5 ms·

We discovered (in rclone) that Google are deprecating the auth method you are using - the OOB auth here: https://github.com/simonw/google-drive-to-sqlite/blob/1

by nickcw 5y ago

We discovered (in rclone) that Google are deprecating the auth method you are using - the OOB auth here: https://github.com/simonw/google-drive-to-sqlite/blob/1215097786c0ecdb12a766c9f2c8e53b2b0cd0f9/google_drive_to_sqlite/cli.py#L61 https://github.com/simonw/google-drive-to-sqlite/blob/121509... Here is the google page: https://developers.googleblog.com/2022/02/making-oauth-flows-safer.html#disallowed-oob https://developers.googleblog.com/2022/02/making-oauth-flows... Here is the discussion on the rclone issue - there are links to more stuff there: https://github.com/rclone/rclone/issues/6000 https://github.com/rclone/rclone/issues/6000 Luckily rclone already implements the oauth webserver for other backends, but for tools like this it has suddenly made authenticating with Google a whole lot harder.

simonw 5y ago
Hah, wow thanks I hadn't seen that! Just my luck to implement that the same week they announce they are deprecating it.
- simonw 5y ago
  It's pretty hard to understand what I'm meant to do for a CLI app instead here. Are they removing all versions of the "copy and paste this code" auth flow? Do I need to spin up a localhost web server on a port instead? How am I supposed to do that sensibly on a remote server that I'm SSHing into? Also that announcement seemed to indicate that localhost: redirects were going to be disabled too, wouldn't that make the local web server option not work either? I swear, obtaining an OAuth token to interact with my Google account is the new hardest problem in computer science. Oh for a GitHub-style personal access token!
  - simonw 5y ago
    I'm collecting notes on how to address this here: https://github.com/simonw/google-drive-to-sqlite/issues/39 https://github.com/simonw/google-drive-to-sqlite/issues/39 It looks like the localhost redirects are being disabled for "iOS, Android and Chrome app OAuth client types" so hopefully I can still use those by spinning up a localhost web server after all.
  - mey 5y ago
    Considering the GCloud SDK CLI Auth uses the copy/paste this code auth flow for certain scenarios, this will be interesting.
    - aaaaaaaaata 5y ago
      They literally couldn't care less. Either you're a sticky customer and you'll figure it out, or you're a high value customer that they'll sick an engineer or two on for a week to re-tool. They do. not. care.
    - sjelkjd 5y ago
      The replacement flow requires gcloud on the machine using the browser to login. The command is 'gcloud auth login --no-browser'
  - nickcw 5y ago
    My reading is that a localhost web server on a port is the way to go. This aligns with what nearly all the other cloud providers do with oauth. > How am I supposed to do that sensibly on a remote server that I'm SSHing into? If you want to see rclone's solution then check out https://rclone.org/remote_setup/ https://rclone.org/remote_setup/ It's a bit of a pain! > Also that announcement seemed to indicate that localhost: redirects were going to be disabled too, wouldn't that make the local web server option not work either? As you noted below that is only for Android, IOS and ChromeOS. I hadn't noticed that before though... > I swear, obtaining an OAuth token to interact with my Google account is the new hardest problem in computer science. Ha ha! I note that you can get "rclone authorize" to do it if you want as you can set the scopes and the client id / client secret.
  - ljm 5y ago
    There used to be one blog that explained how you could roll oAuth. Then v2 came out and they gave up. It wasn't T.J Holowaychuk but it was that time. Google doesn't give me shit but back in 2010 there was one post that everyone was working against.
- smcnally 5y ago
  gTakeout[0] also includes this file meta and allows incremental downloads. Ingesting from a local Takeout archive as an additional source for your tool mitigates some of this auth wonkiness and depreciations. [0]https://takeout.google.com/ https://takeout.google.com/

by nickcw 5y ago

simonw 5y ago

Hah, wow thanks I hadn't seen that! Just my luck to implement that the same week they announce they are deprecating it.

simonw 5y ago
It's pretty hard to understand what I'm meant to do for a CLI app instead here. Are they removing all versions of the "copy and paste this code" auth flow? Do I need to spin up a localhost web server on a port instead? How am I supposed to do that sensibly on a remote server that I'm SSHing into? Also that announcement seemed to indicate that localhost: redirects were going to be disabled too, wouldn't that make the local web server option not work either? I swear, obtaining an OAuth token to interact with my Google account is the new hardest problem in computer science. Oh for a GitHub-style personal access token!
- simonw 5y ago
  I'm collecting notes on how to address this here: https://github.com/simonw/google-drive-to-sqlite/issues/39 https://github.com/simonw/google-drive-to-sqlite/issues/39 It looks like the localhost redirects are being disabled for "iOS, Android and Chrome app OAuth client types" so hopefully I can still use those by spinning up a localhost web server after all.
- mey 5y ago
  Considering the GCloud SDK CLI Auth uses the copy/paste this code auth flow for certain scenarios, this will be interesting.
  - aaaaaaaaata 5y ago
    They literally couldn't care less. Either you're a sticky customer and you'll figure it out, or you're a high value customer that they'll sick an engineer or two on for a week to re-tool. They do. not. care.
  - sjelkjd 5y ago
    The replacement flow requires gcloud on the machine using the browser to login. The command is 'gcloud auth login --no-browser'
- nickcw 5y ago
  My reading is that a localhost web server on a port is the way to go. This aligns with what nearly all the other cloud providers do with oauth. > How am I supposed to do that sensibly on a remote server that I'm SSHing into? If you want to see rclone's solution then check out https://rclone.org/remote_setup/ https://rclone.org/remote_setup/ It's a bit of a pain! > Also that announcement seemed to indicate that localhost: redirects were going to be disabled too, wouldn't that make the local web server option not work either? As you noted below that is only for Android, IOS and ChromeOS. I hadn't noticed that before though... > I swear, obtaining an OAuth token to interact with my Google account is the new hardest problem in computer science. Ha ha! I note that you can get "rclone authorize" to do it if you want as you can set the scopes and the client id / client secret.
- ljm 5y ago
  There used to be one blog that explained how you could roll oAuth. Then v2 came out and they gave up. It wasn't T.J Holowaychuk but it was that time. Google doesn't give me shit but back in 2010 there was one post that everyone was working against.
smcnally 5y ago
gTakeout[0] also includes this file meta and allows incremental downloads. Ingesting from a local Takeout archive as an additional source for your tool mitigates some of this auth wonkiness and depreciations. [0]https://takeout.google.com/ https://takeout.google.com/