viewer roles. Instead, grant a predefined role or custom role that meets your needs.
    6. Click Continue.

    7. Click Done to finish creating the service account.

       Do not close your browser window. You will use it in the next step.

11. Create a service account key:

    1. In the Google Cloud console, click the email address for the service account that you created.
    2. Click Keys.
    3. Click Add key, and then click Create new key.
    4. Click Create. A JSON key file is downloaded to your computer.
    5. Click Close.

Autentica como una cuenta de servicio con delegación de todo el dominio

Si eres un administrador con acceso a grupos de identidad, o si deseas proporcionar una cuenta con privilegios de todo el dominio para que pueda administrar Grupos de Google en nombre de administradores, debes autenticarte como cuenta de servicio y otorgarle los privilegios para todo el dominio.

Nota: Debido a que la delegación de todo el dominio funciona al permitir que la cuenta de servicio robe la identidad de un usuario de administrador, los registros de auditoría mostrarán las acciones de la cuenta de servicio como el usuario.

Para obtener detalles sobre la configuración de la delegación de todo el dominio, consulta Controla el acceso a la API con la delegación de todo el dominio.

Para autenticar como cuenta de servicio, consulta cómo usar OAuth 2.0 para aplicaciones de servidor a servidor. Cuando inicialices la credencial en el código, especifica la dirección de correo electrónico en la que actúa la cuenta de servicio mediante un llamado a with_subject() en la credencial. Por ejemplo:

Python

credentials = service_account.Credentials.from_service_account_file(
  SERVICE_ACCOUNT_FILE, scopes=SCOPES).with_subject(delegated_email)

Crea una instancia de un cliente

En el siguiente ejemplo, se muestra cómo crear una instancia de un cliente mediante las credenciales de la cuenta de servicio. Si quieres autenticarte como usuario final, reemplaza el objeto credential de la cuenta de servicio por la credential que obtuviste antes en Usa OAuth 2.0 para aplicaciones de servidor web.

Python

from google.oauth2 import service_account
import googleapiclient.discovery

SCOPES = ['https://www.googleapis.com/auth/cloud-identity.devices']
SERVICE_ACCOUNT_FILE = '/path/to/service-account-file.json'

def create_service():
  credentials = service_account.Credentials.from_service_account_file(
    SERVICE_ACCOUNT_FILE, scopes=SCOPES)
  delegated_credentials = credentials.with_subject('[e-mail]')

  service_name = 'cloudidentity'
  api_version = 'v1'
  service = googleapiclient.discovery.build(
    service_name,
    api_version,
    credentials=credentials)

  return service

Ahora puedes comenzar a realizar llamadas a la API de dispositivos.

Instala la biblioteca cliente para Python

Para instalar la biblioteca cliente de Python, ejecuta el siguiente comando:

  pip install --upgrade google-api-python-client google-auth \
    google-auth-oauthlib google-auth-httplib2

Para obtener más información sobre la configuración de tu entorno de programación de Python, consulta la Guía de configuración del entorno de desarrollo de Python.