GoogleWebAuthorizationBroker.AuthorizeAsync doesn't support multiple scopes

[bilal-fazlani]

This bug is about Google.Apis.Auth nuget package

private static UserCredential CreateCredential()
        {
            string[] scopes = { CalendarService.Scope.Calendar, GmailService.Scope.GmailReadonly};
            UserCredential credential;

            using (FileStream stream = new FileStream("client_secret.json", FileMode.Open, FileAccess.Read))
            {
                string credPath = "userCredentials";

                credential = GoogleWebAuthorizationBroker.AuthorizeAsync(
                    GoogleClientSecrets.Load(stream).Secrets,
                    scopes,
                    "user",
                    CancellationToken.None,
                    new FileDataStore(credPath, true)).Result;
                
                Console.WriteLine("Credential file saved to: " + credPath);
            }
            return credential;
        }

This code is copied from google's help page here: https://developers.google.com/gmail/api/quickstart/dotnet

The only issue here is that, when I add other scopes to the array, it compiles & runs but only considers the first element of the array of scopes and the 2nd scope in array is ignore. When it opens the browser for the user to log in and allow the application to read or make changes, that screen only shows information about first scope in the array. In the example above, it will only ask for calendar permissions. This results in 403 status from google when it tries to perform gmail operations.

I have tried to switch the order of scopes in array and verified that it only works for 1st element of array.

[LindaLawton]

Which 403 error exactly?

I do this all the time so unless something broke in the last two days I think something else is wrong. Try changing "user" and double check that you have enabled both apis in dev console

[bilal-fazlani]

Hi Linda, Its insufficient permissions 403 error and yes, both apis are enabled in dev console. It works when I only provide one element of scope in scope array. When I provide more, user is asked for permissions only for the forst scope in array. Its pretty easy to reproduce. Let me know if you any more info on this. I will be glad to provide. Thanks Bilal

…

On Wed, Jul 12, 2017, 1:07 AM Linda Lawton ***@***.***> wrote: Which 403 error exactly? I do this all the time so unless something broke in the last two days I think something else is wrong. Try changing "user" and double check that you have enabled both apis in dev console — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#1051 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ADPSr-U78vx7tKW_-NWaWgRD6bJ3HGvxks5sM87jgaJpZM4OUtbt> .

[chrisdunelm]

I cannot reproduce this.
With the code posted above, it opens the browser asking for both Gmail and Calendar permissions, as expected.

When changing the scopes, I did have to delete the file stored in the FileDataStore to cause the full auth process to be triggered, but all still worked as expected.

[chrisdunelm]

Closing. Please re-open if this is still occurring; preferably with instructions on how to reproduce.

[slimCODE]

I do have the same issue. I'm using the following scopes:

        static string[] Scopes = 
        {
            ClassroomService.Scope.ClassroomCourses,
            ClassroomService.Scope.ClassroomCourseworkStudents
        };

In that order:

• The authorization page will display "Manage your Google Classroom classes"
• The service.Courses.List() request will succeed
• service.Courses.CourseWork.List(courseId) requests will fail with a 403

If I switch the order:

• The authorization page will display "Manage course work and grades for students in the Google Classroom classes you teach and view the course work and grades for classes you administer"
• The service.Courses.List() request will fail with a 403
• A service.Courses.CourseWork.List(courseId) request with a course Id returned in the test above will succeed

Notes:

• The sample app is a .NET Core 1.1 project (C#)
• References Google.Apis.Classroom.v1 (1.29.1.977) via NuGet
  • Itself references Google.Apis.Auth (1.29.1)
• Changing the scopes doesn't pop-up the authorization page again. I have to delete the file under our FileDataStore. I would have assumed this would be detected.

[chrisdunelm]

Hmm, interesting.
@slimCODE are you able to post a minimal repro in a .NET Core 1.1 console app?
Previously I was unable to repro this problem myself, so your exact code would really help. Thanks.

[slimCODE]

Here you go:

https://gist.github.com/slimCODE/f1b7e3473035a850d4e0da175e59cd9c

[chrisdunelm]

@slimCODE thanks for the gist. I'll look at this shortly.

[chrisdunelm]

@slimCODE Thanks for the code, I've reproduced the problem in a .NET Core 1.1 console app.
The problem does not occur in a Windows desktop console app.
I'll investigate...