GX Technology : Chatbot - Dev - Testing DialogFlow APIs

Created by Darryl Dekok, last modified on Sep 04, 2018

Download Credentials

The credentials for the service account are located at https://devkeys.disney.network/secret/apps/axis/env/gxchatbot-poc/svc-dialogflow-w-f9e60a01bb5c.json


Perform the following to read the service account credentials into a file.

dekod002@KELAXISDEKOD002:~$ vault read --format=json --field=data /secret/apps/axis/env/gxchatbot-poc/svc-dialogflow-w-f9e60a01bb5c.json > /home/dekod002/key.json

Authentication

Before executing any curl commands, it is best to ensure that you are authenticated as the service account.

dekod002@KELAXISDEKOD002:~$ export GOOGLE_APPLICATION_CREDENTIALS=/home/dekod002/key.json
dekod002@KELAXISDEKOD002:~$ gcloud auth activate-service-account --key-file=/home/dekod002/key.json


To verify you are authenticated as the service account, ensure the service account is flagged with an asterisk

dekod002@KELAXISDEKOD002:~$ gcloud auth list
                        Credentialed Accounts
ACTIVE  ACCOUNT
        dekod002@disney.io
*       svc-dialogflow-w@di-gxchatbot-us-poc-1.iam.gserviceaccount.com

To set the active account, run:
    $ gcloud config set account `ACCOUNT`

Testing DialogFlow API Authorization

Currently, we only get permission denied responses from DialogFlow APIs

dekod002@KELAXISDEKOD002:~$ curl -X GET -H "Authorization: Bearer "$(gcloud auth print-access-token) -H "Content-Type: application/json; charset=utf-8" "https://dialogflow.googleapis.com/v2/projects/di-gxchatbot-us-poc-1/agent"
{
  "error": {
    "code": 403,
    "message": "IAM permission 'dialogflow.agents.get' on 'projects/di-gxchatbot-us-poc-1' denied.",
    "status": "PERMISSION_DENIED"
  }
}

Getting Permissions for Account

There is an IAM endpoint to test for permissions on a given account.

dekod002@KELAXISDEKOD002:~$ curl -H "Authorization: Bearer "$(gcloud auth print-access-token) -H "Content-Type: application/json" -X POST -d '{"permissions":["dialogflow.agents.get"]}' https://cloudresourcemanager.googleapis.com/v1/projects/di-gxchatbot-us-poc-1:testIamPermissions
{}

Note that we're testing for the dialogflow.agents.get (which is required by the API endpoint tested above and supposedly granted by the DialogFlow Admin role) and that we're not getting any values back indicating we do not have the permission.

Compare this to my own account, which does have the DialogFlow Admin role

dekod002@KELAXISDEKOD002:~$ gcloud auth login
Go to the following link in your browser:

    https://accounts.google.com/o/oauth2/auth?*************************

Enter verification code: *****************************
WARNING: `gcloud auth login` no longer writes application default credentials.
If you need to use ADC, see:
  gcloud auth application-default --help

You are now logged in as [dekod002@disney.io].
Your current project is [di-gxchatbot-us-poc-1].  You can change this setting by running:
  $ gcloud config set project PROJECT_ID
dekod002@KELAXISDEKOD002:~$ gcloud auth list
                        Credentialed Accounts
ACTIVE  ACCOUNT
*       dekod002@disney.io
        svc-dialogflow-w@di-gxchatbot-us-poc-1.iam.gserviceaccount.com

To set the active account, run:
    $ gcloud config set account `ACCOUNT`

dekod002@KELAXISDEKOD002:~$ curl -H "Authorization: Bearer "$(gcloud auth print-access-token) -H "Content-Type: application/json" -X POST -d '{"permissions":["dialogflow.agents.get"]}' https://cloudresourcemanager.googleapis.com/v1/projects/di-gxchatbot-us-poc-1:testIamPermissions
{
  "permissions": [
    "dialogflow.agents.get"
  ]
}

The output from the last line indicates that I do have the dialogflow.agents.get permission on my disney.io account.

Issue Summary

The issue here is that I cannot interact with the DialogFlow APIs using the service account despite the service account having the DialogFlow Admin role. Google Cloud Support Case #16187502 has been created to resolve this issue.

Normally, I would just resort to using my disney.io account (since it has the permission), however, this account isn't working either

dekod002@KELAXISDEKOD002:~$ curl -X GET -H "Authorization: Bearer "$(gcloud auth print-access-token) -H "Content-Type: application/json; charset=utf-8" "https://dialogflow.googleapis.com/v2/projects/di-gxchatbot-us-poc-1/agent"
{
  "error": {
    "code": 403,
    "message": "Dialogflow API has not been used in project 32555940559 before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/dialogflow.googleapis.com/overview?project=32555940559 then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.",
    "status": "PERMISSION_DENIED",
    "details": [
      {
        "@type": "type.googleapis.com/google.rpc.Help",
        "links": [
          {
            "description": "Google developers console API activation",
            "url": "https://console.developers.google.com/apis/api/dialogflow.googleapis.com/overview?project=32555940559"
          }
        ]
      }
    ]
  }
}

The project ID 32555940559 belongs to a project I do not have permission to view (I'm not even sure which project it is).