googleUser.grantOfflineAccess is still prompting account chooser

[kishoregunturu]

gapi.auth2.getAuthInstance().currentUser.get().grantOfflineAccess({ 'scope': offlinescopes.join(" ") }).then(function (auth) {
vm.authResult.code = auth.code;
}

The documentation states that it should skip the account chooser. I am calling the offline access on additional scopes for the current user and it still pops up account chooser. Please advise. I do not want user to login twice.

[TMSCH]

Hi @kishoregunturu, could you provide the configuration you pass to the gapi.auth2.init call?

You should indeed not see the account chooser, i.e. the screen where you can select which Google Account to use. However, it will show an authorization screen so that the user can authorize the scopes requested, even if the scopes were already authorized upon sign in. This is because a code allows to request Google API's even when the user is no more signed in to your app, and so the user has to consciously authorize this type of access.

[kishoregunturu]

Thank you for getting back. Here is my workflow and code
initiated the script tag in the head

<script async defer src="https://apis.google.com/js/api.js" onload="this.onload=function(){};handleClientLoad()" onreadystatechange="if (this.readyState === 'complete') this.onload()"></script>

//the gapi init
gapi.load('client:auth2', function () {
gapi.auth2.init({ client_id: window.appConfig.clientId, scope: 'profile email') }).then(function () {
});
});
//button click event
return gapi.auth2.getAuthInstance().signIn().then(function (resp) {
vm.updateSigninStatus(resp);
});
//after authentication user in our app server side
//call offline access. this is where the account chooser keeps popping up instead of consent form
gapi.auth2.getAuthInstance().currentUser.get().grantOfflineAccess({ 'scope': 'https://www.googleapis.com/auth/admin.directory.user.readonly https://www.googleapis.com/auth/admin.directory.orgunit.readonly https://www.googleapis.com/auth/admin.directory.domain.readonly'}).then(function(auth){
});

[kishoregunturu]

index.txt
Here is my html file with the set up

[TMSCH]

@kishoregunturu thanks for the further information. I indeed see the account chooser screen first, which is a bug. I will investigate and get back to you.

[kishoregunturu]

Thank you so much. Please keep me posted. I have deadline for prod release. Any help will be trully appreciated

[TMSCH]

@kishoregunturu we deployed a fix that will only display the correct account instead of all logged in Google accounts in the account chooser screen. Let me know if that works for you!

[kishoregunturu]

I want to confirm the fix. It will still show the account chooser second time but only the logged in accounts??

[TMSCH]

@kishoregunturu right. I'm currently investigating whether we can skip this screen altogether.

[sawanttushar]

I also getting the same screen for already signed in user. Is there any fixed deployed for this issue?

[TMSCH]

@sawanttushar not at this time. We're still discussing the behavior.

[slimCODE]

Any New Year resolution to fix this flow? ;) It's quite annoying (and confusing) for our users.

[TMSCH]

We are working on implementing the behavior but I unfortunately can't provide an ETA.

[knoxz]

I think I have the same problem.
In theory, everything is working. I have the user give API access on the first login.

Calling auth2.grantOfflineAccess().then(signInCallback) to send the access token to the server if there is no data for the user on login, prompts another account chooser and will also ask for permissions again.

Here is my code: https://hastebin.com/opuhaconud.xml

Is there any way to avoid this?

[AbdulShaikh]

@TMSCH: Is there any update available? I have noticed it's started asking for permissions(consent screen) again and again which is not the case earlier.

[kongguibin]

This consent screen is required on each time an offline code is issued, since, with an offline code, your application has the ability to request data on behalf of the user when the user is not present and in front of your application. User must consent on each such code issued.
https://stackoverflow.com/questions/30637984/what-does-offline-access-in-oauth-mean