The scenario:
installing google apps marketplace app
user grant access using oauth2 and some predefined scopes
user clicks on a link after installation
since the user already gave access to the same app he is not forced to grant access again (as we have authentication in the app itself), but only to login if the current session is expired
The problem:
even we set the same app settings + scopes, it's asking twice for the "grant access" - in marketplace + our app
Clues so far:
if we wait (3-4 minutes) between marketplace grant access and clicking the app link .. it's working and it's NOT forcing the user to grant access again, so all cool.. apart from waiting time
if we use only the marketplace auth, the app permission is NOT present here: https://security.google.com/settings/security/permissions So even granted, I cannot revoke it from here
if we use auth in our app (the second one) - it's now present in the above link and can be revoked
I can see something's wrong, but can't figure out what. Is there some "google apps specific login" apart from the standard Google Auth APIs? Or what about that waiting moment and then all works good? All suggestions are welcome! :)
Related
I have a web app which sends emails (gmail) in name of my users
When a user registers, she supplies gmail account and password. Also she has to enable access for Less Secure Apps (I recommend to create a new account for this)
Then I can open a gmail session
session = Session.getInstance(props, new javax.mail.Authenticator() {
protected PasswordAuthentication getPasswordAuthentication() {
return new PasswordAuthentication(user.getEmail(), user.getPassword());
}
});
and send emails on her behalf.
Unfortunately this is going to stop working next 30th May, when Google will allow only OAUTH2 access
I have followed Java Quickstart for Gmail API and I have code up and running for sending emails with OAUTH2: enable gmail api, create an application on google cloud platform, grant send permission, oauth2 client id credential created...
The problem I have is I can't see a way to automatize this task because when creating an authorized credential, a consent screen displays on browser and you have to select the account to be granted manually (maybe because my app in google cloud platform is still pending to be reviewed)
Is there a way to infer the gmail account you want to access from the credentials file (client_secret.json)? Is there a way to automatize this?
No, or yes. It depends.
The whole point of OAuth2 is to improve security by working with authorization tokens rather than asking for user credentials. To do this the user has to consent to the app's access request, and thus the OAuth consent screen cannot be bypassed. This is
explained in Google's documentation. It's not related to your app's review status but rather it's the way OAuth works.
You can still work in a similar way, though . Instead of asking for username and password upon the user's registration you can redirect them to the OAuth consent screen so they can authorize your app. Make sure that your app is requesting offline access type and then you can retrieve an access_token and a refresh_token. These will essentially work as your credentials and you can use the refresh token to generate new access tokens when needed without having the user go through the consent screen each time.
The refresh token doesn't have a "natural" expiration so you can keep using it indefinitely, but there are a few scenarios where it will become invalid, such as it not being used for six months, the user changing passwords (if using Gmail scopes), the user manually revoking access, etc. In these cases you will need to direct them to the consent screen again to reauthorize your app.
In this sense, your app can still work automatically without user input except the initial setup, which you already had to deal with when they supplied you with their credentials. The refresh token expiration can even be compared to what you had to do when the users changed their passwords in your current workflow.
One exception to this are service accounts. If you and your users are part of a Google Workspace domain you can delegate domain-wide access to it, then the service account will be able to access user data without any manual input. Of course, this is because as the domain administrator you pretty much own all the accounts under it. But if you're working with a publicly available application you will have to deal with the limitations I mentioned above.
Sources:
Google's auth overview
Using OAuth 2.0 to access Google APIs
OAuth 2.0 for web applications
The OAuth consent screen
Users can go to account.google.com and revoke access from my site. How can I accomplish the same thing?
I have a site that uses Google authentication. The site, however, does not have a sign up process. New users are added by the site administrators. This is accomplished by simply adding their email to a list. This works fine in most cases. If a user comes to the site they are requested to authenticate with Google. I get their email if it is on the list I let them in. If it is not I tell them that they are not authorized to use the site.
If the user has multiple Google accounts logged in to their browser everything works fine. If the user has only one account signed in, and that is an authorized account all is well too. The next time they go to the site they are allowed in without authentication. Which is really cool.
However, if the one account they have signed in with on their browser is not authorized they are immideatly taken to the "You are not authorized" page. They are not given the opportunity to sign in with some other account.
If I could revoke the permission they granted to the site in Google (for unauthorized users), the next time they come to the site it would ask them to sign in again and give them the option of signing in with another account. Authorized accounts are typically work accounts. I am afraid that because the sign in process is so quick and easy, if someone accidentally signs in with their personal account on their phone they won't get a second chance to correct the error.
This is done by Revoking the token. Thanks #DalmTo
In some cases a user may wish to revoke access given to an application. A user can revoke access by visiting Account Settings. It is also possible for an application to programmatically revoke the access given to it. Programmatic revocation is important in instances where a user unsubscribes or removes an application. In other words, part of the removal process can include an API request to ensure the permissions granted to the application are removed.
Without changing my code or configuration, now google is asking users to grant permission every time when a user is trying to authenticate to my App. Even though the user already grated access and the scope didn't change.
I don't get any errors and the login works fine is just that now the google dialog asking for permissions appears every time.
To initialise google I use gapi.auth2.init with the "https://www.googleapis.com/auth/plus.profile.emails.read" as scope.
Also to request for access I use auth2.grantOfflineAccess.
I also checked in my Google account for Apps that have access and the application is registered successfully in there.
Anyone else has seen this issue? Or does know if google changed something in the way they handle permissions?
I believe I am seeing similar behavior... that the authentication flow has begun asking the user to grant the app permissions to the scopes every time they sign in. Previously, it would only proceed from sign-in to grant permissions the first time the user signed into the app. I haven't changed the scopes requested nor the underlying code recently... but also hadn't used the app in awhile (months?)
I'm using the oAuth2 server-side authentication and grantOfflineAccess() outlined here .
Given that there are no implementation details posted, i can't tell if the fix I found will apply to your situation.
The correction I found... so that the authentication only asks the user to grant the first time they sign into the app was to explicitly specify the "prompt" attribute when calling getOfflineAccess().
var auth2 = gapi.auth2.getAuthInstance();
auth2.grantOfflineAccess({
prompt : 'select_account'
}
).then(signInCallback);
https://developers.google.com/identity/protocols/OAuth2WebServer#offline
Check Step 1 prompt parameter
We're trying to figure out how to submit to the marketplace, but are not sure what we need to do to alter our existing signup flow to accomodate the SSO requirement
Our app was not originally built to be a marketplace app so our signup flow is built for individual users. We are already following the OAuth2 flow as outlined on this documentation page. However, its not clear to me how this works for an entire org when installing from the context of a marketplace app.
Does the admin grant access to all the individual scopes we currently request for the entire org at once? Is there need for some sort of service account or something since we currently are requesting offline access? I'd like to understand what changes we need to make to our server's signup flow in or whether it is just a scope / manifest mismatch.
We currently request the following scopes from an individual user when signing up.
['email', 'profile' ,'https://mail.google.com/', 'https://www.googleapis.com/auth/calendar'],
Exact questions are...
What (if anything) do we need to do to alter our current individual-focused signup flow to accommodate a Google Apps Admin signing up their whole domain?
What scopes do we need to in our Google Apps Admin listing and how do they relate to the scopes we currently request from individuals?
There are not so many changes if you are already using three legged OAuth2.
The first change would be in you project in the developer console. There you need to enable the Marketplace SDK and make the necessary configurations. Here you will add the scopes that your app will request and those are the scopes that the admin will see when installing the app.
The admin will see the scopes your app is requesting, and he will decide if it's ok to install the application in the domain. If it is approved, then yes, the admin would grant access to the entire domain.
Offline access is part of the Oauth flow, after you receive the refresh token, you can continue refreshing the access token without having the user to grant access again.
It is not necessary to have a service account. The service account has two purposes:
To manage information related to the application. In this case the service account can have access to it's own drive to store and retrieve information that is related to the app functionality.
Impersonation of users. When using domain delegation of authority, you can use a service account to impersonate any user in a domain and act on it's behalf to make API calls.
To deploy your app, you also have to create a new project in the Chrome Web Store, with a manifest for Marketplace.
To answer your questions:
It's not necessary that you modify your current oauth flow. The admin will install the app in the domain, but when a user access to the app, the process for authentication is the same as individual.
The scopes in your Marketplace SDK configuration should match the scopes your app will use. This is mostly for security reasons, it wouldn't be safe if you install an app with some scopes and then the app uses different scopes.
You can try your app before actually deploying it by adding trusted testers in the chrome web store dashboard or in the Console API configuration. This way you can check if your flows and all the configurations were done correctly.
Hope this helps. Let me know if you have more questions.
I am considering developing an application for the Apps for Business Marketplace. I see that new rules takes affect on November 19th. Referring to the new documentation (https://developers.google.com/apps-marketplace/) I do not see that any SSO requirement exists. There is allot of talk about migrating to new sign on methods, but I see no mention of sign on requirements.
What are the sign on requirements as of November 19th?
If SSO continues to be required or if I publish before Nov. 19th, my application requires security token from my API, in order to carry out API exchanges. To get this token a user/pass exchange is required one time. They would never need to enter a user/pass for my app after that. Will a one time exchange for the security token be denied under a SSO requirement?
For example the statement regarding SSO that an app cannot do is:
The end user should not be required to enter a username and password when invoking an application from within Google Apps. (https://developers.google.com/google-apps/marketplace/sso)
In my case it would not be required for the user to enter every time, just on the initial creation of the account. After that I would retain the token from my site, encrypted with the Installed App.
Would my app be denied for requiring this one time exchange under the SSO policy?
Mark
You will have to use SSO (or should if at all possible) -- see this part of the documentation: Besides, that is a better practice and should make your users feel more trust for your application.
From what I gather (note that I'm building my first marketplace app) you should not prompt users to enter username/password on your site. I am creating user record & storing token behind the scenes. So the user sees Google authorization screen, agrees to let my app use some data, accepts and sign-in right away without any prompt to create an account. After this, user will not be prompted in the future because I have their google id linked to a user record.
From their site - https://developers.google.com/google-apps/marketplace/sso#user_experience
As long as you don't have any intermediate screen, your app should be approved.