设置 User Invitation API

本页面介绍了如何设置 Cloud Identity User Invitation API。

启用 API 并设置凭证

  1. 登录您的 Google Cloud 账号。如果您是 Google Cloud新手，请 创建一个账号来评估我们的产品在实际场景中的表现。新客户还可获享 $300 赠金，用于运行、测试和部署工作负载。

  2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  3. Enable the Cloud Identity API, if it is not already enabled.

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

    Enable the API

  4. Create a service account:

    1. Ensure that you have the Create Service Accounts IAM role (roles/iam.serviceAccountCreator) and the Project IAM Admin role (roles/resourcemanager.projectIamAdmin). Learn how to grant roles.

    2. In the Google Cloud console, go to the Create service account page.

      Go to Create service account
    3. Select your project.

    4. In the Service account name field, enter a name. The Google Cloud console fills in the Service account ID field based on this name.

      In the Service account description field, enter a description. For example, Service account for quickstart.

    5. Click Create and continue.

    6. Grant the Service Account Token Creator role to the service account.

      To grant the role, find the Select a role list, then select Service Account Token Creator.

    7. Click Continue.

    8. Click Done to finish creating the service account.

  5. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  6. Enable the Cloud Identity API, if it is not already enabled.

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

    Enable the API

  7. Create a service account:

    1. Ensure that you have the Create Service Accounts IAM role (roles/iam.serviceAccountCreator) and the Project IAM Admin role (roles/resourcemanager.projectIamAdmin). Learn how to grant roles.

    2. In the Google Cloud console, go to the Create service account page.

      Go to Create service account
    3. Select your project.

    4. In the Service account name field, enter a name. The Google Cloud console fills in the Service account ID field based on this name.

      In the Service account description field, enter a description. For example, Service account for quickstart.

    5. Click Create and continue.

    6. Grant the Service Account Token Creator role to the service account.

      To grant the role, find the Select a role list, then select Service Account Token Creator.

    7. Click Continue.

    8. Click Done to finish creating the service account.

安装 Python 客户端库

如需安装 Python 客户端库，请运行以下命令：

  pip install --upgrade google-api-python-client google-auth \
    google-auth-oauthlib google-auth-httplib2

如需详细了解如何设置 Python 开发环境，请参阅 Python 开发环境设置指南。

对客户端进行身份验证并实例化

如需以服务账号身份调用 User Invitation API，您必须使用全网域委派 (DWD)。您可以使用应用默认凭证 (ADC) 或服务账号密钥对服务账号进行身份验证。

如需在不使用 DWD 的情况下以管理员身份进行身份验证，请改用具有 https://www.googleapis.com/auth/cloud-identity.userinvitations 范围的最终用户 OAuth 2.0 凭据。如需了解详情，请参阅针对 Web 服务器应用使用 OAuth 2.0。

设置全网域授权

如需使用全网域授权，您必须向服务账号授予模拟管理员的权限。审核日志会将任何服务账号操作显示为模拟的用户。

如需查看相关说明，请参阅向服务账号授予全网域权限。

如需向服务账号授权，请提供以下范围：

  • https://www.googleapis.com/auth/cloud-identity.userinvitations

实例化客户端

如需实例化客户端，请选择一种身份验证方法。如果您的代码在Google Cloud 上运行或使用工作负载身份联合，我们建议您使用应用默认凭据 (ADC)。

ADC 

from google.auth import iam
from google.auth.transport import requests
import google.auth
from google.oauth2 import service_account

INITIAL_SCOPES = ['https://www.googleapis.com/auth/iam']
CI_SCOPES = ['https://www.googleapis.com/auth/cloud-identity.userinvitations']
TOKEN_URI = "https://accounts.google.com/o/oauth2/token"

def create_delegated_credentials(
  user_email: str
) -> google.auth.credentials.Credentials:
  """Creates delegated credentials for the user.

  Args:
    user_email: The administrator email to call as.

  Returns:
    The delegated credentials for the user.
  """

  # Fetch application default credentials (ADC)
  credentials, _ = google.auth.default(scopes=INITIAL_SCOPES)

  # Populate account information
  request = requests.Request()
  credentials.refresh(request)

  # Create an IAM signer
  signer = iam.Signer(request, credentials,
                      credentials.service_account_email)

  # Create domain-wide delegated (DWD) credentials
  delegated_credentials = service_account.Credentials(
      signer=signer,
      service_account_email=credentials.service_account_email,
      token_uri=TOKEN_URI,
      scopes=CI_SCOPES,
      subject=user_email
  )

  return delegated_credentials

服务账号密钥

from google.oauth2 import service_account
import googleapiclient.discovery

SCOPES = ['https://www.googleapis.com/auth/cloud-identity.userinvitations']
SERVICE_ACCOUNT_FILE = '/path/to/service-account-file.json'

def create_service():
  credentials = service_account.Credentials.from_service_account_file(
    SERVICE_ACCOUNT_FILE, scopes=SCOPES)
  delegated_credentials = credentials.with_subject('user@altostrat.com')

  service_name = 'cloudidentity'
  api_version = 'v1'
  service = googleapiclient.discovery.build(
    service_name,
    api_version,
    credentials=delegated_credentials)

  return service

运行此代码后，您就可以开始调用 User Invitation API 了。

后续步骤