Making changes to your data and accessing private data will require the passing of an authentication token with your requests. You need to make use of the AuthSub Interface to acquire a token.
Acquiring and manipulating tokens
The workflow of the AuthSub authentication process is nicely summarised by Google:
AuthSubRequest - Request an authentication token
-
//Once the request is authenticated, AuthSub will redirect the user to this page.
-
$callback_url = urlencode('<a href="http://www.mysite.com/calendar.php" class="linkification-ext" title="Linkification: http://www.mysite.com/calendar.php">http://www.mysite.com/calendar.php</a>');
-
//Indicate for which objects or scope you wish to be authenticated for
-
$scope = urlencode('<a href="http://www.google.com/calendar/feeds/yourgoogleacct%40gmail.com/private/full" class="linkification-ext" title="Linkification: http://www.google.com/calendar/feeds/yourgoogleacct%40gmail.com/private/full">http://www.google.com/calendar/feeds/yourgoogleacct%40gmail.com/private/full</a>');
-
//Set to 1 if you have a registered application and wish to issue a secure token
-
$secure = 0;
-
//1 - the one-time-use token may be exchanged for a session token; 0 - cannot be exchanged
-
$session = 1;
-
-
//Call the URL:
-
$url = "<a href="https://www.google.com/accounts/AuthSubRequest?next=$callback_url&scope=$scope&secure=$secure&session=$session" class="linkification-ext" title="Linkification: https://www.google.com/accounts/AuthSubRequest?next=$callback_url&scope=$scope&secure=$secure&session=$session">https://www.google.com/accounts/AuthSubRequest?next=$callback_url&scope=$scope&secure=$secure&session=$session</a>");
-
exit;
The user will be taken to a login screen hosted on Google's end, where they will have to provide their credentials. If successful, they will be redirected back to the callback URL with a 'token' parameter in the URL's query string.
-
$authsub_token = $_GET['token'];
AuthSubSessionToken - acquire a session token
The token returned above is for one-time-use. If you are going to be making multiple token requests, it is more efficient to convert the one-time-use token to a long-lived session token.
Call AuthSubSessionToken using an HTTP GET request to https://www.google.com/accounts/AuthSubSessionToken. The request must also contain an Authorization header.
If the request is successful, Google responds with an HTTP 200 message. The response header will contain the token in the form
Token=ASDF...8976
AuthSubTokenInfo - check the status of a given token
You can check on the status of a token by making an HTTP GET request to https://www.google.com/accounts/AuthSubTokenInfo. The request must also contain an Authorization header.
The successful HTTP 200 response will give you 3 pieces of key information:
Target=http://www.mysite.com
Scope=http://www.google.com/calendar/feeds/yourgoogleacct%40gmail.com/private/full
Secure=true
AuthSubRevokeToken - revoke an active token
At the time of writing, session tokens do not have an expiration time. There may be cases (e.g. security has been compromised, user no longer wishes to use your service) where you wish to revoke a token.
Make an HTTP GET request to https://www.google.com/accounts/AuthSubRevokeToken. The request must also contain an Authorization header.
If the request is successful you will receive an HTTP 200 message.
Things to keep in mind
At the time of writing, Google will only issue 10 session tokens per site per scope. This means you should keep track of, via a database, your users' tokens. They can be re-used each time the user logs in to your application. If you do not wish to store your users' tokens, and wish them to reauthenticate with Google each time they visit your application, be sure to revoke the tokens whenever they log our or if there is a period of inactivity.
Using the Zend Framework
More comprehensive examples and explanations are available here.
AuthSubRequest
-
$scope = 'http://www.google.com/calendar/feeds/yourgoogleacct%40gmail.com/private/full';
-
$secure = 0;
-
$session = 1;
-
-
$googleURI = Zend_Gdata_AuthSub::getAuthSubTokenUri($callback_url, $scope, $secure, $session);
-
-
echo "<a href=\"$googleURI\">Click here to authorise this application to access your calendar</a>";
AuthSubToken
-
$session_token = Zend_Gdata_AuthSub::getAuthSubSessionToken($token);
Making use of your token
-
//Once you have the token you can create an authenticated HTTP Client to communicate with Google
-
$client = Zend_Gdata_AuthSub::getHttpClient($token);
-
-
//Create a Gdata object using the authenticated client
-
$cal = new Zend_Gdata_Calendar($client);
AuthSubRevokeToken
-
Zend_Gdata_AuthSub::AuthSubRevokeToken($token);
