How to authenticate a google home user with the back-end server?

Question

We are trying to link the google home app with our back-end server. At the moment we can login to the google home app with a google account and send an access token to our own api. We can also login to our own services with a google account. But how can we verify who is sending the requests from the google home to connect both accounts.

Information received by google login from our server.

object(Google_Service_Oauth2_Userinfoplus)#48 (14) {
  ["internal_gapi_mappings":protected]=>array(3) {
    ["familyName"]=>string(11) "family_name"
    ["givenName"]=>string(10) "given_name"
    ["verifiedEmail"]=>string(14) "verified_email"
  }
  ["email"]=>NULL
  ["familyName"]=>string(6) "familyname"
  ["gender"]=>string(4) "male"
  ["givenName"]=>string(7) "givenname"
  ["hd"]=>NULL
  ["id"]=>string(21) "XXXXXXXXXXXXXXXXXX"
  ["link"]=>string(45) "https://plus.google.com/XXXXXXXXXXXXXXXXXXXX"
  ["locale"]=>string(2) "nl"
  ["name"]=>string(14) "firstname lastname"
  ["picture"]=>string(92) ""
  ["verifiedEmail"]=>NULL
  ["modelData":protected]=>array(2) {
    ["given_name"]=>string(7) ""
    ["family_name"]=>string(6) ""
  }
  ["processed":protected]=>array(0) {
  }
}
array(6) {
  ["access_token"]=>string(140) "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  ["expires_in"]=>int(3599)
  ["scope"]=>string(206) "https://www.googleapis.com/auth/userinfo.profile
    https://www.googleapis.com/auth/plus.profile.language.read
    https://www.googleapis.com/auth/plus.me
    https://www.googleapis.com/auth/plus.profile.agerange.read"
  ["token_type"]=>string(6) "Bearer"
  ["id_token"]=>string(1085) "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  ["created"]=>int(1534615815)
}

Post request from google home to the webhook

{  
 "user":{  
  "userId":"XXXXXXXXXXXXXXXXXXXXXXXX",
  "accessToken":"XXXXXXXXXXXXXXXXXXXXXXXXX",
  "locale":"nl-NL",
  "lastSeen":"2018-10-15T14:17:23Z",
  "userStorage":"{\"data\":{}}"
  },
  "conversation":{  
  "conversationId":"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
  "type":"ACTIVE",
  "conversationToken":"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
},

Prisoner Prisoner · Accepted Answer · 2018-10-15T16:12:34

If you are getting an accessToken in the request to your webhook, then this is an access token that your OAuth2 server should have issued to the Assistant so it can act on your behalf. Presumably, you would use this token in your auth system to identify the user's account, but the exact method for doing so is up to you since it depends on the OAuth server you're using.

Since you're assuming a Google account, however, you can simplify things greatly by using Google Sign in for Assistant. This will give you an idToken instead which, when decoded and validated, will include their Google ID, which should match the id you get from their profile.

How to authenticate a google home user with the back-end server?

1 Answers