0

I implemented a Google marketplace App that does not show prompt when the domain administrator (who installed it) click on the app icon (i.e. it does not show the authorization prompt. However, when the individual user tries to run the application it shows the prompt as shown in the figure below: Prompt for individual users

According to the best practices guidelines this should not happen. The application is available to all the users of the organization. Also, I am directly making REST API calls for OAuth2.

Any pointers will be appreciated.

Samuel
  • 1,949
  • 4
  • 18
  • 30

1 Answers1

0

If you noted approval_prompt=force URL parameter will force showing the oauth dialog to the user every single time. By simply removing this URL parameter the user will not be prompted on subsequent auth flows.

The first time the user authorizes you (when he sees the approval screen) or if you force this by using approval_prompt=force then when you exchange the auth code you will be granted an refresh_token and an access_token.

However every time the user is not shown with the approval screen (subsequent auth when not using approval_prompt=force), when exchanging the auth code you will only be granted an access_token, no refresh_token. So if that's the flow you are using and if you want to be able to access the user's data offline you need to make sure that you save the refresh_token locally for future use, when you get it the first time. That is only likely to happen if you request access to other type of data than simply the auth data though (using the OAuth 2 flow you can request access to other data for instance Contacts API data, Calendar API data, Drive data etc...) as usually a regular Open ID flow would not need offline access.

Applications may access a Google API while the user is present at the application, and this type of application cannot keep a secret. This authorization flow is known as the implicit grant flow.

Below is a sample URL used when authenticating a user: 

https://accounts.google.com/o/oauth2/v2/auth

Here's a related ticket which discuss Authorization work flow: Why is there an "Authorization Code" flow in OAuth2 when "Implicit" flow works so well?

Community
  • 1
  • 1
Android Enthusiast
  • 4,826
  • 2
  • 15
  • 30
  • I do not think this is the case in my situation. When the Google Apps admin installs the marketplace app, it seems to implicitly give permission to the scope of the regular open-id and user details. When the apps user clicks on the install app, it should not ask for the authorization (to be accepted in the marketplace). I am not sure how the admin gives access to the users in the domain. BTW: I am using online access and do not need any other services except user info and directory service. – Samuel Jun 08 '16 at 18:48