How do I use Google's token from AccountManager in my web app? (Rails with omniauth-google-oauth2)

Question 1

I managed to validate the token on the server side manually, without using omniauth.

I had to change the call to AccountManager#getAuthToken. The authTokenType parameter (previously "ah") needed to be filled with the client ID instead as follows: "audience:server:client_id:" + CLIENT_ID. The client ID is retrieved from the API Console, and is the one belongs to your web application. It looks like this: 123456789.apps.googleusercontent.com.
The code on the server side was pretty simple, so I didn't mind:

SessionsController (app/controllers/sessions_controller.rb):

def create
  auth = request.env["omniauth.auth"]
  if auth
    account = case auth['provider']
                when GoogleAccount::OAUTH_PROVIDER then GoogleAccount.find_by_omniauth(auth)
              end
  else
    account = case params[:provider]
                when GoogleAccount::PROVIDER then GoogleAccount.find_by_token(params[:token])
              end
  end
  render text: "Unauthoirized", status: :unauthorized and return if account.nil?
  session[:user_id] = account.user.id
    respond_to do |format|
    format.html { redirect_to root_url, :notice => "Signed in!" }
    format.json { render json: { result: true } }
  end
end

GoogleAccount (app/models/google_account.rb):

def self.find_by_token(token)
  validator = GoogleIDToken::Validator.new
  jwt = validator.check(token, CLIENT_ID)
  return if jwt.nil?

  google_account = where(uid: jwt['id']).first_or_initialize
  google_account.email = jwt['email']
  google_account.save!
  google_account
end

jwt is a Hash that looks like this:

{"iss"=>"accounts.google.com",
 "verified_email"=>"true",
 "email_verified"=>"true",
 "email"=>"my.email@gmail.com",
 "aud"=>"123456789.apps.googleusercontent.com", # aka CLIENT_ID
 "cid"=>"123456789-somerandomletters.apps.googleusercontent.com", # this is the device ID, you can validate that too with another parameter
 "azp"=>"123456789-samerandomletters.apps.googleusercontent.com",
 "id"=>"10000000000000000000", # this is Google's user ID for this user, keep it
 "sub"=>"10000000000000000000",
 "iat"=>1376306389,
 "exp"=>1376310289}

The server now doesn't get the same details it gets when logging in on the web as the token only holds the email, but that's enough for me. I also don't validate the CID (device ID), not sure when you'll want this.

Question 2

With Google Play Services you can call GoogleAuthUtil.getToken to get the token in the Android app. See http://developer.android.com/google/play-services/auth.html.

I use rest-client to manually validate the token on the server. I based the headers on the Twitter OAuth Echo that I have used in the past.

require 'rest_client'
require 'json'

class ApplicationController < ActionController::Base
  # Prevent CSRF attacks by raising an exception.
  # For APIs, you may want to use :null_session instead.
  protect_from_forgery with: :exception

  before_filter :require_login_or_oauth!

  private

  def authorization_header
    'X-Verify-Credentials-Authorization'
  end

  def service_provider_header
    'X-Auth-Service-Provider'
  end

  def verify_url
    'https://www.googleapis.com/oauth2/v1/tokeninfo'
  end

  def client_ids
      %w(-- your client ids here--)
  end

  def find_oauth_user
    if request.headers[authorization_header].nil? or verify_url != request.headers[service_provider_header]
      logger.warn "bad authorization headers"
      render :text => "Bad authorization headers", :status => :unauthorized
      return nil
    end
    begin
      response = RestClient.get verify_url, { :params => { :access_token => request.headers[authorization_header] }, :accept => :json }
      if 200 != response.code
        render :text => "OAuth validation failed", :status => :unauthorized
        return nil
      end
      body = JSON.parse(response.to_str)

      return nil if not client_ids.include? body['audience']
      # TODO log bad client

      # TODO possibly validate scope

      if identity = Identity.find_by_uid(body['user_id'])
        user = identity.user
        logger.info "Authenticated #{user.id} as #{identity.email}"
        return user
      end
      return nil
    rescue RestClient::Exception => e
      logger.warn e
      render :text => "OAuth validation failed", :status => :unauthorized
      return nil
    end
  end

  def require_login_or_oauth!
    if "application/json" == request.format
      user = find_oauth_user
      if user
        sign_in(:user, user)
        session[:user_id] = user.id
      else
        redirect_to root_url, status: 401
      end
    else
      authenticate_user!
    end
  end
end