Search code examples
google-oauthsingle-sign-ongmail-api

Google SSO not asking for scope for just one user (other users OK)

I'm seeing a strange problem with google SSO and one of my users.

I'm requesting the following scopes using the oauth:

    const url = oauth2Client.generateAuthUrl({
      access_type: 'offline', // we want refresh tokens
      scope: ['email'],
      state: '{...}',  //state object
      prompt: 'consent', 
      hd: 'example.com', // restrict to just our domain
      include_granted_scopes: true,
    });

For every other user redirected to url, they are given a consent screen after authenticating that looks like this:

enter image description here

EXCEPT for one user. For this user - when they authenticate, there is no consent screen, and they are logged in with the bare minimum scope.

When the user looks at their account security page, they see our webapp as authorized with no scope. I've asked the user to revoke the app permissions and to try logging in again, but the same thing happens. They are logged in with no consent screen and no scope. Again, the strange thing is that it is only occurring for this one user.

Solution

  • The culprit in this case was:

    include_granted_scopes: true,

    The other users for whom the consent screen was shown had at some time in the past been given the correct scope, and granted permission. Therefore, on any subsequent grant, the consent screen showed the previously granted scopes. The source code, at some point, changed and removed those particular scopes (and thus, we were only left with the email scope as shown in the question.

    Interestingly, the email scope does not have to be consented to, and is automatic so it returned the user to our app with that granted scope, having never showed the consent screen to that one user.

    Changing the scope to actually include the correct scopes now allows all users to see the consent screen and grant the proper scopes:

        const url = oauth2Client.generateAuthUrl({
      access_type: 'offline', // we want refresh tokens
      scope: ['email',
              'https://www.googleapis.com/auth/gmail.readonly',
              'https://www.googleapis.com/auth/gmail.labels',
              'https://www.googleapis.com/auth/gmail.modify',
             ],
      state: '{...}',  //state object
      prompt: 'consent', 
      hd: 'example.com', // restrict to just our domain
      include_granted_scopes: true,
    });