Google apps applications talk to each other

I am looking for a way for two Google Apps applications to talk to each other and share data between each other. I have the following scenario:

• Application A logs user in using Google Apps login
• Application B logs user in using Google Apps login
• then these applications need to communicate directly to each other (server-to-server) using some APIs

The question is: how do these applications verify that the other one is logged in with the same user to Google? I would imagine something like: - Application A gets some '开发者_C百科token' from Google and sends it to Application B - Application B verifies that this token is valid for the same Google account as it is logged in with

Is there a way to accomplish that via Google Federated Login? I am talking about Hybrid protocol here.

---

Here's a simple way to do it:

1. You keep everything keyed to the user's Google userid on both applications.
2. You share the data using HTTP requests that contain the userid.
3. To prevent leaking of the userids (forbidden by the account API) and to verify the messages really come from the other application, you encrypt the requests with a symmetric cipher such as AES or Blowfish or whatever you like. Both applications have the same key embedded.

You could public key cryptography. With just two applications, it's not worth it in my opinion. If you start having more apps, public key makes sense.

The fine print: encryption does not guarantee integrity or origin without additional measures. You need to take precautions against playback, for example by incorporating a time-stamp or sequence number. You need to take precautions against tampering, e.g. with a checksum. Make sure to use CBC and good initialization vectors. Keep the key secret.

---

user.user_id() is always the same across all the apps for the same user. So you can simply compare values returned by user.user_id(). Is this what you are looking for?

Note: Every user has the same user ID for all App Engine applications. If your app uses the user ID in public data, such as by including it in a URL parameter, you should use a hash algorithm with a "salt" value added to obscure the ID. Exposing raw IDs could allow someone to associate a user's activity in one app with that in another, or get the user's email address by coercing the user to sign in to another app.

From docs