search

EionRobb / purple-hangouts

47 stars 4 forks source link

Cannot authenticate "Error: invalid_scope" #71

Open EionRobb opened 8 years ago

EionRobb commented 8 years ago

Original report by Eion Robb (Bitbucket: EionRobb, GitHub: EionRobb).

When trying to authenticate in the browser with the plugin at the url https://accounts.google.com/o/oauth2/auth?client_id=936475272427.apps.googleusercontent.com&scope=https://www.google.com/accounts/OAuthLogin&redirect_uri=urn:ietf:wg:oauth:2.0:oob&response_type=code there is an error message

Error: invalid_scope.

EionRobb commented 8 years ago

Original comment by Diego Carrión (Bitbucket: 0x783czar, ).

I started getting is error last Friday too, on two different accounts.

EionRobb commented 8 years ago

Original comment by Richard Schuster (Bitbucket: richtubesockss, ).

I get this error, and have tried changing the scope url parameter to the various scopes on https://developers.google.com/+/web/api/rest/oauth#authorization-scopes

They succeed and give me a code, but pidgin gives me an auth error upon creating the account using each code I've tried.

I double-checked on https://developers.google.com/oauthplayground/ and re-tried the url with all of the following scopes under "Google OAuth2 API v2," space-delimited (as per google documentation):

[https://accounts.google.com/o/oauth2/auth?client_id=936475272427.apps.googleusercontent.com&scope=https://www.googleapis.com/auth/plus.login https://www.googleapis.com/auth/plus.me https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile&redirect_uri=urn:ietf:wg:oauth:2.0:oob&response_type=code](https://accounts.google.com/o/oauth2/auth?client_id=936475272427.apps.googleusercontent.com&scope=https://www.googleapis.com/auth/plus.login https://www.googleapis.com/auth/plus.me https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile&redirect_uri=urn:ietf:wg:oauth:2.0:oob&response_type=code)

The request succeeds and gives me a code but I still get an auth error in pidgin. I don't see another sensible scope to try.

As a last-ditch effort I tried adding guesses and got this error as a response:

Error: invalid_scope

Some requested scopes were invalid. {valid=[https://www.googleapis.com/auth/plus.login, https://www.googleapis.com/auth/plus.me, https://www.googleapis.com/auth/userinfo.email, https://www.googleapis.com/auth/userinfo.profile], invalid=[OAuth2, oauthlogin, oauth2login, OAuthLogin, OAuth2Login, oauth2, oauth, OAuth]}

EionRobb commented 8 years ago

Original comment by Anagh (Bitbucket: anaghzaccount, GitHub: anaghzaccount).

https://accounts.google.com/o/oauth2/auth?client_id=936475272427.apps.googleusercontent.com&scope=https://www.googleapis.com/auth/plus.login&redirect_uri=urn:ietf:wg:oauth:2.0:oob&response_type=code

I used Richard's first url and added a response type, it generated a code. The Google page says "Sign in to Google Search, Play and other Google apps on your Android TV.", and the generated code gives auth error on pidgin. Maybe tweak the code a bit?

EionRobb commented 8 years ago

Original comment by Eion Robb (Bitbucket: EionRobb, GitHub: EionRobb).

This is mentioned on the front page of the plugin, but pasting here in case it's missed:

"...if you still have a working Hangouts on an existing version of Pidgin you can copy the access token out of the 'password' field in your ~/.purple/accounts.xml and paste that into the new accounts.xml while Pidgin is not running."

Edit: oh, and that this is also being tracked in the hangups issue tracker since other 3rd party Hangouts apps/plugins aren't working https://github.com/tdryer/hangups/issues/260

EionRobb commented 8 years ago

Original comment by Eion Robb (Bitbucket: EionRobb, GitHub: EionRobb).

Theres a workaround to get the OAuth code at https://github.com/tdryer/hangups/issues/260#issuecomment-246578670 with a How-To video at https://www.youtube.com/watch?v=hlDhp-eNLMU

EionRobb commented 8 years ago

Original comment by Michael Romeos (Bitbucket: mromeos, GitHub: mromeos).

I've also had success with :

->(while i was logged in to gmail, (i don't know whether or not this played any role) I used : https://accounts.google.com/o/oauth2/v2/auth?client_id=936475272427.apps.googleusercontent.com&scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.email&redirect_uri=urn:ietf:wg:oauth:2.0:oob&response_type=code&access_type=offline&top_level_cookie=1

and got the oauth token from there (similar to what dequis described at (https://github.com/tdryer/hangups/issues/260#issuecomment-246578670) but without the programmatic auth.. )

1. open link 2. open Inspect Element (in Firefox) 3. go to the Network tab 4. sign-in 5. click on the first POST request 6. on the right side, go to the Cookies tab 7. locate oauth_code 8. copy and paste in pidgin.

EionRobb commented 8 years ago

Original comment by Xandor Schiefer (Bitbucket: zeorin, GitHub: zeorin).

I can confirm Micheal Romeos' workaround worked for me.

EionRobb commented 8 years ago

Original comment by Anagh (Bitbucket: anaghzaccount, GitHub: anaghzaccount).

+1. It works!

EionRobb commented 8 years ago

Original comment by Paolo Lòpez (Bitbucket: paolo_lopez, ).

I could not get oauth_code using: https://accounts.google.com/o/oauth2/v2/auth?client_id=936475272427.apps.googleusercontent.com&scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.email&redirect_uri=urn:ietf:wg:oauth:2.0:oob&response_type=code&access_type=offline&top_level_cookie=1

but yes using link dequis described at: https://github.com/tdryer/hangups/issues/260#issuecomment-246578670

I finally obtain oauth_code in "cookies tab" and then in "response cookie" (not "request cookie" because oauth_code are different)

These steps worked for me using firefox.

Regards,

EionRobb commented 8 years ago

Original comment by Diego Carrión (Bitbucket: 0x783czar, ).

dequis link worked for me, though since I was already logged in, I just needed to have the network tab open before loading the page (or refreshing it)

EionRobb commented 8 years ago

Original comment by Violet (Bitbucket: bitbotcat, ).

Edit: Sorry, had a question about using a Google apps account but I somehow got it working with this method. Yay!

The question I have is that if I tried these methods a couple of times and failed, what happens to those other oauth keys that seemingly got created just by loading that page? I don't want them floating around creating a security hole. I notice that it doesn't appear under my normal Oauth apps in Google. How can I revoke them?

EionRobb commented 8 years ago

Original comment by Bryan Seitz (Bitbucket: seitz, GitHub: seitz).

I have no response cookie on mine, any help would be appreciated!

EionRobb commented 8 years ago

Original comment by Xandor Schiefer (Bitbucket: zeorin, GitHub: zeorin).

I just set this up on a new machine and I also noticed this. I tried https://github.com/tdryer/hangups/issues/260#issuecomment-246578670 again and found a response cookie with that method.

EionRobb commented 8 years ago

Original comment by dx (Bitbucket: dequisdequis, ).

@mromeos that url doesn't have the required scopes for the hangouts connection to work at all, all it provides is userinfo.email.

The cookie you're probably seeing is the one that was set when trying the programmatic_auth method first.

@seitz followed the video? https://www.youtube.com/watch?v=hlDhp-eNLMU - it's easier if you log out of the account first.

EionRobb commented 8 years ago

Original comment by cdellin (Bitbucket: cdellin, GitHub: cdellin).

I wrote a little Python script to automate @dequisdequis's sweet workaround. If you sign on correctly in the window that pops up, it will dump the oauth_code found to the terminal. Works for me in Debian.

https://gist.github.com/cdellin/6b9bae1310f2ee6b47ba3663bdcb1ded

EionRobb commented 8 years ago

Original comment by Michael Romeos (Bitbucket: mromeos, GitHub: mromeos).

@dequisdequis Yes you are probably right! My bad. Scratched that out...

EionRobb commented 8 years ago

Original comment by Bryan Seitz (Bitbucket: seitz, GitHub: seitz).

Got it working after logging out first, thanks DX :)

EionRobb commented 8 years ago

Original comment by Robert Freeman-Day (Bitbucket: PresGas, GitHub: PresGas).

Is it easy to work in the fix that is applied in hangups?

https://github.com/tdryer/hangups/issues/260

EionRobb commented 8 years ago

Original comment by dx (Bitbucket: dequisdequis, ).

Is it easy

Since you're asking: no, it's quite shitty and we'd rather not. Hangups has it easy because it's python and it just introduced a dependency to a third party library for html scraping. Not so easy here.

On the bright side, I'm not the one who has to do it. Eion is a masochist and he likes protocols. Thanks Eion!

EionRobb commented 8 years ago

Original comment by Robert Freeman-Day (Bitbucket: PresGas, GitHub: PresGas).

LOL,

I appreciate your reply style. Yes, thanks Eion!!

EionRobb commented 8 years ago

Original comment by Matthew Hailwood (Bitbucket: hailwoodnz, ).

Alrighty, So I'm getting a rather strange behaviour after following the above method,

The contact list begins to populate, which is great, but shortly after that (1 second or so) the whole app crashes, upon which I'm asked for the oauth code again. Trying the same code causes an "already redeemed" error.

Trying the process again has the same issues.

EionRobb commented 8 years ago

Original comment by dx (Bitbucket: dequisdequis, ).

@hailwoodnz Please open a new ticket, include a backtrace: https://developer.pidgin.im/wiki/GetABacktrace

EDIT: also, if you're not using the latest commit, try with that

EionRobb commented 8 years ago

Original comment by Sheree Grier (Bitbucket: Shaeree, GitHub: Shaeree).

At first, using the 'dequis' method caused Pidgin to immediately crash on Windows (edit: to clarify--immediately after entering the OAuth code), and then immediately crash on start every time after that, as long as that account was in 'accounts.xml'. Even re-tried with a fresh Google account, and then with a fresh .purple folder, and always got the crash-on-startup.

However, when I started over with a fresh Pidgin installation (big frowney face), it worked.

EionRobb commented 8 years ago

Original comment by dx (Bitbucket: dequisdequis, ).

Yeah at this point it's clear that all crashes happen to people who aren't running the latest version of the plugin.

EionRobb commented 8 years ago

Original comment by Sheree Grier (Bitbucket: Shaeree, GitHub: Shaeree).

Has there been a new version in the last hour?

Update: Heh, dx. It was an older version, all right--but not an older version of puple-hangouts. Somehow, it was an older version of purple-facebook causing this. purple-facebook seemed to work fine by itself and with existing purple-hangouts account setups--I saw zero symptoms until I tried to add a new purple-hangouts account. Crash-issue is resolved after updating purple-facebook. Strange!

EionRobb commented 8 years ago

Original comment by Phuzzy (Bitbucket: Phuzzy, GitHub: Phuzzy).

-- content removed by author: nevermind, I was low on coffee --

EionRobb commented 8 years ago

Original comment by Colin Griffith (Bitbucket: Tynach, GitHub: Tynach).

I'm not sure it's a good idea to try to reverse engineer this to the point that it doesn't load up a web page for authentication.

In particular, I use 2-factor authentication, and so @cdellin's Python script fails - but it at least gave me the correct URL to open up in an incognito window so that I could get the oauth code manually.

EionRobb commented 8 years ago

Original comment by SalyerBRK (Bitbucket: SalyerBRK, ).

Issue #92 was marked as a duplicate of this issue.

EionRobb commented 8 years ago

Original comment by Eion Robb (Bitbucket: EionRobb, GitHub: EionRobb).

Issue #93 was marked as a duplicate of this issue.

EionRobb commented 8 years ago

Original comment by Steven Mercurio (Bitbucket: [Steven Mercurio](https://bitbucket.org/Steven Mercurio), ).

Can the dequis workaround be added to the readme under the 400 issue for easy reference as it does seem to be a working workaround?

I am not a web developer but would the best solution to this issue be a Chrome or Firefox plugin that goes basically what the workaround does?

EionRobb commented 8 years ago

Original comment by Eion Robb (Bitbucket: EionRobb, GitHub: EionRobb).

@smercurio Good idea, thanks... I've added that to the readme on the front page :)

EionRobb commented 7 years ago

Original comment by Sheree Grier (Bitbucket: Shaeree, GitHub: Shaeree).

I have to update the oauth code on two accounts every month, and having the video pop up every time is pretty annoying, especially since it steals the focus from me pasting the oauth code to do it. Any chance maybe the video popup could be replaced with a link to https://github.com/tdryer/hangups/issues/260#issuecomment-246578670 on the oauth popup instead?

EionRobb commented 7 years ago

Original comment by Eion Robb (Bitbucket: EionRobb, GitHub: EionRobb).

@Shaeree I'd be more concerned about why you're having to update the oauth code every month. Are you regularly changing your password, or are you remotely logging out the plugin?

EionRobb commented 7 years ago

Original comment by Sheree Grier (Bitbucket: Shaeree, GitHub: Shaeree).

I'm not sure what you mean by "remotely logging out the plugin", but it happens every time my computer reboots after patching, which is once a month. (it doesn't happen during other reboots.) I just figured the code was expiring after a month... Is that not the case?

One of the accounts is a standard gmail account, the other is a gapps account that hands authentication off to our CAS and uses Duo 2FA. It's both of them every time.

EionRobb commented 7 years ago

Original comment by Eion Robb (Bitbucket: EionRobb, GitHub: EionRobb).

@Shaeree no, I haven't had to update the code for over 6 months and I restart my computer weekly. Can you start a new issue and detail your setup (pidgin version, plugin version, etc)

EionRobb commented 7 years ago

Original comment by Sheree Grier (Bitbucket: Shaeree, GitHub: Shaeree).

@EionRobb Sure.