3

I have:

// package com.google.auth.oauth2;
UserAuthorizer userAuthorizer = 
       UserAuthorizer.newBuilder()
            .setClientId(of(clientId, clientSecret))
            .setCallbackUri(create(callbackUri))
            .setScopes(asList(scopes))
            .build();

then I am able to do:

userAuthorizer.getCredentialsFromCode(authorizationCode, create(baseUri)).getRefreshToken();

(This is oauth flow initiated from client side through oauth2 dialog and providing accessing access code)

I have difficulty finding how from that standpoint I can get something like UserInfo (profile picture and / or email)?

NenadP
  • 585
  • 7
  • 24
  • Did you check solution from https://stackoverflow.com/questions/22516693/how-to-get-user-profile-on-google-api-using-the-java-library? – saver Feb 28 '21 at 03:09

1 Answers1

1

Short answer: You can't. Because User Information has nothing to do with OAuth2.

Actually it looks like:

User <-> Client <-> Remote OAuth2 Server <-> Remote App

You might confuse Client with User here. The Client might e.g. be a Third Party Provider which acts as a broker between a User and the App. From an OAuth2-POV the ClientId and ClientSecret thus have nothing to do with any actual User. The Tokens (Refresh or Access) are just so that the Client can tell the remote server, that it (the Client) really is who it says it is and the server can verify this claim.

The Access token received from the Remote OAuth2 Server will then allow your User to access certain EndPoints at the Remote App, by including the Access token in the Request (usually body or header, depending on API implementation). This is, because your Client has identified itself to the Remote OAuth2 Server.

Sorin
  • 977
  • 3
  • 12
  • Hey @Sonin, I understand the distinction, and you explain it well. But, for sure we can make a call to the api on behalf of user once we have refresh token. For example, using above refresh token I can create AdWordsSession to create a credential and call AdWords api for, say, list of Campaigns (for Customer). I am puzzled what api do I call and how to make use of refresh token to get user info, similar how on Facebook api you can query 'me' endpoint to get details of the user. I can demonstrate how I do that in case of Adwords but it won't look nice in the comment. – NenadP Feb 23 '21 at 18:40