How do I use a Service Account to Access the Google Analytics API V3 with .NET C#?

.net, c#, dotnetopenauth, google-analytics-api, oauth-2.0

Solution

The following code, corrected from my original question, is based on the example provided by Ian Fraser at:

https://groups.google.com/forum/#!msg/google-search-api-for-shopping/4uUGirzH4Rw/__c0e4hj0ekJ

His code addressed three issues:

- It appears as though AnalyticsService.Scopes.AnalyticsReadonly does not work, at least not for me or the way I am doing it.

- For some reason, the ServiceAccountUser must be assigned to the ServiceAccountId property of the AssertionFlowClient instance.

- OAuth2Authenticator provides the IAuthenticator that I was looking for.

In your project, include references to:

- Lib\DotNetOpenAuth.dll

- Lib\Google.Apis.dll

- Lib\Google.Apis.Authentication.OAuth2.dll

- Services\AnalyticsService\Google.Apis.Analytics.v3.dll

namespace GoogleAnalyticsAPITest.Console
{
    using System.Security.Cryptography.X509Certificates;
    using Google.Apis.Analytics.v3;
    using Google.Apis.Analytics.v3.Data;
    using Google.Apis.Authentication.OAuth2;
    using Google.Apis.Authentication.OAuth2.DotNetOpenAuth;
    using Google.Apis.Util;

    class Program
    {
        static void Main(string[] args)
        {
            log4net.Config.XmlConfigurator.Configure();            
            const string ServiceAccountId = "nnnnnnnnnnn.apps.googleusercontent.com";
            const string ServiceAccountUser = "nnnnnnnnnnn@developer.gserviceaccount.com";
            AssertionFlowClient client = new AssertionFlowClient(
                GoogleAuthenticationServer.Description, new X509Certificate2(@"value-privatekey.p12", "notasecret", X509KeyStorageFlags.Exportable))
            {
                Scope = AnalyticsService.Scopes.AnalyticsReadonly.GetStringValue(),
                ServiceAccountId = ServiceAccountUser //Bug, why does ServiceAccountUser have to be assigned to ServiceAccountId
                //,ServiceAccountUser = ServiceAccountUser
            };
            OAuth2Authenticator<AssertionFlowClient> authenticator = new OAuth2Authenticator<AssertionFlowClient>(client, AssertionFlowClient.GetState);            
            AnalyticsService service = new AnalyticsService(authenticator);            
            string profileId = "ga:64968920";
            string startDate = "2010-10-01";
            string endDate = "2010-10-31";
            string metrics = "ga:visits";
            DataResource.GaResource.GetRequest request = service.Data.Ga.Get(profileId, startDate, endDate, metrics);
            request.Dimensions = "ga:date";
            GaData data = request.Fetch();            
        }

    }
}

Problem

I realized this question has been previously asked but with little in the way of example code, so I am asking again but with at least a little bit of direction. After hours of searching, I have come up with the following partial implementation. ``` namespace GoogleAnalyticsAPITest.Console { using System.Security.Cryptography.X509Certificates; using DotNetOpenAuth.OAuth2; using Google.Apis.Analytics.v3; using Google.Apis.Analytics.v3.Data; using Google.Apis.Authentication.OAuth2; using Google.Apis.Authentication.OAuth2.DotNetOpenAuth; class Program { static void Main(string[] args) { log4net.Config.XmlConfigurator.Configure(); string Scope = Google.Apis.Analytics.v3.AnalyticsService.Scopes.Analytics.ToString().ToLower(); string scopeUrl = "https://www.googleapis.com/auth/" + Scope; const string ServiceAccountId = "nnnnnnnnnnn.apps.googleusercontent.com"; const string ServiceAccountUser = "nnnnnnnnnnn@developer.gserviceaccount.com"; AssertionFlowClient client = new AssertionFlowClient( GoogleAuthenticationServer.Description, new X509Certificate2(@"7039572692013fc5deada350904f55bad2588a2a-privatekey.p12", "notasecret", X509KeyStorageFlags.Exportable)) { Scope = scopeUrl, ServiceAccountId = ServiceAccountId//,ServiceAccountUser = ServiceAccountUser }; IAuthorizationState state = AssertionFlowClient.GetState(client); AnalyticsService service = new AnalyticsService(authenticator); string profileId = "ga:xxxxxxxx"; string startDate = "2010-10-01"; string endDate = "2010-10-18"; string metrics = "ga:visits"; DataResource.GaResource.GetRequest request = service.Data.Ga.Get(profileId, startDate, endDate, metrics); request.Dimensions = "ga:date"; GaData data = request.Fetch(); } } } ``` I have a couple issues. The call to `AssertionFlowClient.GetState(client)` results in a "invalid_scope" response as seen in the DotNetOpenAuth log of 2012-10-19 13:27:36,272 (GMT-4) [8] INFO DotNetOpenAuth - DotNetOpenAuth, Version=4.0.0.11165, Culture=neutral, PublicKeyToken=2780ccd10d57b246 (official) 2012-10-19 13:27:36,284 (GMT-4) [8] DEBUG DotNetOpenAuth.Messaging.Channel - Preparing to send AssertionFlowMessage (2.0) message. 2012-10-19 13:27:36,294 (GMT-4) [8] INFO DotNetOpenAuth.Messaging.Channel - Prepared outgoing AssertionFlowMessage (2.0) message for https://accounts.google.com/o/oauth2/token: grant_type: assertion assertion_type: http://oauth.net/grant_type/jwt/1.0/bearer assertion: (a bunch of encoded characters go here) 2012-10-19 13:27:36,296 (GMT-4) [8] DEBUG DotNetOpenAuth.Messaging.Channel - Sending AssertionFlowMessage request. 2012-10-19 13:27:36,830 (GMT-4) [8] DEBUG DotNetOpenAuth.Http - HTTP POST https://accounts.google.com/o/oauth2/token 2012-10-19 13:27:36,954 (GMT-4) [8] ERROR DotNetOpenAuth.Http - WebException from https://accounts.google.com/o/oauth2/token: { "error" : "invalid_scope" } I have tried specifying one or both of ServiceAccountId and ServiceAccountUser with no luck. Second, even if I get an IAuthorizationState, I am not sure how I get an IAuthenticator that can be passed to the AnalyticsService constructor. The following is the web.config I use to enable DotNetOpenAuth logging. ``` <?xml version="1.0"?> <configuration> <configSections> <section name="log4net" type="log4net.Config.Log4NetConfigurationSectionHandler,log4net, Version=1.2.10.0, Culture=neutral, publicKeyToken=1b44e1d426115821" /> <!--<section name="log4net" type="log4net.Config.Log4NetConfigurationSectionHandler" requirePermission="false"/>--> <sectionGroup name="dotNetOpenAuth" type="DotNetOpenAuth.Configuration.DotNetOpenAuthSection, DotNetOpenAuth"> <section name="openid" type="DotNetOpenAuth.Configuration.OpenIdElement, DotNetOpenAuth" requirePermission="false" allowLocation="true"/> <section name="oauth" type="DotNetOpenAuth.Configuration.OAuthElement, DotNetOpenAuth" requirePermission="false" allowLocation="true"/> <section name="messaging" type="DotNetOpenAuth.Configuration.MessagingElement, DotNetOpenAuth" requirePermission="false" allowLocation="true"/> <section name="reporting" type="DotNetOpenAuth.Configuration.ReportingElement, DotNetOpenAuth" requirePermission="false" allowLocation="true"/> </sectionGroup> </configSections> <log4net> <appender name="RollingFileAppender" type="log4net.Appender.RollingFileAppender"> <file value="DotNetOpenAuth.log"/> <appendToFile value="true"/> <rollingStyle value="Size"/> <maxSizeRollBackups value="10"/> <maximumFileSize value="100KB"/> <staticLogFileName value="true"/> <layout type="log4net.Layout.PatternLayout"> <conversionPattern value="%date (GMT%date{%z}) [%thread] %-5level %logger - %message%newline"/> </layout> </appender> <appender name="TracePageAppender" type="OpenIdProviderWebForms.Code.TracePageAppender, OpenIdProviderWebForms"> <layout type="log4net.Layout.PatternLayout"> <conversionPattern value="%date (GMT%date{%z}) [%thread] %-5level %logger - %message%newline"/> </layout> </appender> <!-- Setup the root category, add the appenders and set the default level --> <root> <level value="ALL"/> <appender-ref ref="RollingFileAppender"/> <appender-ref ref="TracePageAppender"/> </root> <!-- Specify the level for some specific categories --> <logger name="DotNetOpenAuth"> <level value="ALL"/> </logger> </log4net> <dotNetOpenAuth> <!-- This is an optional configuration section where aspects of dotnetopenauth can be customized. --> <!-- For a complete set of configuration options see http://www.dotnetopenauth.net/developers/code-snippets/configuration-options/ --> <!--<messaging clockSkew="00:10:00" lifetime="00:03:00" strict="true">--> <!--<messaging> <untrustedWebRequest timeout="00:00:30" readWriteTimeout="00:00:01.500" maximumBytesToRead="1048576" maximumRedirections="10"> <whitelistHosts> --> <!-- Uncomment to enable communication with localhost (should generally not activate in production!) --> <!-- <add name="localhost"/> </whitelistHosts> </untrustedWebRequest> </messaging>--> <!-- Allow DotNetOpenAuth to publish usage statistics to library authors to improve the library. --> <reporting enabled="false"/> </dotNetOpenAuth> <appSettings> <!--<add key="log4net.Internal.Debug" value="true" />--> </appSettings> <runtime> </runtime> <startup> <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.0"/> </startup> </configuration> ```

Original source