How can an application server associate Google accounts to a user's device?

Question

I want users to be able to enter data from a web server and/or native PC app and transfer it to their chosen Android device in much the same way that Google Play's install on device works.

I'd like to use the user's Google account authentication to establish a link between the application server and the user's Android device that registered with GCM.

I couldn't find any mention of how to handle this kind of authentication in the Google Cloud messaging API documentation, but did find this unanswered question in the GCM forums.

I'd like to authenticate users from a web application via the his or her Google account. Similarly, the Android application would somehow obtain a handle on the same Google Account, which would be sent to the web application server once at same time as initial GCM registration.

Then when the user uses the web application, the server provides a list of devices the user has already registered to the server, so that the user can be prompted about which Android device he or she would like to send data to.

How can I accomplish this on the web server as well as on the device?

What information can I use after authenticating with the Google account to establish a link between the two logins?

Answer 1

You should use the user_id that is returned from the Google account server after registration to uniquely identify each user. Email addresses shouldn't be used for a number of reasons:

• Accessing email addresses may require additional permissions from the user and dissuade users from using your service/app because of trust issues.
• Adds liability for securing database of users' email addresses
• Users may change their email addresses in Google accounts but cannot change their user IDs.
• Users can associate one email address with more than one user ID, so it is not necessarily unique.

The following sequence diagram shows the initial registration from client Android app:

The next diagram shows what happens when a client wants to access his device from a browser:

Note that although not shown, the client Android app can now communicate back to the client browser if needed via the application server.

Answer 2

The user_id you get from the device when you register with GCM should be the same as the user_id you get with your OAuth token for your app. Just store the OAuth token and Registration ID in your user repository, associating both with the user_id.