approval_prompt=force no longer works

[chripede]

After upgrading to 2.0.0 approval_prompt=force no longer works.

The difference in the generated url seems to be the reason

1.5.2:
https://accounts.google.com/o/oauth2/auth?access_type=offline&approval_prompt=force

2.0.0:
https://accounts.google.com/o/oauth2/v2/auth?access_type=offline&approval_prompt=force

I'm not sure where to report this, as the real issue seems to be the new v2 endpoint.

[dhermes]

These were updated by @jay0lee in #368.

@jay0lee this is a pretty serious regression. Please weigh in.

[dhermes]

@chripede Thanks for the report and sorry we don't have system tests to catch regressions like this. oauth2client with user input is a bit funky.

[jay0lee]

AFAICT, approval_prompt=force has been replaced with prompt=none|consent|select_account.

https://developers.google.com/identity/protocols/OAuth2WebServer#redirecting

Apologies for not catching this sooner, I'm not aware of anything that pointed out the changes in the new version and I made a bad assumption that only the endpoint had changed and parameters would remain the same.

Moving forward, it looks like replacing approval_prompt=force can just be replaced with prompt=consent for 2.0 today since it's a kwarg:

https://github.com/google/oauth2client/blob/15c945f1c76f0bd537b7fbcd7c09cb941ec89ceb/oauth2client/client.py#L1894

I have not tested that yet but will try to today. @chripede if it's possible for you test that fix also, that'd be great.

Assuming that solves we may be able to add a check for approval_prompt values in kwargs and convert that to the proper prompt value.

[chripede]

@jay0lee I tried that before posting this bug report. prompt=consent didn't do anything for me. I hope you can prove me wrong :)

I'd really like to submit this as a bug with those who owns the end-point, but no idea how to do that. Was hoping that some of you would know how to do that.

[jay0lee]

@chripede do you have sample code for the issue? I tested something very simple like:

    from oauth2client.client import OAuth2WebServerFlow
    from oauth2client.tools import run_flow
    from oauth2client.file import Storage

    CLIENT_ID = '<client_id>'
    CLIENT_SECRET = '<client_secret>'
    flow = OAuth2WebServerFlow(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET,
                           scope='https://spreadsheets.google.com/feeds https://docs.google.com/feeds',
                           redirect_uri='http://example.com/auth_return',
                           prompt='consent')
    storage = Storage('creds.data')
    credentials = run_flow(flow, storage)
    print "access_token: %s" % credentials.access_token

and I was prompted to approve. If I changed prompt to select_account I was brought straight to the picker (even though I only had one user logged in).

[theacodes]

Should we issue a warning in OAuth2WebServerFlow if someone uses approval_prompt='force'? We can also set the appropriate prompt value as well.

[chripede]

@jay0lee it seems that prompt='consent' did the trick. It prompts me for approval and returns a refresh token even when used multiple times.