Configurer l'API Devices

Cette page explique comment configurer l'API Devices de Cloud Identity.

Activer l'API et configurer des identifiants

1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

   Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

   Go to project selector

3. Make sure that billing is enabled for your Google Cloud project.

4. Enable the Cloud Identity API.

   Enable the API

5. Create a service account:

   1. In the Google Cloud console, go to the Create service account page.

      Go to Create service account
   2. Select your project.

   3. In the Service account name field, enter a name. The Google Cloud console fills in the Service account ID field based on this name.

      In the Service account description field, enter a description. For example, Service account for quickstart.

   4. Click Create and continue.

   5. Grant the Project > Owner role to the service account.

      To grant the role, find the Select a role list, then select Project > Owner.

      Note: The Role field affects which resources the service account can access in your project. You can revoke these roles or grant additional roles later. In production environments, do not grant the Owner, Editor, or Viewer roles. Instead, grant a predefined role or custom role that meets your needs.
   6. Click Continue.

   7. Click Done to finish creating the service account.

      Do not close your browser window. You will use it in the next step.

6. Create a service account key:

   1. In the Google Cloud console, click the email address for the service account that you created.
   2. Click Keys.
   3. Click Add key, and then click Create new key.
   4. Click Create. A JSON key file is downloaded to your computer.
   5. Click Close.

7. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

   Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

   Go to project selector

8. Make sure that billing is enabled for your Google Cloud project.

9. Enable the Cloud Identity API.

   Enable the API

10. Create a service account:

    1. In the Google Cloud console, go to the Create service account page.

       Go to Create service account
    2. Select your project.

    3. In the Service account name field, enter a name. The Google Cloud console fills in the Service account ID field based on this name.

       In the Service account description field, enter a description. For example, Service account for quickstart.

    4. Click Create and continue.

    5. Grant the Project > Owner role to the service account.

       To grant the role, find the Select a role list, then select Project > Owner.

       Note: The Role field affects which resources the service account can access in your project. You can revoke these roles or grant additional roles later. In production environments, do not grant the Owner, Editor, or Viewer roles. Instead, grant a predefined role or custom role that meets your needs.
    6. Click Continue.

    7. Click Done to finish creating the service account.

       Do not close your browser window. You will use it in the next step.

11. Create a service account key:

    1. In the Google Cloud console, click the email address for the service account that you created.
    2. Click Keys.
    3. Click Add key, and then click Create new key.
    4. Click Create. A JSON key file is downloaded to your computer.
    5. Click Close.

Authentification en tant que compte de service avec délégation au niveau du domaine

Si vous êtes administrateur en charge de la gestion des groupes d'identités ou si vous souhaitez fournir à un compte des droits relatifs à l'ensemble du domaine lui permettant de gérer les Google Groupes pour le compte des administrateurs, vous devez vous authentifier en tant que compte de service puis lui accorder les privilèges au niveau du domaine.

Remarque : Étant donné que la délégation au niveau du domaine fonctionne en permettant au compte de service d'emprunter l'identité d'un administrateur, les journaux d'audit affichent toutes les actions du compte de service en tant qu'utilisateur.

Pour en savoir plus sur la configuration de la délégation au niveau du domaine, consultez la page Contrôler l'accès à l'API à l'aide de la délégation au niveau du domaine.

Pour en savoir plus sur l'authentification en tant que compte de service, consultez l'article Utiliser OAuth 2.0 pour les applications de serveur à serveur. Lors de l'initialisation de l'identifiant dans votre code, spécifiez l'adresse e-mail avec laquelle le compte de service agit en appelant with_subject() sur l'identifiant. Exemple :

Python

credentials = service_account.Credentials.from_service_account_file(
  SERVICE_ACCOUNT_FILE, scopes=SCOPES).with_subject(delegated_email)

Instancier un client

L'exemple suivant montre comment instancier un client à l'aide des identifiants d'un compte de service. Pour vous authentifier en tant qu'utilisateur final, remplacez l'objet credential du compte de service par l'objet credential que vous avez obtenu précédemment dans Utiliser OAuth 2.0 pour les applications de serveur Web.

Python

from google.oauth2 import service_account
import googleapiclient.discovery

SCOPES = ['https://www.googleapis.com/auth/cloud-identity.devices']
SERVICE_ACCOUNT_FILE = '/path/to/service-account-file.json'

def create_service():
  credentials = service_account.Credentials.from_service_account_file(
    SERVICE_ACCOUNT_FILE, scopes=SCOPES)
  delegated_credentials = credentials.with_subject('[e-mail]')

  service_name = 'cloudidentity'
  api_version = 'v1'
  service = googleapiclient.discovery.build(
    service_name,
    api_version,
    credentials=credentials)

  return service

Vous pouvez maintenant commencer à appeler l'API Devices.

Installer la bibliothèque cliente Python

Pour installer la bibliothèque cliente Python, exécutez la commande suivante :

  pip install --upgrade google-api-python-client google-auth \
    google-auth-oauthlib google-auth-httplib2

Pour savoir comment configurer votre environnement de développement Python, consultez le guide de configuration d'un environnement de développement Python.