Why does Google Sign In In for Android return a "south" user ID that is different from UserService.getCurrentUser () for domain hosting accounts?

Question

For Google accounts that are NOT registered domain accounts, the sub user ID returned by https://developers.google.com/identity/sign-in/android/backend-auth always matches the response from UserService.getCurrentUser().getUserId() as expected.

However, for registered domain accounts, the sub identifier does not match the response from UserService.getCurrentUser().getUserId() . How can we have a common user ID for hosting domain accounts, regardless of whether the user is signed in with a Google login for Android Id Token or through a server-based UserService user account?

Answer 1

What’s the reason: I’m sure that the mismatch is an artifact of the fact that the Google App Engine directly uses its own authentication system / Google user account, while the Identity Kit is a separate project that integrates with several OAuth providers. In other words, these are separate projects that at some point were poorly integrated.

To solve this problem, I recommend that you do not use Google’s own authentication API for App Engine and instead just use the Identity Toolkit Web , which will, of course, use the same data and scheme as the Android / iOS Identity objects. Just using the Identity Toolkit, like any other web application, it’s pretty simple, and it goes beyond GAE.

If the Identity Toolkit was created during the creation of App Engine, it is possible that they will be automatically integrated and everything will work. But I found that you cannot mix and match them; you choose one and stick to it.