Azure WebSites denies access to Google Api

Question

I am working on a dll that is used by web form application. One of dll's features is creating Google CalendarService and using it. When I run the webforms on my local host everything is running smoothly. However, if I run it from Azure websites

'GoogleWebAuthorizationBroker.AuthorizeAsync' method throws HttpListenerException (0x5): Access is denied

Here is a stack trace:

[HttpListenerException (0x5): Access is denied]
Microsoft.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) +82   
Microsoft.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccess(Task task) +71   
Mosoft.Integrations.CalendarService.<GetCredentials>d__2.MoveNext() +362

[AggregateException: One or more errors occurred.]
System.Threading.Tasks.Task.ThrowIfExceptional(Boolean includeTaskCanceledExceptions) +3833113
System.Threading.Tasks.Task`1.GetResultCore(Boolean aitCompletionNotification) +73
System.Threading.Tasks.Task`1.get_Result() +10900681
Mosoft.Integrations.CalendarService.GoogleCalendar..ctor(Int32 userID) +38
WebFormsDemo.ModalCreate.CreateServices() +35
WebFormsDemo.ModalCreate.Page_Load(Object sender, EventArgs e) +240 System.Web.Util.CalliEventHandlerDelegateProxy.Callback(Object sender, EventArgs e) +51
System.Web.UI.Control.OnLoad(EventArgs e) +92
System.Web.UI.Control.LoadRecursive() +54
System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +772

And this is how I set up the credentials

private static async Task<BaseClientService.Initializer> GetCredentials(int userID)
    {
        ClientSecrets secrets = new ClientSecrets
        {
            ClientId = CLIENT_ID,
            ClientSecret = CLIENT_SECRET
        };

         UserCredential googleCredential = await GoogleWebAuthorizationBroker.AuthorizeAsync(secrets,
            new[] { Google.Apis.Calendar.v3.CalendarService.Scope.Calendar }, userID.ToString(), CancellationToken.None, new MyDataStore());

         var initializer = new BaseClientService.Initializer
         {
             HttpClientInitializer = googleCredential,
             ApplicationName = "MyCalendar"
         };
         return initializer;
    }

Any suggestions what could be wrong? Or pointing towards right direction?

NicoJuicy · Answer 1 · 2015-10-29T23:47:42.940

Both are using Service Accounts, so i hope it will help you.

Possability #1:

When you generate the P12 certificate, did you try changing

var certificate = new X509Certificate2(p12Path, "notasecret", X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.Exportable);

//(notice the X509KeyStorageFlags.MachineKeySet |)

Possability #2, authentication using service accounts

string keyFilePath = System.Web.Hosting.HostingEnvironment.MapPath("~/----path to json credentials downloaded using google developer console ---.json");
string p12Path = System.Web.Hosting.HostingEnvironment.MapPath("~/---path to p12 certificate ----.p12");
string[] scopes = new string[] {
    CalendarService.Scope.Calendar, // Manage your calendars
    CalendarService.Scope.CalendarReadonly // View your Calendars
};

       var certificate = new X509Certificate2(p12Path, "notasecret", X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.Exportable);

ServiceAccountCredential credential = new ServiceAccountCredential(
    new ServiceAccountCredential.Initializer("--email generated by google developer console ending with ----@developer.gserviceaccount.com")
    {
        Scopes = scopes
    }.FromCertificate(certificate));

    CalendarService service = new CalendarService(new BaseClientService.Initializer()
    {
        HttpClientInitializer = credential,
        ApplicationName = "----the project name used from developer console---",
    });

score 0 · Answer 2 · answered Apr 29 '15 at 22:35

0

To use Google APIs you usually have to white-list the domain the API request will be coming from. Did you forget to white-list your azure website's domain?

answered Apr 29 '15 at 22:35

Zain Rizvi

23,586
22
91
133

If by white-listing you mean allowing all IP's to access my domain, then yes, that is done. – Paulius Sabutis Apr 30 '15 at 13:35
@PauliusSabutis No, I mean you have to tell Google "Hey, I'll be accessing you from 'www.mysite.com'. Please let the request go through" – Zain Rizvi Oct 30 '15 at 00:02

score 0 · Answer 3 · edited May 23 '17 at 12:22

0

 UserCredential googleCredential = await GoogleWebAuthorizationBroker.AuthorizeAsync(secrets,
            new[] { Google.Apis.Calendar.v3.CalendarService.Scope.Calendar }, userID.ToString(), CancellationToken.None, new MyDataStore());

This doesn't seem to be the right way to authenticate using a web app. This answer is how I stopped the "Access is denied" error.

edited May 23 '17 at 12:22

Community

1
1

answered Jan 23 '16 at 22:43

Shiran Dror

1,472
1
23
36

Azure WebSites denies access to Google Api

3 Answers3