Connecting to a Google application using the website OAuth 2.0 authorization method

To enable IBM® App Connect to work with Google applications like Gmail and Google Sheets, you can connect by using one of two authorization methods. You can use an OAuth 2.0 client ID & secret, or provide credentials for App Connect to use by obtaining an OAuth 2.0 client ID, client secret, access token, and refresh token. This topic describes how to connect using the website OAuth 2.0 authorization method. With this method, App Connect generates an access and refresh token for you.

High-level procedure:

  1. Start with a project
  2. Define a consent screen
  3. Get an OAuth client ID and secret
  4. Enable the Google APIs that you want to let IBM App Connect use with your Google data
  5. Connect to a Google application

The procedure described in this page assumes that you do not already have a suitable OAuth client ID and client secret for a project that has the Google APIs enabled, and that to give IBM App Connect access to a consumer Gmail account you want to use the Google API Console to get an OAuth client ID and client secret. If you do have a suitable OAuth client ID and client secret, you can use those to connect to App Connect without having to create and configure a new project. You'll just need to update your Google application with the redirect URI provided by App Connect, see Updating the authorized redirect URI.

Start with a project

In the Google Cloud Platform, you configure details for OAuth 2.0 authentication and authorization in a project. You can either use an existing project or create a new project for IBM App Connect.

    1. Open the Google Cloud Platform https://console.developers.google.com/apis/dashboard.

      (Sign in with your Google account)

    2. From the project drop-down menu, select an existing project or create a new project, as follows:
      1. Click NEW PROJECT
      2. If displayed, agree to the terms of service for Google Cloud Platform to continue
      3. Enter a project name that will help you manage OAuth for IBM App Connect; for example: 
        Project for IBM App Connect
      4. Click CREATE. (This returns you to the dashboard.)
Figure 1. Google Cloud Platform – Create a new project
Google API Console – Create a new project

(Click image to view full size)

Define a consent screen

Use the OAuth consent screen option to define a consent screen.

The consent screen will only be used by you to get an access token and refresh token for IBM App Connect use.

    1. Select the OAuth consent screen option
    2. Select a User Type from one of the following options.
      Internal
      Select Internal to make your app available to other users in your organization. In G Suite, depending on your organizational structure, settings, and policies, users can create their own Client ID and Client secret or might use the G Suite account holder's Client ID and Client secret. Those users will not see an 'unverified app' screen when configuring an access token and refresh token, and can use the OAuth credentials to connect IBM App Connect to Google apps.

      Only available to G Suite users.

      External
      Select External so that you can use your app yourself or make your app available to any user with a Google account. These users might see an 'unverified app' screen when configuring an access token and refresh token, but can use the OAuth credentials to connect IBM App Connect to Google apps.

      External is selected by default if you are not a G Suite user.

    3. Click CREATE
    4. Enter an Application name to help you manage OAuth for IBM App Connect; for example: App for IBM App Connect
    5. Select your User support email address
    6. In the Authorized domains field, enter ibm.com to add this to your list of authorized domains
    7. In the Developer contact information field, add an email address
    8. Click SAVE AND CONTINUE. (This displays the Scopes screen.)
    9. (Optional) Add scopes for the Google apps that you want to use. (Otherwise, you can select scope permissions later.)
      To add scopes now:
      1. Click ADD OR REMOVE SCOPES
      2. Under Manually add scopes paste scopes for Google apps
      3. Click ADD TO TABLE
      4. Click UPDATE. This lists the scopes under headings like Your sensitive scopes.

      For example, the recommended scope for GMail is: https://www.googleapis.com/auth/gmail.modify

      Recommended scopes for other Google apps:

      • For Google Drive and Google Sheets apps: https://www.googleapis.com/auth/drive
      • For Google Analytics app:
        https://www.googleapis.com/auth/analytics
https://www.googleapis.com/auth/analytics.edit
https://www.googleapis.com/auth/analytics.manage.users
https://www.googleapis.com/auth/analytics.manage.users.readonly
https://www.googleapis.com/auth/analytics.readonly

      Click SAVE AND CONTINUE. (This displays the Test users screen.)

    10. (Optional) Add users as required, then click SAVE AND CONTINUE. (This displays the OAuth consent screen details.)
    11. Click BACK TO DASHBOARD
    12. In the Publishing status section, click PUBLISH APP. The Push to production pop up window is displayed.
    13. Click CONFIRM
Figure 2. Google API Console – Create a new consent screen
Google API Console – Create a new consent screen

(Click image to view full size)

Get an OAuth client ID and secret

Use the Credentials option to get an OAuth client ID and secret, and update the authorized redirect URI provided by App Connect.

    1. Click the Credentials option
    2. Click + CREATE CREDENTIALS
    3. Click OAuth client ID
    4. Click the Web application check box
    5. Enter a Name to help you manage OAuth for IBM App Connect; for example: Web client for IBM App Connect
    6. In the Authorized redirect URIs field, enter the redirect URI provided in the App Connect UI, then press return to add this to your list
    7. Click Create

    The OAuth client is created, and the Client ID and secret are displayed. You can copy the values displayed, or download them as a JSON file from the Credentials page at any time. To continue, close the OAuth client created window.

    If you later want to see the Client ID and secret, or add the redirect URI provided by App Connect, from the Google APIs and Services menu, click the Credentials and then click the name of the client you want to work with in the OAuth 2.0 Client IDs section.

Figure 3. Google API Console - Updating the authorized redirect URI
Screen shot to demonstrate how to update the authorized redirect URI for a Google application

Enable the Google APIs that you want to let IBM App Connect use with your Google data

For your project, enable the Google APIs that can be used. We'll later define the scopes of API use that you want to allow; for example, to only retrieve messages or to create new spreadsheets.

    1. Click the Library option
    2. Select a Google API that you want to use in IBM App Connect flows, then click ENABLE
    Repeat these steps for each of the Google apps that you want to use in IBM App Connect; for example:
    • Gmail: Gmail API
    • Google Analytics: Google Analytics API
    • Google Drive: Google Drive API
    • Google Sheets: Google Sheets API and Google Drive API

The APIs that you have enabled are listed on the dashboard; for example:

Figure 4. Google Cloud Platform dashboard, showing the list of APIs enabled
Google API Console dashboard, showing the list of APIs enabled

(Click image to view full size)

Select the scopes of APIs to use in IBM App Connect

If you did not select API scopes when defining the consent screen, edit the OAuth app to select the scopes of APIs for each of the Google apps that you want to use in IBM App Connect. For a list of the recommended scopes, see the "Define a consent screen" section of the preceding link.

  1. Select the OAuth consent screen option
  2. Click EDIT APP
  3. Click SAVE AND CONTINUE. (This displays the Scopes screen.)
  4. Click ADD OR REMOVE SCOPES
  5. Select API scopes from the list of enabled APIs, or manually add scopes
  6. Click UPDATE
  7. Click SAVE AND CONTINUE on the following screens until you see the OAuth consent screen details
  8. Click BACK TO DASHBOARD

Connect to a Google application

When you have completed all the steps above you are ready to connect to a Google application in the App Connect UI.

    1. Specify the Application client ID obtained in Get an OAuth client ID and secret
    2. Specify the Application client secret obtained in Get an OAuth client ID and secret
    3. Click Connect
    4. You are prompted to select the Google account that you want to sign in with
    5. If the Unverified app screen is displayed, click Advanced > Go to IBM.com (unsafe). For more information about unverified apps, see the Google doc Unverified apps.
    6. In the Google consent screen, select the access you want to provide to App Connect.
      Figure 5. Example of selecting access in the Google consent screen
      Example of selecting access in the Google consent screen
    7. Click Continue to close the consent screen and return to the App Connect UI
    8. You are connected to your Google application and the account is created in App Connect
Figure 6. Example of completed fields for connecting from App Connect
Example of completed fields for connecting from App Connect