oauth 2.0 - Is it possible to be able to correctly select any available Google account to use when using authorisation via the JS client library for Drive?

Question

I've got an existing Google Drive enabled application that's using the Google Java client library and server flow auth.

If you're not logged into the application and navigate to the URL AND you have logged into more than one google account on that browser (only one personal Google account is possible, any additional ones have to be Google business accounts) the OAuth callback offers the options to select which Google Account to use.

However, whilst testing a switch to using the JavaScript client library I'm not able to activate the multiple account selection screen using gapi.auth.authorize. Is it possible to handle multiple accounts using the JS library?

Update : I tried with the immediate parameter false. I can log in as long as I don't change account in the popup. If I do change account, I get to:

https://accounts.google.com/o/oauth2/auth?client_id=433863057149.apps.googleusercontent.com&scope=https://www.googleapis.com/auth/drive.file+https://www.googleapis.com/auth/drive.install+https://www.googleapis.com/auth/userinfo.email+https://www.googleapis.com/auth/userinfo.profile&immediate=false&redirect_uri=postmessage&origin=https://drivedrawio.appspot.com&proxy=oauth2relay593063763&response_type=token&state=701344514&authuser=1

in a new tab and nothing happens. I've made a video to demonstrate.

Update 2 : This bug against the JS client library for the need for double selection of mulitple account has been accepted.

Answer 1

You are not getting the multi user selection screen because of the following parameter: authuser=0 This automatically selects the first account you are signed-in with (authuser=1 would select the second etc...).

It's currently not possible to remove that param using the client library because the client library sets it automatically to 0 (this is why it claims not to handle multi-accounts) if there is no value so one way is to override it to -1 for example, this will show the multi-account chooser. Then you could also ask to access the user's profile or email at the same time you ask access to other APIs and fetch either the email of the user or its ID. Then on subsequent auth you can specify the user_id param which wil bypass the user-selection screen.

So in practice, first authorize like this:

gapi.auth.authorize({client_id: <Your Client ID>,
                     scope: 'https://www.googleapis.com/auth/drive openid', // That requires access to Google Drive and to the UserInfo API
                     authuser: -1});

The only problem with the above is that the auto-refresh of the client library will not work because every auth will by blocked at the multi-account selection screen.

The trick is to get the ID of the user using the UserInfo API, save that ID in a session cookie and use it on subsequent auth like that:

gapi.auth.authorize({client_id: <Your Client ID>,
                     scope: 'https://www.googleapis.com/auth/drive openid',
                     user_id: <The User ID>,
                     authuser: -1});

Specifying the User's ID will make sure the multi-account chooser is bypass and will allow the auto-refresh of the token from the client lib to work again.

For reference, other URL param that impact the User flow are:

• user_id: similar than authuser (bypasses the multi-account selection screen) but you can use email address (e.g. [email protected]) or the User ID you get from our Open ID Connect endpoint/Google+ API/UserInfo API
• approval_prompt: default is auto, can be set to force to make sure that the approval/grant screen gets shown. This makes sure that the gant screen is not bypassed on subsequent auth (after first time).
• immediate: immediate is a bit tricky, when set to true it will bypass the grant screen (kinda like approval_prompt=auto) if the user already granted approval previously, but if the user has not granted approval previously you will get redirected with an error: error=immediate_failed. If set to false it won't add special behavior and therefore fallback on the behavior setup by the approval_prompt value.

Note: immediate=true and approval_prompt=force is an invalid combination.

I think the client library is using the immediate param so that if he gets the error=immediate_failed it will restart an auth flow without the authuser param, but that's only speculations :)