Google auth is invalid for this user.

[josephkandi]

We use GitHub Issues for bugs.

If you have a non-bug question, ask on Stack Overflow or Server Fault:

• https://stackoverflow.com/questions/tagged/parse.com
• https://serverfault.com/tags/parse

If you have a vulnerability disclosure, please follow our policy available here https://github.com/parse-community/parse-server/blob/master/SECURITY.md

You may also search through existing issues before opening a new one: https://github.com/parse-community/parse-server/issues?utf8=%E2%9C%93&q=is%3Aissue

--- Please use this template. If you don't use this template, your issue may be closed without comment. ---

Issue Description

Am trying to login with Google. I have used the Google OAuth 2 Playground and got an access token. Am passing the access token in the authData as follows

{ "username": "josephkandi", "authData": { "google": { "id": "username-without-@gmail.com" "access_token": "token-here" } } }

Steps to reproduce

My app is hosted on Heroku, so i have used the parse-server example, https://github.com/parse-community/parse-server-example.

I have updated my packages.json to the latest as follows :

"dependencies": { "express": "^4.16.3", "kerberos": "0.0.23", "parse": "^1.11.1", "parse-server": "^2.7.4" }

I use Postman and send a POST request to https://my-parse-server-url/parse/users/

Expected Results

Am supposed to get 201 created but instead i get the error :

{ "code": 101, "error": "Google auth is invalid for this user." }

Actual Outcome

What is happening instead.

Environment Setup

• Server

  • parse-server version (Be specific! Don't say 'latest'.) : 2.7.4
  • Operating System: Heroku
  • Hardware: Heroku
  • Localhost or remote server? heroku

• Database

  • MongoDB version: mlab, Heroku addon
  • Storage engine: [FILL THIS OUT]
  • Hardware: [FILL THIS OUT]
  • Localhost or remote server? Heroku

Logs/Trace

2018-04-04T20:07:18.458649+00:00 app[web.1]: verbose: REQUEST for [POST] /parse/users/: { 2018-04-04T20:07:18.458670+00:00 app[web.1]: "username": "josephkandi", 2018-04-04T20:07:18.458672+00:00 app[web.1]: "authData": { 2018-04-04T20:07:18.458674+00:00 app[web.1]: "google": { 2018-04-04T20:07:18.458676+00:00 app[web.1]: "id": "myemail", 2018-04-04T20:07:18.458679+00:00 app[web.1]: "access_token": "ya29.GluTBbIljEVZ8ZuPfNZg0l8BaoylumMqMmkFLFpZ9msncMvKXWh_h2ofrDQ9I-qj0-CTSQyIWslepBwe1ygB_y0WzatkrnBO0UovdVwbv26iRFtYaf9gkn5omSvu" 2018-04-04T20:07:18.458681+00:00 app[web.1]: } 2018-04-04T20:07:18.458682+00:00 app[web.1]: } 2018-04-04T20:07:18.458685+00:00 app[web.1]: } method=POST, url=/parse/users/, host=parse.peruzal.com, connection=close, accept-encoding=gzip, cf-ipcountry=ZA, x-forwarded-for=41.145.73.111, 172.68.186.57, cf-ray=40666681aa3f8064-CPT, x-forwarded-proto=http, cf-visitor={"scheme":"https"}, x-parse-application-id=my-app-id, content-type=application/json, cache-control=no-cache, postman-token=ab113afa-78c2-4414-962d-ce51d03bddca, user-agent=PostmanRuntime/7.1.1, accept=*/*, cookie=__cfduid=d8327f1e50a2c7db19b3091e5f4b147501522793473, cf-connecting-ip=41.145.73.111, x-request-id=76657b5e-e223-4292-af15-249a8f75fb94, x-forwarded-port=80, via=1.1 vegur, connect-time=1, x-request-start=1522872438434, total-route-time=0, content-length=261, username=josephkandi, id=myemail, access_token=ya29.GluTBbIljEVZ8ZuPfNZg0l8BaoylumMqMmkFLFpZ9msncMvKXWh_h2ofrDQ9I-qj0-CTSQyIWslepBwe1ygB_y0WzatkrnBO0UovdVwbv26iRFtYaf9gkn5omSvu 2018-04-04T20:07:18.569037+00:00 app[web.1]: error: Error generating response. ParseError { code: 101, message: 'Google auth is invalid for this user.' } code=101, message=Google auth is invalid for this user. 2018-04-04T20:07:18.572271+00:00 app[web.1]: error: Google auth is invalid for this user. code=101, message=Google auth is invalid for this user. 2018-04-04T20:07:18.574979+00:00 heroku[router]: at=info method=POST path="/parse/users/" host=parse.peruzal.com request_id=76657b5e-e223-4292-af15-249a8f75fb94 fwd="41.145.73.111,172.68.186.57" dyno=web.1 connect=1ms service=138ms status=404 bytes=591 protocol=http

[flovilmart]

What are you using for the id/access_token? How to you acquire them?

[josephkandi]

I acquire them using the Google Oauth 2.0 Playground website, https://developers.google.com/oauthplayground/.

When i test this using the Playground on this url https://www.googleapis.com/oauth2/v3/tokeninfo?access_token=token-here it works fine

[flovilmart]

And the id corresponds the the acquired ID?

[josephkandi]

The id is my email username. You dont acquire an id from that endpoint but you get the an id_token, is the id the id_token? I thought from code here

function validateAuthData(authData) { if (authData.id_token) { return validateIdToken(authData.id, authData.id_token); } else { return validateAuthToken(authData.id, authData.access_token).then(() => { // Validation with auth token worked return; }, () => { // Try with the id_token param return validateIdToken(authData.id, authData.access_token); }); } }

It check i passed in the id_token or the access_token. Clearly though using the id_token doesn't seem to work when testing with the Google OAuth 2 playground.

I will try get the access_token with code and see if that works. It probably should work first because my app have the Google App ID on the client side, and when i login, i need to authorize that. When i use playgrounds, am authorizing a different app.

This is the part i didnt understand how parse is working, for which app configured on google does it verifies the token?

[flovilmart]

The id is this case is clearly not the email username, but the user id for the google services, provided by google after you make your oauth authentication calls.

If you have an id_token, you can pass id/id_token pair instead of id/access_token, both are supported

[josephkandi]

Am using the client id from the Google Console API for the iOS app, and still nothing. I have decoded the id_token i got and its a valid oauth2 token.

I tried sending that and still i get the same error. Am getting a 404 response code with the error :

{ "code": 101, "error": "Google auth is invalid for this user." }

I have used the access token and still same error. I have run out things to test now.

[josephkandi]

Using the app i can retrieve my profile details on this endpoint https://www.googleapis.com/oauth2/v2/userinfo using the access_token i get on the app. The same access token am unable to authenticate with parse to login a user.

[flovilmart]

Yes because you need to provide the user ID from google. As long as you pass the id as an email, this won’t work. As for how to acquire the id for the google user, check the google login documentation.

See: https://developers.google.com/identity/protocols/OAuth2

[josephkandi]

Am not passing the id as email, am using the client id from Google API console.

Using Postman, i can make the same request using the access token and get back the following :

{ "azp": "21547282892-gc6ih5922efrnpvlgh7fh25n40m3it7d.apps.googleusercontent.com", "aud": "21547282892-gc6ih5922efrnpvlgh7fh25n40m3it7d.apps.googleusercontent.com", "sub": "112694148092739840900", "scope": "https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/plus.me", "exp": "1522886440", "expires_in": "1212", "email": "josephkandi@gmail.com", "email_verified": "true", "access_type": "offline" }

Which is correct, but somehow the server returns a 404 not found when i use the same token to login with parse.

How can i debug this locally? I might just need to go through the code locally and put a break point and see whats really happening.

[josephkandi]

Clearly the issue is not with the token. The token works as i have used it in two places, using Postman locally and on the Google OAuth 2 Playground. I have also decoded the id_token and its a valid jwt token. So those are valid and not the issue.

[flovilmart]

As per the documentation, parse requires a user id that identifies uniquely your user in the scope of the google authentication. https://github.com/parse-community/parse-server/blob/master/src/Adapters/Auth/google.js#L8

In your case, given the response, you should probably pass the subvalue as the id:

id: "112694148092739840900",
access_token: access_token

[josephkandi]

Still that does not work

[flovilmart]

This should work, double check your parameters, id, id_token or access_token and make sure you pass the right values. I can assure you it works, as we use it in production currently.

[josephkandi]

Nope, checked and re-checked. No joy. Why do i get a 404 not found from parse?