Enabling Oauth2sso in the Google App Engine

Question

I am trying to set spring oauth2 security setting in my app in google app. Everything seems to work fine locally, but when I deploy the application, everything starts to break down. After I authenticate via google, it redirects me to the Whitelabel error page. In the console, I see this error:

http://my-application.appspot.com/login?state=t…m&session_state=8b67f5df659a8324430803973b9e1726e39fd454..1ae3&prompt=none 401 (Unauthorized) 

I configure my auth with this application.yml file:

 security: oauth2: client: clientId: client-key clientSecret: secret-key accessTokenUri: https://www.googleapis.com/oauth2/v4/token userAuthorizationUri: https://accounts.google.com/o/oauth2/v2/auth clientAuthenticationScheme: form scope: - openid - email - profile - https://www.googleapis.com/auth/cloud-platform resource: userInfoUri: https://www.googleapis.com/oauth2/v3/userinfo preferTokenInfo: true 

My security configuration looks something like this:

 @Override protected void configure(HttpSecurity http) throws Exception { http.csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()) .and() .authorizeRequests() .antMatchers("/static/**").permitAll() .antMatchers("/**").hasAuthority("ROLE_ADMIN") .anyRequest().authenticated() .and() .exceptionHandling() .accessDeniedPage("/403"); } 

I set the Oauth id on google credential pages to allow authorized javascript roots:

 http://my-application.appspot.com https://my-application.appspot.com http://localhost:8080 

And the allowed redirect URIs are:

 http://my-application.appspot.com/login https://my-application.appspot.com/login http://localhost:8080/login 

Any ideas why I can get unauthorized errors after deploying to GAE?

Thanks,

Craig

Answer 1

Your problem is authorization, perhaps a missing step on a fully authorization application, for example, moving your client_secret.json to your working directory.

https://developers.google.com/drive/v3/web/quickstart/java#step_1_turn_on_the_api_name

Step 1: Enable Drive API

• Use this wizard to create or select a project in the Google Developer Console and automatically enable the API. Click Continue, then go to your credentials. In the Add Credentials window of the project page, click the "Cancel" button.

  2. At the top of the page, select the OAuth consent screen tab. Select an email address, enter the product name, if it is not already installed, and click the "Save" button. Select the Credentials tab, click Create. account and select the OAuth client ID.

  3. Select the Other application type, enter the name "Drive API Quickstart" and click the "Create" button.

  4. Click OK to close the dialog box.

  5. Click the file_download (Download JSON) button to the right of the client ID.

  6. Move this file to your working directory and rename it client_secret.json.

Useful link: GCM http 401 authorization error