-1

I'm using the Microsoft.Owin.Security.Google (version 3.0.1) middlware to provide Google OAuth to my app.

It's configured like so:

app.UseGoogleAuthentication(new GoogleOAuth2AuthenticationOptions
{
    AuthenticationType = "Google",
    Caption = "Google",
    SignInAsAuthenticationType = signInAsType, // "idsrv.external"
    ClientId = "xxx.apps.googleusercontent.com",
    ClientSecret = "xxx"
});

Pretty simple stuff. I'm using IdentityServer as the MW to issue the claims.

When i first authenticate the user with Google, Google asks for the following consent from the user: enter image description here

Which makes total sense, as i'm requesting openid profile email scopes in the URL:

https://accounts.google.com/o/oauth2/auth?scope=openid profile email&response_type=code&redirect_uri=https://localhost:44301/core/signin-google&state=xxx&client_id=111.apps.googleusercontent.com&hl=en-GB&from_login=1&as=-25fb4219b2997893&authuser=0

I then accept, and all works well.

Now, after i logout, then re-authenticate again - from now on Google keeps asking me for "offline access":

enter image description here

I've not asked for offline access scope, so confused why Google is asking for this?

Confirmed the URL looks fine:

https://accounts.google.com/o/oauth2/auth?scope=openid profile email&response_type=code&redirect_uri=https://localhost:44301/core/signin-google&state=xxx&client_id=111.apps.googleusercontent.com&hl=en-GB&from_login=1&as=676f55265a78c036&authuser=0

So exactly the same URL as the first request.

I have tried:

  1. Turned on Google+ API in API console
  2. Tried adding &prompt=auto (causes error "Invalid parameter value for prompt: Invalid prompt: auto")
  3. Tried adding access_type=online (even though this is the default, if not provided).
  4. Tried adding approval_prompt=auto

None of those techniques have worked.

Any ideas?

RPM1984
  • 72,246
  • 58
  • 225
  • 350

2 Answers2

1

Appeared to be localhost issue. Once deploy to server, worked fine :/

RPM1984
  • 72,246
  • 58
  • 225
  • 350
0

The offline_access scope value requests an OAuth 2.0 refresh token.

If you're not requesting this, then it sounds like something built into the OWIN Google component or the Google API.

You can read more about the offline access scope here: http://openid.net/specs/openid-connect-core-1_0.html#OfflineAccess

Scott Brady
  • 5,498
  • 24
  • 38
  • Thanks, but like i said im not requesting access (check my url params). I haven't configured anything extra in the google owin MW. Anyway, i think it was a localhost issue – RPM1984 Jan 10 '16 at 10:13
  • I have the same experience with Google and localhost – Tony Basallo May 15 '16 at 19:58