Google Login - invalid-authentication issue

[aribn]

I closely followed the instructions to set up Google Login, but after setting environment variables and restarting the app, I'm still getting redirected to /?notice=invalid-authentication after signing into my Google Workspaces account.

This is the error that was logged server-side:

{  
  "error":"Validation error",
  "level":"error",
  "message":"Error during authentication",
  "stack":"UnauthorizedError: Validation error
           at InvalidAuthenticationError (/app/code/build/server/errors.js:46:34)
           at accountProvisioner (/app/code/build/server/commands/accountProvisioner.js:59:54)
           at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
}

Any thoughts on what I might be doing wrong?

[tommoor]

Did you set a list of allowed domains before enabling Google?

[aribn]

Yes, I set one allowed domain before enabling Google and the login that failed was from that domain.

[tommoor]

I would recommend removing the allowed domain to login, you'll need to do so in the database on the teams table. There is likely some sort of mismatch based on the error.

[aribn]

That unfortunately didn't work.

• Can you confirm that the Google+ API is the correct one for Google Workspaces?
• There wasn't mention in the documentation of which scopes needed to be added. I added three non-sensitive scopes (./auth/userinfo.email, ./auth/userinfo.profile and openid) and wanted to verify that was correct.

[nikkuexe]

Take a look at your authentication_providers table and look for any other providers that use your Google Workspace domain. In my case the oidc was registered with my company domain, so Google couldn't use the same domain.

UPDATE authentication_providers SET "providerId" = '' where name = 'oidc';

[aribn]

I am running Outline on a Cloudron server, which had set up an OIDC authentication provider using the same provider ID. Google Login worked once I cleared out this field. (I subsequently reinstalled Outline with the Cloudron Directory disabled, and Google Login works properly in that case, too.)