I am making an multi-tenant platform that integrates client's Google drive to:
Create a folder in their Google Drive
Share Editor access with Tenants
Allow Tenants to create sub-folder and write documents.
I am using SCOPE: https://www.googleapis.com/auth/drive which works well.
However, the SCOPE is quite pervasive and Grant Full, permissive scope to access all of a user's files.
I just wanted access to create a folder editor access to things within.I don't want access to anything that client previously had in their Drive.
Do you think any way to have a limited SCOPE API?
Thanks to #Tanaike! SCOPE: https://www.googleapis.com/auth/drive.file is what solved my problem.
In that case, how about using the scope of
https://www.googleapis.com/auth/drive.file instead of
https://www.googleapis.com/auth/drive? The official document of
https://www.googleapis.com/auth/drive.file says Per-file access to
files created or opened by the app. File authorization is granted on a
per-user basis and is revoked when the user deauthorizes the app.. Is
this the direction you expect? – Tanaike 58 mins ago
Related
Is it easy for people to find "public" google sheets/docs?
Context: Storing some semi-sensitive data (individual user info, of non-sensitive nature) for an app beta-test in google sheets. Planning to migrate to some DB in the future, but for now, just using JavaScript to pull the data directly from the google sheets (since there are visualizations being dynamically updated by the sheets).
Yes, it's easy to get information. Search engines may index and cache the information. Then, there are bots, crawlers and scrapers. Do NOT put (semi)sensitive information in public. Implement google-oauth properly with google-sheets-api to get information. You can also use service-accounts
Yes, it can be easily accessed.
According to the official Google article Share files from Google Drive: when you set your file's General Access setting to public:
Anyone can search on Google and get access to your file, without signing in to their Google account.
What you can do:
In the case of your app beta-test in google sheets data, you may want to reconsider to change your file's General Access setting to one of the following (in descending order of security):
Restricted - Only people that you manually give access to can view or edit your files. When you click the share button, a prompt will show and you may manually add the users who can view or edit your files:
Afterwards, you may select a role for those users and then they can be notified afterwards through email.
On the other hand, you can share the link to others. A prompt will show like the one below if you send the url through Google Chat:
You may opt to select Don't give access which will result in the following view on the other user's end:
This would mean that if unauthorized users get hold of the file URL, they will still need to send an access request. If other users submit the request, an email notification will be sent to your mail inbox. Other users who also own the file will also be notified by mail.
Your Organization - If you use a Google Account through work or school, anyone signed in to an account in your organization can open the file. If you are an administrator in a work or school workspace, you may set how members can share content within the organization. The administrator can prevent the sharing of content with group members outside your organization. If external sharing is prohibited, only group members who are in your organization can access the group's shared content.
Anyone with the link - Anyone who has the link can use your file, without signing in to their Google Account. This option is least recommended because if the URL is leaked to unauthorized users, they can easily access the file.
References:
Share files from Google Drive
Share content with a group
Don’t make it public unless you want the public to see it. Use oauth to access.
I am trying to publish a Google Sheets Add-on. I am working on the Google Workspace Marketplace SDK configuration. The configuration automatically includes the following 2 scopes as defaults:
https://www.googleapis.com/auth/userinfo.email
https://www.googleapis.com/auth/userinfo.profile
The Add-on has no reason to access the user's email or profile. Why are these added? Can I delete them? The only scopes that the script code should need are:
https://www.googleapis.com/auth/script.container.ui
https://www.googleapis.com/auth/spreadsheets.currentonly
When I go to create the OAuth Consent Screen. I am told that I need to create "A Youtube video showing how you plan to use the Google user data that you get from scopes". Am I being asked to do this because of these default scopes that are included?
EDIT: I deleted these 2 scopes and did a SAVE. It confirmed that the edits were saved. But when I refreshed the page, the scopes were back!
The reason why the Trust and Safety team is asking you for the video is because this:
1-Most of the apps that will be public, require certain steps. So the video is one of those.
2-Now, the main reason for the video, is because the scope https://www.googleapis.com/auth/script.container.ui is part of the restricted scopes. And according to the documentation it needs to go through the verification.
So basically the reason for the video is because you have a restricted scope because this scope allows you to display and run third-party web content in prompts and sidebars inside Google applications. Therefore, it is important for the verification process.
Now in regards to your concern of the default scopes, I was able to remove them and create OAuth consent screen without them.
I'll try to be as brief and comprehensive as I can.
Objective: To be able to upload PDF files generated after filling an HTML form to my personal OneDrive.
I have been looking into this for a few days now and cannot for the life of me figure out the proper way to set up the app and permissions in the Azure portal for this to work. I was initially using the Personal Microsoft accounts only option but quickly realized that would mean having to sign in. Then I tried the Accounts in any organizational directory (Any Azure AD directory - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox) option. So this seemed to be a step in the right direction as the end-user does not need to do anything. I could use Application Permissions which would work without a signed-in user. That is basically what I want.
This lead to another issue, Tenant does not have a SPO license. After looking up more, it seems that to use the OneDrive APIs, you need to have a subscription. Like I mentioned, I am using a personal account (free).
I also tried daemon (since I can use application permissions and work without a user signed in). But based on the Microsoft Graph Get Files Permissions, Only Delegated permission is supported for personal Microsoft account.
I am trying to achieve this through PHP and using the libraries that are recommended everywhere. I honestly think that I am finding this much more complicated than it really is but I really can't figure out where I'm going wrong.
In conclusions, I can't answer these questions:
Can a personal free account (with student subscription or not) be used to access OneDrive?
If so, what supported account type is ideal for this?
And finally, is there anywhere I can follow to do this?
P.S. I have tried a lot more things I mentioned here, so in case anyone thinks of something I should have done, ask me and I'll update you.
You have tried many and got many correct conclusions.
To make a personal account access the personal OneDrive, you have to use delegated permission. Application permission is not supported in this scene.
I know your requirement is not to sign in interactively. Unfortunately it's not supported to use ROPC flow for personal accounts.
So the only option is to use auth code flow or implicit grant flow. Both of them require you to sign in interactively.
In summary, uploading files to personal OneDrive using non-interactive login is not supported.
Does anyone know if I can have a single one drive folder and then assign via the API different people, and then they would see only the folders that they are allowed to see.
I am trying to re-create the "views" functionality of dropbox enterprise
Yes, the simplest way to do so is to use the Microsoft Graph API which has an entire set of endpoints that work with a OneDrive account.
The endpoints that will best serve you are the Create Sharing Link and the Add Permission.
Note: Using the sharing link that doesn't require account authentication means anyone with that link can access the OneDrive folder/file that it is assigned to. If the user(s) have Microsoft Accounts or Microsoft Organizational Accounts (also known as work/school account) then the Add Permission endpoint is likely your best bet.
Project ASP.NET
I will use Azure for my storage. Questions (requirements):
In my project I let my registered users download files. But I don't want the user to share this download link to unregistered people (example : the download link what I gave the registered user shall only be downloadable on their computer) .
I show only for registered users the download link, the registered users can download the files that I gave them
No one can delete my files
Question 1: This is really up to your app but... if you're giving direct links to blobs in Azure Storage, you would need to protect them with a Shared Access Signature (or policy). This way, you can give someone a link that expires (for example, 10 minutes after you issue the link). Then, if someone gives away the link, it won't work for very long. There's no way to limit a link's use to a specific computer. Now, if you simply stream content from blob to your app, and then from your app to the user, you will probably have a bit more control, since you wouldn't really be generating a reusable link. But this will have downsides (such as running all content through your web tier, requiring more resources in your web tier).
Question 2: This is completely up to your app, how you manage assets and present them to a registered user. No way to answer this for you, since we know nothing about your app.
Question 3: Azure Storage is accessible by a secret key, which should stay secret, and only you should ever have access to it (for example, it would be used by your code on the server). As long as you don't publish this key anywhere, then nobody would be able to delete your content.