{"id":13446,"date":"2016-03-04T17:20:13","date_gmt":"2016-03-04T13:20:13","guid":{"rendered":"http:\/\/www.msp360.com\/blog\/?p=13446"},"modified":"2022-06-20T17:38:58","modified_gmt":"2022-06-20T13:38:58","slug":"explaining-google-cloud-storage-authentication","status":"publish","type":"post","link":"https:\/\/www.msp360.com\/resources\/blog\/explaining-google-cloud-storage-authentication\/","title":{"rendered":"Explaining Google Cloud Storage Authentication"},"content":{"rendered":"<p>Today we are going to talk about authentication and authorization with OAuth 2.0 protocol that is used by Google and many other services. By means of it, services and applications like MSP360 Explorer can get access to third-party systems with no need to disclose user logins and passwords.<br \/>\nThe information described in this post will prove useful when using any modern web-services. But we will consider the specifics of Google Cloud Storage authentication.<br \/>\n<!--more--><\/p>\n<h2>Google Cloud Storage Authentication<\/h2>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-13457 aligncenter\" src=\"https:\/\/www.msp360.com\/resources\/wp-content\/uploads\/2016\/03\/Google-Cloud-Storage-logo-authentication.png\" alt=\"Google Cloud Storage logo authentication\" width=\"729\" height=\"365\" srcset=\"https:\/\/www.msp360.com\/resources\/wp-content\/uploads\/2016\/03\/Google-Cloud-Storage-logo-authentication.png 729w, https:\/\/www.msp360.com\/resources\/wp-content\/uploads\/2016\/03\/Google-Cloud-Storage-logo-authentication-300x150.png 300w, https:\/\/www.msp360.com\/resources\/wp-content\/uploads\/2016\/03\/Google-Cloud-Storage-logo-authentication-624x312.png 624w\" sizes=\"auto, (max-width: 729px) 100vw, 729px\" \/><\/p>\n<p>To get access to files in Google Cloud Storage a user shall confirm its identity (authenticate) and access rights (authorize). And here are a few mechanisms implemented for this purpose:<\/p>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li>\u00a0\u2014 the most progressive option and we will consider it later.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>&lt;ligsutil\u00a0\u2014 authentication by means of the utility having the same name. It provides an algorithm similar to OAuth (the password is entered on a special external site, the authorization code is received and then it is exchanged for an access token) but here all actions are manual.<\/p>\n<ul>\n<li>Client Library\u00a0\u2014 a method used to test the product or work with general information that does not depend on the user. You just use Google Application Default Credentials like Network Service account in the Windows environment.<\/li>\n<li>Cookie-Based \u2014\u00a0An excellent option to provide a browser-based access to files for selected users. All links are publicly available but you can specify e-mails having read and write rights. In this case, when the user makes an attempt to load something, it will be offered to authenticate on a Google page.<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p>Most mechanisms have their drawbacks that limit their application area or make their implementation complicated. That\u2019s why it is recommended to use OAuth 2.0 whenever possible.<\/p>\n<h2>What is Google OAuth 2.0<\/h2>\n<p>Generally, OAuth was developed for those who are tired of registering on innumerable websites and forums and who is not ready to risk security for the sake of convenience. This standard provides a service or application with a possibility to verify your identity and check credentials without an access to the user password.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-13451 aligncenter\" src=\"https:\/\/www.msp360.com\/resources\/wp-content\/uploads\/2016\/03\/Google-Account-Sign-In-Screen-Authentication.png\" alt=\"Google Account Sign-In Screen Authentication\" width=\"635\" height=\"417\" srcset=\"https:\/\/www.msp360.com\/resources\/wp-content\/uploads\/2016\/03\/Google-Account-Sign-In-Screen-Authentication.png 635w, https:\/\/www.msp360.com\/resources\/wp-content\/uploads\/2016\/03\/Google-Account-Sign-In-Screen-Authentication-300x197.png 300w, https:\/\/www.msp360.com\/resources\/wp-content\/uploads\/2016\/03\/Google-Account-Sign-In-Screen-Authentication-624x410.png 624w\" sizes=\"auto, (max-width: 635px) 100vw, 635px\" \/><\/p>\n<p>It means that you can be authenticated by any website after entering your password on a Google special protected webpage. In addition, in a similar way you can provide the application with access to your own information in a cloud. To get access to resources, the authorized application uses an access token that is transferred as an HTTPS request via an SSL encrypted channel.<\/p>\n<h2>OAuth &amp; Google Storage<\/h2>\n<p>Let\u2019s consider the operation of OAuth through the example of Google Cloud Storage.<\/p>\n<p>Several authorization scenarios for web-servers, applications, and devices having no physical keyboard are supported in OAuth. All of them are united by the following algorithm:<\/p>\n<ol>\n<li>An application with the support of OAuth (for example, MSP360 Explorer) provides Google authentication server with rights to work with it. Usually, it is a public key generally embedded into the source code.<\/li>\n<li>Receipt of an application authorization code. This code is attached to the user account and is provided by Google when the user confirms its intent on a special webpage. Surely, you could often see a popup window offering to authorize a Google application on your smartphone \u2013 that\u2019s it.<\/li>\n<li>Then the application sends the authorization code to Google Storage API and exchanges it for a personal access token which has rights to certain Google objects.<\/li>\n<\/ol>\n<p>The list of requested access rights is created in the Scope parameter on the second step. Look at the picture below \u2014 Google depicted the whole process.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-13449 aligncenter\" src=\"https:\/\/www.msp360.com\/resources\/wp-content\/uploads\/2016\/03\/List-of-requested-access-rights-Google-Cloud-Storage.png\" alt=\"List-of-requested-access-rights-Google-Cloud-Storage\" width=\"364\" height=\"377\" srcset=\"https:\/\/www.msp360.com\/resources\/wp-content\/uploads\/2016\/03\/List-of-requested-access-rights-Google-Cloud-Storage.png 364w, https:\/\/www.msp360.com\/resources\/wp-content\/uploads\/2016\/03\/List-of-requested-access-rights-Google-Cloud-Storage-290x300.png 290w\" sizes=\"auto, (max-width: 364px) 100vw, 364px\" \/><\/p>\n<p>There are also niceties with access token expiration but their solution is transparent for users and it extends beyond this article.<\/p>\n<h2>The Role of Service Account<\/h2>\n<p>Google cloud systems can authenticate both users and applications. The second option can be applied in cases when the service must run regardless of the user password and activity. If you ever customized separate accounts for applications on a Windows server \u2013 it\u2019s just about the same.<\/p>\n<p>To delegate cloud access to the application, it is required to create an account on Google Developers Console. Similarly to a user, the server account will get an e-mail having quite a long prefix and a pair of a public key and a privacy key. These are the data that shall be provided to the application for its operation under Google account.<\/p>\n<p>Look at the picture below \u2014 service account mode just replaces user authorization code with <b>JSON Web Tokens<\/b> (JWT). Also, you have to create a service account and generate JWT on your own.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-13452 aligncenter\" src=\"https:\/\/www.msp360.com\/resources\/wp-content\/uploads\/2016\/03\/Service-account-mode-JSON-web-tokens-scheme.png\" alt=\"Service-account-mode-JSON-web-tokens-scheme\" width=\"325\" height=\"302\" srcset=\"https:\/\/www.msp360.com\/resources\/wp-content\/uploads\/2016\/03\/Service-account-mode-JSON-web-tokens-scheme.png 325w, https:\/\/www.msp360.com\/resources\/wp-content\/uploads\/2016\/03\/Service-account-mode-JSON-web-tokens-scheme-300x279.png 300w\" sizes=\"auto, (max-width: 325px) 100vw, 325px\" \/><\/p>\n<p><b>Note:<\/b> There is a peculiarity with the Service Account and Google Apps admins shall keep it in mind \u2013 domain administrative policies are not applied to these accounts. It means the following: if you prohibit files sharing with the outside world by means of domain policy, this prohibition will not be applied to Service Accounts.<\/p>\n<h2>Conclusion<\/h2>\n<p>With the emergence of <b>OAuth 2.0<\/b> Internet services integration became much easier as the same account can be used to get various resources access without the security losses. The standard is under development now, that\u2019s why it may be required to readjust settings of services running with OAuth in future. But still it\u2019s a good compromise to the equilibrium of versatility, convenience and security.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Today we are going to talk about authentication and authorization with OAuth 2.0 protocol that is used by Google and many other services. By means of it, services and applications like MSP360 Explorer can get access to third-party systems with no need to disclose user logins and passwords. The information described in this post will [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":35016,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[877,885],"tags":[],"class_list":["post-13446","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog-articles","category-other"],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/posts\/13446","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/comments?post=13446"}],"version-history":[{"count":2,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/posts\/13446\/revisions"}],"predecessor-version":[{"id":54258,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/posts\/13446\/revisions\/54258"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/media\/35016"}],"wp:attachment":[{"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/media?parent=13446"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/categories?post=13446"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/tags?post=13446"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}