Question

I want to list calendar events using new Calendar API v3. I have read that article (Calendar API v3, 2-legged OAuth & Java) and I did authentication in same way. Please see my factory:

import java.io.IOException;

import com.gene.herder.google.GoogleApiSettings;
import com.google.api.client.auth.oauth.OAuthHmacSigner;
import com.google.api.client.auth.oauth.OAuthParameters;
import com.google.api.client.http.HttpTransport;
import com.google.api.client.http.javanet.NetHttpTransport;
import com.google.api.client.json.jackson2.JacksonFactory;
import com.google.api.services.calendar.Calendar;
import com.google.api.services.calendar.Calendar.Builder;
import com.google.api.services.calendar.CalendarRequest;
import com.google.api.services.calendar.CalendarRequestInitializer;

public final class CalendarApiFactory {

    private GoogleApiSettings settings;

    public CalendarApi createCalendarApi() {
        Calendar calendar = createBuilder(settings).build();

        CalendarApi calendarApi = new CalendarApi();
        calendarApi.setCalendar(calendar);
        return calendarApi;
    }

    private Builder createBuilder(GoogleApiSettings settings) {
        HttpTransport transport = new NetHttpTransport();
        JacksonFactory jsonFactory = new JacksonFactory();

        OAuthParameters oauthParameters = createOAuthParameters(settings);

        Builder builder = new Builder(transport, jsonFactory, oauthParameters);
        builder.setApplicationName("MY-COMPANY-MY-APP/1.0");
        builder.setCalendarRequestInitializer(new SettingsCalendarRequestInitializer(settings));
        return builder;
    }

    private OAuthParameters createOAuthParameters(GoogleApiSettings settings) {
        OAuthParameters oauthParameters = new OAuthParameters();
        oauthParameters.version = "1";
        oauthParameters.consumerKey = settings.getClientKey();
        oauthParameters.signer = createSigner(settings);
        return oauthParameters;
    }

    private OAuthHmacSigner createSigner(GoogleApiSettings settings) {
        OAuthHmacSigner signer = new OAuthHmacSigner();
        signer.clientSharedSecret = settings.getClientSecret();
        return signer;
    }

    public void setSettings(GoogleApiSettings settings) {
        this.settings = settings;
    }
}

class SettingsCalendarRequestInitializer extends CalendarRequestInitializer {

    private GoogleApiSettings settings;

    public SettingsCalendarRequestInitializer(GoogleApiSettings settings) {
        this.settings = settings;
    }

    @Override
    protected void initializeCalendarRequest(CalendarRequest<?> request) throws IOException {
        request.setKey(settings.getApiKey());
    }
}

After that I implemented CalendarApi in this way:

import java.io.IOException;

import com.google.api.client.util.ArrayMap;
import com.google.api.services.calendar.Calendar;
import com.google.api.services.calendar.Calendar.Events.Insert;
import com.google.api.services.calendar.Calendar.Events.List;
import com.google.api.services.calendar.model.Event;
import com.google.api.services.calendar.model.Events;

public class CalendarApi {

    private Calendar calendar;

    public Events listEvents(String calendarId) throws IOException {
        // Add the xoauth_requestor_id query parameter to let the API know
        // on behalf of which user the request is being made.
        ArrayMap<String, Object> customKeys = new ArrayMap<String, Object>();
        customKeys.add("xoauth_requestor_id", calendarId);

        List events = calendar.events().list("primary");
        events.setUnknownKeys(customKeys);
        return events.execute();
    }

    public void setCalendar(Calendar calendar) {
        this.calendar = calendar;
    }
}

My domain configuration looks like this:
Advanced Tools => Manage third party OAuth Client access

and my Console APIs looks like this:

Now if I invoke my listEvents method with “[e-mail]” parameter everything works OK. I can see all events from specified calendar.

But in the case when I pass any other domain user I get “Invalid Credentials” exception all the time. Stacktrace:

com.google.api.client.googleapis.json.GoogleJsonResponseException: 401 Unauthorized
{
  "code" : 401,
  "errors" : [ {
    "domain" : "global",
    "location" : "Authorization",
    "locationType" : "header",
    "message" : "Invalid Credentials",
    "reason" : "authError"
  } ],
  "message" : "Invalid Credentials"
}
    at com.google.api.client.googleapis.json.GoogleJsonResponseException.from(GoogleJsonResponseException.java:143) ~[google-api-client-1.13.2-beta.jar:1.13.2-beta]
    at com.google.api.client.googleapis.services.json.AbstractGoogleJsonClientRequest.newExceptionOnError(AbstractGoogleJsonClientRequest.java:115) ~[google-api-client-1.13.2-beta.jar:1.13.2-beta]
    at com.google.api.client.googleapis.services.json.AbstractGoogleJsonClientRequest.newExceptionOnError(AbstractGoogleJsonClientRequest.java:40) ~[google-api-client-1.13.2-beta.jar:1.13.2-beta]
    at com.google.api.client.googleapis.services.AbstractGoogleClientRequest$1.interceptResponse(AbstractGoogleClientRequest.java:309) ~[google-api-client-1.13.2-beta.jar:1.13.2-beta]
    at com.google.api.client.http.HttpRequest.execute(HttpRequest.java:1090) ~[google-http-client-1.13.1-beta.jar:1.13.1-beta]
    at com.google.api.client.googleapis.services.AbstractGoogleClientRequest.executeUnparsed(AbstractGoogleClientRequest.java:407) ~[google-api-client-1.13.2-beta.jar:1.13.2-beta]
    at com.google.api.client.googleapis.services.AbstractGoogleClientRequest.executeUnparsed(AbstractGoogleClientRequest.java:340) ~[google-api-client-1.13.2-beta.jar:1.13.2-beta]
    at com.google.api.client.googleapis.services.AbstractGoogleClientRequest.execute(AbstractGoogleClientRequest.java:458) ~[google-api-client-1.13.2-beta.jar:1.13.2-beta]
    at com.gene.herder.google.calendar.CalendarApi.listEvents(CalendarApi.java:31) ~[CalendarApi.class:na]

My maven dependencies looks like this:

<!-- Google API -->
<dependency>
  <groupId>com.google.apis</groupId>
  <artifactId>google-api-services-calendar</artifactId>
  <version>v3-rev22-1.13.2-beta</version>
</dependency>
<dependency>
  <groupId>com.google.http-client</groupId>
  <artifactId>google-http-client-jackson2</artifactId>
  <version>1.13.1-beta</version>
</dependency>
<dependency>
  <groupId>com.google.oauth-client</groupId>
  <artifactId>google-oauth-client-jetty</artifactId>
  <version>1.13.1-beta</version>
</dependency>

Why it doesn’t work? I thought I can use that API for any user I want. Where I have made mistake?

Answer 1

We have to enable Two-legged OAuth access control option in CPanel. With this option API works OK.
You can find this option on:
Advanced Tools => Manage OAuth domain key => Two-legged OAuth access control