Google responds with 12500

vicatcu commented 6 years ago

I'm trying to integrate The Ionic Google Plus Native Plugin to allow users to log into my app from their phone using Google Login. This is just a wrapper around this library.

I think I'm just about all the way there. I have a button on my login screen and when I click it on my Android phone, I am confronted with the expected "Choose an account" screen. But when I actually do tap on one of my accounts and look at what happened in Chrome Dev Tools (by way of Remote Debugging), I see that an error resulted, cryptically denoted 12500 with a useless stack-trace.

It seems that a handful of stars need to align to get this to work, and it's not entirely clear how I can get this to work concurrently in Development and Production modes. Here's what I've checked:

In Google APIs & Services => Credentials dashboard
- I have two OAuth 2.0-client IDs for Android, one is meant for Development and one is meant for Production.
- Both of these are configured with the same Package name, which is the fully qualified name in the Android manifest file, named starting with "com.blah.blah.blah" which is also the widget id in the config.xml file
- Each of these is configured with a different Signing-certificate fingerprint, which I established using keytool.
  - For Production, I generated the SHA1 fingerprint from the keystore file I use to sign the app for production.
  - For Development, I generated the SHA1 fingerprint by extracting the debug APK generated by ionic cordova run android, and running keytool on the contained META-INF/CERT.RSA file.
In the Ionic project's config.xml file
- I have a section that looks like this:

<plugin name="cordova-plugin-googleplus" spec="^5.3.2">        
    <variable name="REVERSED_CLIENT_ID" value="com.googleusercontent.apps.ABCDEFG-12345" />
    <variable name="WEB_APPLICATION_CLIENT_ID" value="ABCDEFG-12345.apps.googleusercontent.com" />
    <variable name="PLAY_SERVICES_VERSION" value="11.8.0" />
</plugin>

I've been substituting for ABCDEFG-12345 above the Production or Development unique client id part there, I don't see a clear way to support both at once except maybe as a custom build step.

In the Typescript for the page with my login button, for now, I'm just doing this:

import { GooglePlus } from '@ionic-native/google-plus
...
constructor(public googlePlus: GooglePlus){}
...
login() {
  this.googlePlus.login({
    webClientId: 'ABCDEFG-12345.apps.googleusercontent.com',
    offline: false
  })
  .then(res => console.log(res))
  .catch(err => console.error(err));
}

Again here, substituting ABCDEFG-12345 above the Production or Development unique client id part there, I don't see a clear way to support both at once except maybe as a custom build step.

When I tap the button, I just get the 12500 error in Development mode. I haven't tried in Production mode. What the heck am I missing and how do I get to the bottom of it?

Cross Posted on Stack Overflow here (not much traction).

barbaragavalda commented 6 years ago

Same problem here!

vicatcu commented 6 years ago

@barbaragavalda consider up-voting cross-referenced stack overflow post as well

barbaragavalda commented 6 years ago

@vicatcu I've managed to solve the problem after days. I just erased the webClientId parameter: and it works!

vicatcu commented 6 years ago

@barbaragavalda I'll try it... do you know if it works on both Android and iPhone?

vicatcu commented 6 years ago

@barbaragavalda CRAZY. That actually works (almost).

Omitting all options from the call to this.googlePlus.login (that is, passing an empty object, {}) I don't get the error, but this.googlePlus.login, I get back a user object in response. However, I do not get back (at least on Android) an idtoken (which I can pass to my server-side code). So my object looks like this:

{
  accessToken: "XXXXXXXXXXX"
  displayName: "XXXXXXXXXXX"
  email: "XXXXXXXXXXX"
  expires: XXXXXXXXXXX
  expires_in: XXXXXXXXXXX
  familyName: "XXXXXXXXXXX"
  givenName: "XXXXXXXXXXX"
  userId: "XXXXXXXXXXXX"
}

Any ideas how to get an idtoken in the callback object?

Aside: @EddyVerbruggen what gives? Do the docs need an update or what?

barbaragavalda commented 6 years ago

It would work for iOS without any parameters because it is not required. And I guess you don't obtain the idtoken because the webClientId is required to get this field according to the documentation: https://github.com/EddyVerbruggen/cordova-plugin-googleplus#usage

'webClientId': 'client id of the web app/server side', // optional clientId of your Web application from Credentials settings of your project - On Android, this MUST be included to get an idToken. On iOS, it is not required.

EddyVerbruggen commented 6 years ago

@vicatcu Dunno, if you think it does please send a PR.

allanpoppe commented 5 years ago

I'm also having this issue, with no lucky of success.

joao-pedro-alves commented 5 years ago

Same issue here... I can`t find any solution anywhere...

yuvarajnaga commented 5 years ago

I'm also having this issue

joao-pedro-alves commented 5 years ago

Guys, i figured out how to solve it.

In your config.xml, line 2, the ID attribute of the tag <widget> MUST BE the same as the package name in Google Console.

In my case, my widget in config.xml is (line 2) <widget id="com.vitrinedarua.app" version="0.0.1" xmlns="http://www.w3.org/ns/widgets" xmlns:cdv="http://cordova.apache.org/ns/1.0">

So i put the same ID into package name in my credential in Google. See print

Dont forget to run/build your app signing it to the keystore file you generated the fingerprint!

vicatcu commented 5 years ago

@joao-pedro-alves thanks for replying, but I don't know where I'm going wrong still. How did you figure out where things went wrong for you? I'm getting back an object but it doesn't include an id_token field, which is critical to trusting the contents of the object on the back-end (reference).

milankragujevic commented 5 years ago

@vicatcu I either don't get a valid response (error 12500) or if I ommit the client ID I get the accessToken but not id_token. So I really don't know what to do, signature of final build matches the one in Google's console, name of app is the same, checked all configs everything is A-OK, but auth doesn't work. This is a real showstopper for me. I'm gonna try and fix it in the plugin's side, if I manage that I'll create a fork and submit a PR to @EddyVerbruggen. I only hope I can fix it 👍

milankragujevic commented 5 years ago

For posterity, here's the logcat:


11-21 20:31:42.541 18473 18586 I GooglePlugin: Building Google options
11-21 20:31:42.558 18473 18586 I GooglePlugin: Building GoogleApiClient
11-21 20:31:42.598 18473 18586 I GooglePlugin: GoogleApiClient built
11-21 20:31:42.598 18473 18586 I GooglePlugin: Trying to Log in!
11-21 20:31:42.648 18473 18586 W PluginManager: THREAD WARNING: exec() call to GooglePlus.login blocked the main thread for 109ms. Plugin should use CordovaInterface.getThreadPool().
11-21 20:31:43.546 18607 18607 I GoogleHttpClient: GMS http client unavailable, use old client
11-21 20:31:45.919 18473 18473 I GooglePlugin: In onActivityResult
11-21 20:31:45.920 18473 18473 I GooglePlugin: One of our activities finished up
11-21 20:31:45.920 18473 18473 I GooglePlugin: Handling SignIn Result
11-21 20:31:45.921 18473 18473 I GooglePlugin: Wasn't signed in
11-21 20:31:46.680 18627 18723 W Auth    : [GoogleAuthUtil] GoogleAuthUtil
11-21 20:31:51.817 18473 18586 I GooglePlugin: Building Google options
11-21 20:31:51.817 18473 18586 I GooglePlugin: Building GoogleApiClient
11-21 20:31:51.825 18473 18586 I GooglePlugin: GoogleApiClient built
11-21 20:31:51.825 18473 18586 I GooglePlugin: Trying to Log in!
11-21 20:31:51.848 18473 18586 W PluginManager: THREAD WARNING: exec() call to GooglePlus.login blocked the main thread for 33ms. Plugin should use CordovaInterface.getThreadPool().
11-21 20:31:52.603 18473 18473 I GooglePlugin: In onActivityResult
11-21 20:31:52.603 18473 18473 I GooglePlugin: One of our activities finished up
11-21 20:31:52.604 18473 18473 I GooglePlugin: Handling SignIn Result
11-21 20:31:52.604 18473 18473 I GooglePlugin: Wasn't signed in```

joao-pedro-alves commented 5 years ago

It's not the plugin's side! It's working properly for me now after I did what i said in the last comment.

@vicatcu I followed this tutorial: https://www.youtube.com/watch?v=TCcvji4ow40

And then when i got the 12500 error i did what i mentioned in the last comment. It's working fine for me.

I also created a build.json file in the root ionic folder with some instructions pointing to my keystore.

{
    "android": {
        "release": {
            "keystore": "project.keystore",
            "storePassword": "MY_KEYSTORE_PASSWORD",
            "alias": "MY_KEYSTORE_ALIAS",
            "password" : "MY_KEYSTORE_PASSWORD",
            "keystoreType": "JKS"
        }
    }
}

Then I test it running the command: cordova run --prod --release

vicatcu commented 5 years ago

@joao-pedro-alves are you getting back a id_token field? Without it you can't follow google guidance on server side authentication. https://developers.google.com/identity/sign-in/web/backend-auth

joao-pedro-alves commented 5 years ago

@joao-pedro-alves are you getting back a id_token field? Without it you can't follow google guidance on server side authentication. https://developers.google.com/identity/sign-in/web/backend-auth

Yes, i'm. Everything working fine since I posted the solution.

vicatcu commented 5 years ago

@joao-pedro-alves how did you get / create the values in this object? Is there a step-by-step guide online?

{
    "android": {
        "release": {
            "keystore": "project.keystore",
            "storePassword": "MY_KEYSTORE_PASSWORD",
            "alias": "MY_KEYSTORE_ALIAS",
            "password" : "MY_KEYSTORE_PASSWORD",
            "keystoreType": "JKS"
        }
    }
}

joao-pedro-alves commented 5 years ago

@joao-pedro-alves how did you get / create the values in this object? Is there a step-by-step guide online?

{
    "android": {
        "release": {
            "keystore": "project.keystore",
            "storePassword": "MY_KEYSTORE_PASSWORD",
            "alias": "MY_KEYSTORE_ALIAS",
            "password" : "MY_KEYSTORE_PASSWORD",
            "keystoreType": "JKS"
        }
    }
}

I mentioned what I did https://github.com/EddyVerbruggen/cordova-plugin-googleplus/issues/547#issuecomment-440825069

vicatcu commented 5 years ago

@joao-pedro-alves I watched that video and it makes no mention of using build.json unfortunately

joao-pedro-alves commented 5 years ago

The build.json is in Cordova documentation.

asoap commented 5 years ago

I ran into this issue during development, and resovled it. It just re-appeared again while I'm pushing my project to release on Android.

For me I have three credentials inside of google: Android, iOS, and Web.

For android I use the web client id. But for some reason it also uses the android signature. You have to use this to get the SHA1 signature to save inside of google. keytool -exportcert -keystore path-to-debug-or-production-keystore -list -v

For me everything was working fine until I went to release, but this popped up again. I had to re-run this command again on the release certificate, and now it's suddenly working again.

I am also using build.json and for that it requires a few steps. Creating the certificate, creating build.json and then debugging build.json.

Then creating the APK by running this command cordova build android --release --buildConfig

To give people more info this is what I used to create the signature: http://docs.phonegap.com/phonegap-build/signing/android/

keytool -genkey -v -keystore [keystore_name].keystore -alias [alias_name] -keyalg RSA -keysize 2048 -validity 10000

And in my build.json I had to fill out keystore file location, storePassword, password, and alias.

Hope this helps people.

publicbar commented 5 years ago

I cannot get this to work, yet I had a debug version working fine for a while. I rebuilt the lot but still cannot get past a 12500 response. I do no use firebase.

PS: The dashboard in console.developers.google.com has never recorded any activity...

I've got Android credential setup <- use the clientId from this. I've got the Web credential setup <- used this on my backend to validate login on my server.

This was working.

Signatures match from keystore to developer console.
Widget Package names match

I've redone the platform directory. I've run out of ideas as to what is wrong.

Any new ideas ? Please ?

shinji1985 commented 5 years ago

same error! It often works well. but it often doesnt work! Ive checked all required information - SHA1, widget id, etc - its working strangely.

shinji1985 commented 5 years ago

I resolved this problem. It was because of SHA-1 difference. I thought i was using correct one. Because when i run my app in my device, everything work well.

My problem occurred when i upload my app to google play and share it with my friends using internal test via google play url. it was resolved by the document below.

Publishing your app in Google Play Store Google re-signs your app with a different certificate when you publish it in the Play Store. Once your app is published, copy the SHA-1 fingerprint of the "App signing certificate", found in the "App signing" section under "Release Management", in Google Play Console. Paste this fingerprint in the Release OAuth client ID in Google Credentials Manager.

SHA-1 fingerprint seems to be changed through Google Play. so we need to get correct SHA-1 value from that page above in google play.

vicatcu commented 5 years ago

I got it working too, but mostly by ignoring the instructions in the README and following various threads of advice on here and on stack overflow. I didn't use Firebase, but did the Google API setup "from scratch" instead. Ultimately, I think this issue is a documentation problem.

EddyVerbruggen commented 5 years ago

Please send a PR if tou think something’s off.

Nexeuz commented 5 years ago

I fixed it signing APK thanks

techboycr commented 5 years ago

Same problem her, but this shows up after signing process and Google Store publishing.

Can figure out why. My id is the same as google console and all that, this just append after publishing.

jsitu commented 5 years ago

@vicatcu can you please post the steps you took to solve the issue?

rcauquil commented 5 years ago

having the same issue here with ionic1 and firebase...

vicatcu commented 5 years ago

Here's what my Google API Console looks like for the project.

... and here's what each of those looks like (with redactions) when you drill down into them:

Other than that, I tried to follow along closely with https://codesundar.com/ionic-login-with-google-plus as well as using a Cordova build.json file as recommended earlier in this thread.

rcauquil commented 5 years ago

@vicatcu any news ? I finally got it to work but i'm using firebase in the process as well

neerajsaxena0711 commented 5 years ago

@vicatcu I had the exact same issue as yours, the issue with me was I was using the wrong web client id. Check it again.

prashanteb commented 5 years ago

I have solved it by changing REVERSED_CLIENT_ID if client id 123-xyz.apps.googleusercontent.com then you need to reverse it com.googleusercontent.apps.123-xyz

Example: Client id in google develper tool is : 123-xyz.apps.googleusercontent.com and command below is with reverse client id

cordova plugin add cordova-plugin-googleplus --save --variable REVERSED_CLIENT_ID=com.googleusercontent.apps.123-xyz

mrunalkh9595 commented 5 years ago

https://stackoverflow.com/a/46123932/12267258 refer this for sha1 issue

rajngarg commented 4 years ago

{ 'webClientId': 'CLIENT_ID', 'offline': true }

do this instead of

{ webClientId: 'CLIENT_ID', offline: true }

worked for me

EddyVerbruggen / cordova-plugin-googleplus

Google responds with 12500 #547