401 on fetch_user_info when providing access token

[adlindenberg]

Hi all, I apologize in advance if I'm being negligent to something here config-wise, which I am starting to assume is the case, but I am truly running out of ideas.

We are upgrading from 0.54.0 --> 0.63.3 and struggling with the now required _fetch_user_info within the GoogleOuath2Adapter.complete_login() function (from 0.61.0 release).

I have overridden this adapter and confirm a valid JWT is being passed in and the logged response from google is:

{'error': {'code': 401, 'message': 'Request is missing required authentication credential. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.', 'status': 'UNAUTHENTICATED'}}

It seems like this should be working. It's odd that Google's messsage almost implies no auth is attached but I can see that it clearly is when the request is made (I mimicked this in Postman with it attached and got the same message).

I am lost - is this a library issue, a config issue, something else? Any advice? We're using all the default in terms of identity url, etc...

[pennersr]

What is it that you are attempting to accomplish? As the name implies, _fetch_user_info() is a private function, so you should not be using that at all?

[adlindenberg]

@pennersr -- we're not using it explicitly, we're using just using GoogleOauth2Adapter class in our login flows but it's 500ing because of issues in fetch_user_info (call to identity URL with JWT returns 401) -- see stack trace. My issue is that we have a valid JWT -- being passed here?

...
File "/usr/local/lib/python3.9/site-packages/dj_rest_auth/views.py", line 125, in post
    self.serializer.is_valid(raise_exception=True)
  File "/usr/local/lib/python3.9/site-packages/rest_framework/serializers.py", line 227, in is_valid
    self._validated_data = self.run_validation(self.initial_data)
  File "/usr/local/lib/python3.9/site-packages/rest_framework/serializers.py", line 429, in run_validation
    value = self.validate(value)
  File "/usr/local/lib/python3.9/site-packages/dj_rest_auth/registration/serializers.py", line 158, in validate
    login = self.get_social_login(adapter, app, social_token, response={'id_token': id_token})
  File "/usr/local/lib/python3.9/site-packages/dj_rest_auth/registration/serializers.py", line 62, in get_social_login
    social_login = adapter.complete_login(request, app, token, response=response)
  File "/usr/local/lib/python3.9/site-packages/allauth/socialaccount/providers/google/views.py", line 89, in complete_login
    data = self._fetch_user_info(token.token)
  File "/usr/local/lib/python3.9/site-packages/allauth/socialaccount/providers/google/views.py", line 114, in _fetch_user_info
    raise OAuth2Error("Request to user info failed")
allauth.socialaccount.providers.oauth2.client.OAuth2Error: Request to user info failed

[adlindenberg]

It seems like a config issue but we have profile and openid in our scope and we were just upgrading the library so I'm not sure what we weren't configured for?

[pennersr]

It's a bit difficult to assess what is going on here, but it is clear that this is not an issue in allauth itself. It looks more like an incompatibility between dj-rest-auth and allauth.

PS: You might want to consider switching to this: https://docs.allauth.org/en/latest/headless/api.html

[adlindenberg]

@pennersr in the end it was related to this issue -- the fix was us passing an additional param, id_token (assigned the access token value) and all good.

https://github.com/iMerica/dj-rest-auth/issues/503#issuecomment-1932655997