Menyiapkan Policy API

Halaman ini menjelaskan cara menyiapkan Cloud Identity Policy API sebelum mencantumkan dan mendapatkan kebijakan.

Instal library klien Python

Untuk menginstal library klien Python, jalankan perintah berikut:

  pip install --upgrade google-api-python-client google-auth \
    google-auth-oauthlib google-auth-httplib2

Untuk mengetahui informasi selengkapnya tentang cara menyiapkan lingkungan pengembangan Python, lihat Panduan Penyiapan Lingkungan Pengembangan Python.

Aktifkan API dan siapkan kredensial akun layanan

  1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.
  2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Go to project selector

  3. Verify that billing is enabled for your Google Cloud project.

  4. Enable the Cloud Identity API.

    Enable the API

  5. Create a service account:

    1. In the Google Cloud console, go to the Create service account page.

      Go to Create service account
    2. Select your project.
    3. In the Service account name field, enter a name. The Google Cloud console fills in the Service account ID field based on this name.

      In the Service account description field, enter a description. For example, Service account for quickstart.

    4. Click Create and continue.
    5. Grant the Project > Owner role to the service account.

      To grant the role, find the Select a role list, then select Project > Owner.

    6. Click Continue.
    7. Click Done to finish creating the service account.

      Do not close your browser window. You will use it in the next step.

  6. Create a service account key:

    1. In the Google Cloud console, click the email address for the service account that you created.
    2. Click Keys.
    3. Click Add key, and then click Create new key.
    4. Click Create. A JSON key file is downloaded to your computer.
    5. Click Close.
  7. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Go to project selector

  8. Verify that billing is enabled for your Google Cloud project.

  9. Enable the Cloud Identity API.

    Enable the API

  10. Create a service account:

    1. In the Google Cloud console, go to the Create service account page.

      Go to Create service account
    2. Select your project.
    3. In the Service account name field, enter a name. The Google Cloud console fills in the Service account ID field based on this name.

      In the Service account description field, enter a description. For example, Service account for quickstart.

    4. Click Create and continue.
    5. Grant the Project > Owner role to the service account.

      To grant the role, find the Select a role list, then select Project > Owner.

    6. Click Continue.
    7. Click Done to finish creating the service account.

      Do not close your browser window. You will use it in the next step.

  11. Create a service account key:

    1. In the Google Cloud console, click the email address for the service account that you created.
    2. Click Keys.
    3. Click Add key, and then click Create new key.
    4. Click Create. A JSON key file is downloaded to your computer.
    5. Click Close.
  12. Melakukan autentikasi sebagai akun layanan dengan delegasi tingkat domain

    Jika Anda adalah administrator yang mengelola kebijakan identitas, atau jika Anda ingin memberikan hak istimewa di seluruh domain kepada akun agar akun tersebut dapat mengelola kebijakan Google atas nama administrator, Anda harus melakukan autentikasi sebagai akun layanan, lalu memberikan hak istimewa di seluruh domain kepada akun layanan tersebut.

    Untuk mengetahui detail tentang cara menyiapkan delegasi tingkat domain, lihat Mengontrol akses API dengan delegasi tingkat domain.

    Untuk melakukan autentikasi sebagai akun layanan, lihat Menggunakan OAuth 2.0 untuk aplikasi server ke server. Saat menginisialisasi kredensial dalam kode, tentukan alamat email yang digunakan akun layanan dengan memanggil with_subject() pada kredensial. Contoh:

    Python

    credentials = service_account.Credentials.from_service_account_file(
      SERVICE_ACCOUNT_FILE, scopes=SCOPES).with_subject(ADMIN_EMAIL)
    

    Contoh kode mendetail untuk memanggil Policy API, termasuk kode untuk autentikasi, disediakan di Mencantumkan dan mendapatkan kebijakan.