title: Google App Engine: Endpoints authentication when custom auth or Open ID is used
body: <p>I recently got started with Google App Engine. I intend to use Flask to serve web pages and the Endpoints API, preferably with the Endpoints-Proto-Datastore for everything else. </p>
  
  <p>From the beginning, non-Google Authentication mechanisms on GAE seem like they need some work. I'd appreciate any light shed on issues I've found so far:</p>
  
  <p><strong>Custom Authentication</strong></p>
  
  <p>If you can write an Open ID provider as part of the app, use something like Python-OpenID and also implement a consumer in the same workflow so it appears like regular login. This way it integrates nicely into what the GAE Users API provides.
  I'm guessing if this is done right, users.get_current_user() will work just fine.</p>
  
  <p>If you want to skip writing your own OpenID provider and instead write an email/password auth system using Flask-Login integrating with NDB, that should be alright too. However, one puzzling bit of info in the <a href="https://developers.google.com/appengine/docs/python/users/userobjects" rel="noreferrer">GAE documentation</a> says I can instantiate a user object like so: </p>
  
  <p><code>user = users.User("XYZ@XYZ.com")</code></p>
  
  <p>However, (there is no <code>user.put()</code> method here) a <code>users.get_current_user()</code> still returns None. So what would the use of constructing the user object ever be?</p>
  
  <p><strong>Endpoints Authorization</strong></p>
  
  <p>On including a user=required in the method decorator for an Endpoint-Proto-Datastore rolled API, OAuth seems to work right away - all you have to do while testing it in the APIs explorer is to turn on the OAuth 2.0 switch and pick a valid Oauth 2.0 Scope. So does that mean that if we implement a OpenID provider that integrates with the Users API correctly, it won't be sufficient to use the OAuth magic of Endpoints API?</p>
  
  <p>Here too, it seems like constructing a user object will not help satisfy the authentication requirement. </p>
  
  <p>How would custom authentication / another OpenID implementation work with Endpoint API authentication/authorization? </p>