Google OAuth flow

help
1

Hello everyone,
I have a usecase that I think is pretty common. I want to implement Incremental authorization for google Aouth 2.0
because this is better for the user experience. I first want the user to login into my app with google but ask only his basic contact details. Then after he has logged in I want him to grant me access to his google analytics data. How should I go about doing this? I’ve been looking at the Accounts code and wondering how I can use it to do what I want.

Any directions would much appreciated

2

You should be able to use eg. Meteor.loginWithGoogle and pass it {requestPermissions: [...]} once the user already has an account to upgrade the permissions. Haven’t tried this myself, but that would be the first place I’d look (before trying to build it myself).

2 Likes
3

Rahul I serious can’t thank you enough… I was agonizing about this but your solution did the trick!!!
:smiley:

1 Like
4

@rahul I though you cannot call Meteor.loginWithGoogle on an already logged in user. Can you? Otherwise, this would not work since you would not know when to elevate premission requirements.

So @yann how did that work out for you?

5

It works like a charm! It will give another prompt with only the additional permissions

1 Like
6

Heya! This works like a charm for incrementing authorization. But when the user sign out and then sign in again the scope are back to the original one.

  1. Sign in/up (Meteor.loginWithGoogle with minimal scope)
  2. Re-signin to increment authorization (Meteor.loginWithGoogle with additional scope)
  3. Sign out
  4. Sign in again (Meteor.loginWithGoogle with minimal scope)

At first I thought it might be that Meteor just updated the services.google.scope list to what ever was last passed to loginWithGoogle(). But I’ve double checked the access token manually ( https://www.googleapis.com/oauth2/v1/tokeninfo?access_token=xyz ) and the minimal scope is indeed in effect.

Any ideas?

7

Still exploring, but it seems like it’s possible to store the access token with the elevated privileges separately and then manually add it back once the user has signed in again. Another option is to use the refresh token to retrieve a new access token.

8

Found the solution, posting it here in case anyone else run into the same problem. Just provide add an extra parameter include_granted_scopes=true with the auth url.

In Meteor that means adding the following to the loginWithGoogle() options:

loginUrlParameters: {include_granted_scopes: true}

https://developers.google.com/identity/protocols/OAuth2WebServer#redirecting

1 Like
9

hey! sorry for late reply… was a busy week. Glad you found it!

10

@yann @rahul @mikael: I still sucks with getting a google refresh token using a code; can I ve an example of code showing how to get it to work? please. knowing that I don’t use google to log in my app.

Thank’s for you help.