Menyiapkan User Invitation API

Halaman ini menjelaskan cara menyiapkan Cloud Identity User Invitation API.

Mengaktifkan API dan menyiapkan kredensial

  1. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  2. Enable the Cloud Identity API, if it is not already enabled.

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

    Enable the API

  3. Create a service account:

    1. Ensure that you have the Create Service Accounts IAM role (roles/iam.serviceAccountCreator) and the Project IAM Admin role (roles/resourcemanager.projectIamAdmin). Learn how to grant roles.

    2. In the Google Cloud console, go to the Create service account page.

      Go to Create service account
    3. Select your project.

    4. In the Service account name field, enter a name. The Google Cloud console fills in the Service account ID field based on this name.

      In the Service account description field, enter a description. For example, Service account for quickstart.

    5. Click Create and continue.

    6. Grant the Service Account Token Creator role to the service account.

      To grant the role, find the Select a role list, then select Service Account Token Creator.

    7. Click Continue.

    8. Click Done to finish creating the service account.

Menginstal library klien Python

Untuk menginstal library klien Python, jalankan perintah berikut:

  pip install --upgrade google-api-python-client google-auth \
    google-auth-oauthlib google-auth-httplib2

Untuk mengetahui informasi selengkapnya tentang cara menyiapkan lingkungan pengembangan Python, lihat Panduan Penyiapan Lingkungan Pengembangan Python.

Mengautentikasi dan membuat instance klien

Untuk memanggil User Invitation API sebagai akun layanan, Anda harus menggunakan delegasi tingkat domain (DWD). Anda dapat mengautentikasi akun layanan menggunakan Kredensial Default Aplikasi (ADC) atau kunci akun layanan.

Untuk melakukan autentikasi sebagai administrator tanpa DWD, gunakan kredensial OAuth 2.0 pengguna akhir dengan cakupan https://www.googleapis.com/auth/cloud-identity.userinvitations. Untuk informasi selengkapnya, lihat Menggunakan OAuth 2.0 untuk aplikasi server web.

Menyiapkan delegasi tingkat domain

Untuk menggunakan delegasi tingkat domain, Anda harus memberikan otoritas kepada akun layanan untuk meniru identitas administrator. Log audit menampilkan tindakan akun layanan apa pun sebagai pengguna yang ditiru identitasnya.

Untuk mengetahui petunjuknya, lihat Mendelegasikan otoritas di seluruh domain ke akun layanan Anda.

Untuk mengizinkan akun layanan, berikan cakupan berikut:

  • https://www.googleapis.com/auth/cloud-identity.userinvitations

Membuat instance klien

Untuk membuat instance klien, pilih metode autentikasi. Sebaiknya gunakan Kredensial Default Aplikasi (ADC) jika kode Anda berjalan di Google Cloud atau menggunakan Workload Identity Federation.

ADC 

from google.auth import iam
from google.auth.transport import requests
import google.auth
from google.oauth2 import service_account

INITIAL_SCOPES = ['https://www.googleapis.com/auth/iam']
CI_SCOPES = ['https://www.googleapis.com/auth/cloud-identity.userinvitations']
TOKEN_URI = "https://accounts.google.com/o/oauth2/token"

def create_delegated_credentials(
  user_email: str
) -> google.auth.credentials.Credentials:
  """Creates delegated credentials for the user.

  Args:
    user_email: The administrator email to call as.

  Returns:
    The delegated credentials for the user.
  """

  # Fetch application default credentials (ADC)
  credentials, _ = google.auth.default(scopes=INITIAL_SCOPES)

  # Populate account information
  request = requests.Request()
  credentials.refresh(request)

  # Create an IAM signer
  signer = iam.Signer(request, credentials,
                      credentials.service_account_email)

  # Create domain-wide delegated (DWD) credentials
  delegated_credentials = service_account.Credentials(
      signer=signer,
      service_account_email=credentials.service_account_email,
      token_uri=TOKEN_URI,
      scopes=CI_SCOPES,
      subject=user_email
  )

  return delegated_credentials

Kunci akun layanan 

from google.oauth2 import service_account
import googleapiclient.discovery

SCOPES = ['https://www.googleapis.com/auth/cloud-identity.userinvitations']
SERVICE_ACCOUNT_FILE = '/path/to/service-account-file.json'

def create_service():
  credentials = service_account.Credentials.from_service_account_file(
    SERVICE_ACCOUNT_FILE, scopes=SCOPES)
  delegated_credentials = credentials.with_subject('user@altostrat.com')

  service_name = 'cloudidentity'
  api_version = 'v1'
  service = googleapiclient.discovery.build(
    service_name,
    api_version,
    credentials=delegated_credentials)

  return service

Setelah menjalankan kode ini, Anda dapat mulai melakukan panggilan ke User Invitation API.

Langkah berikutnya