0

The id I get from app.getUser() from the actions-on-google-nodejs app looks entirely different from the id I get from Oauth.

app.getUser() in Google Assistant

{ userId: 'KMdEs***szG-ZRQl***cU',
  user_id: 'KMdEs***szG-ZRQl***cU',
  userName:
    {
[...]

The same id is returned with and without the app.SupportedPermissions.NAME permission.

googleUser.getBasicProfile().getId() in Google OAuth

11348***63489

Is there any way to match these users up? It's the same Google Project in the developer console, so I assume that even if Google would generate unique ID's per project it should be the same, however in this case it looks like I am getting entirely different types of id's.

David Mulder
  • 26,123
  • 9
  • 51
  • 114

1 Answers1

2

They are different types of IDs.

The ID returned from app.getUser() is meant as an anonymous project-unique identifier that can be used in some of the same ways a web cookie is used. It can not be identified against a specific account - but it will be consistent across all sessions (unless reset by the user). The profile information you can get with it (their name) is also considered non-identifying. Both are intended to be used to make a more friendly interface, rather than as a firm identifier. Users are able to reset their Google Home devices, for example, and this may reset this to a different ID.

The ID returned through OAuth, however, is meant to link them to a Google Account, with all the implications that brings, including associating them with a specific identity. This Account Linking is done separately, and does not directly give you the ID - instead it gives you an OAuth Access Token (which you can get through app.getUser().accessToken) which you can use to get their Google ID and other information that you may be scoped to get.

In theory, if you have Account Linking enabled, you could match the two up. In practicality, if you have Account Linking enabled, you wouldn't care about app.getUser().userId since you have the Access Token which will get you their Google ID. If you do not have Account Linking enabled - there is no way to match up the two and you should treat the userId as an anonymous (but consistent) user.

Prisoner
  • 49,922
  • 7
  • 53
  • 105
  • I assumed one of the two was supposed to be project specific, but I am logging in within the same project context, so I think it would be a fair idea to make the project specific ID available outside of the actions-on-google context as well. After all, if I get the user to go through a proper OAuth flow than I think I can be trusted with the less identifying ID as well. Regardless, account linking seems to be all about having the user log into some existing non-google, guess I will ask separately about how to log into a Google account then :/ – David Mulder May 31 '17 at 15:21
  • Account linking *can* be used to log into a Google account - but yes, best asked as a separate question. – Prisoner May 31 '17 at 15:32
  • Just did: https://stackoverflow.com/questions/44288981/how-to-authenticate-user-with-just-a-google-account-on-actions-on-google – David Mulder May 31 '17 at 15:35