I have published an app on the Google Apps Marketplace. My project includes all the required scopes and yet these are not present when the app is installed meaning that following installation the user is being asked for permission to use scopes which should already be enabled - this breaks SSO.
Scopes are listed - as you can see here: https://workbooks.box.com/s/p7qpsx6uotwj5eg6ltrg
... /auth/userinfo.email
... /auth/userinfo.profile
... /auth/calendar
... /auth/tasks
... /auth/drive
... /auth/admin.directory.user.readonly
and half a dozen APIs are enabled.
But the Marketplace app lacks half of the requested scopes: https://workbooks.box.com/s/wnuy6cs8i7rzpoc2526t
Is this a bug in the publishing mechanism? Or have I missed out a step?
In Admin console go to "Security > Advanced Settings > Manage API client access" there you can see the actual scopes requested by the app after installing it.
Some scopes require the user to grant the application permission to access certain information, even when the domain administrator already installed and granted said scopes. The user should be asked just one time to grant permission for the scopes. Only when new scopes are requested, the user may be asked to grant permission to those new scopes.