Google apps integration: ending up in someone else's mailbox

Google apps integration: ending up in someone else's mailbox

by Vaya Willemen -
Number of replies: 9

Hi everyone,

We are working on integrating Google apps for education into our Moodle 2.8 environment.

We did the setup of the google apps block. On the homepage of the user, the block appears to give them access to gmail, google calendar, Google Drive, ...

We have a single sign on setup where Moodle holds the user accounts.

When user A logs on to Moodle, then clicks on the gmail link in the Google apps block, the gmail account of user A opens. When he leaves the computer, he does not sign out of Google but simply closes the browser tab where the google session was in and walks away. Moments later, another student, user B takes place behind the computer and logs into Moodle using the user B account. This user also clicks on the gmail link in his Google apps block. At that point, the gmail of user A opens!!!!

Why is this happening! It is a serious security issue that needs to be resolved. We cannot enforce students to sign out. A lot of them just close the browser tab when they are done, but that apparently does not sign them out of Google.

We use three different browser in our school (each has a specific reason for being installed on the computers), so students have the choice between IE, Firefox and Chrome. It happens in all three browsers.

Average of ratings: -
In reply to Vaya Willemen

Re: Google apps integration: ending up in someone else's mailbox

by Rob Johnson -

Hi Vaya,

I have been using this integration since 2009.  I began with Moodle 1.9 and am currently on 2.6.4.  This summer (N. Hemisphere) I will be moving to 2.8 or 2.9.  I have seen the behavior you describe the entire time

This problem is not coming from Moodle.  Google is setting a cookie that lasts for two weeks.  If the browser is not set to clear cookies on closing, it will persist.  For shared computers, this can be a problem.

I have set my Moodle so that if a user logs out there, they are logged out of Google too.  The code hack to do this is here.  This still does not deal with simply closing the browser, but most of our on campus devices are Chromebooks or AD authenticated Windows machines.  Logging out of the device deals with leftover cookies.

Average of ratings: -
In reply to Vaya Willemen

Re: Google apps integration: ending up in someone else's mailbox

by Michael Milette -
Picture of Core developers Picture of Documentation writers Picture of Particularly helpful Moodlers Picture of Plugin developers Picture of Testers Picture of Translators

It isn't Moodle, it is Google. Students could access the previous users Google account just by going to Google without ever touching Moodle.

While I haven't used this feature, I do have a few suggestions that might help.

Solution #1: Educate students

You need to teach your students the purpose of the "Stay signed in" checkbox appearing on the login page of Google apps like GMail. This will save them from problems in the future when they access their Google apps from public places.

Solution #2: Patch Login instead of Logout

You could possibly reduce the problem by patching the Moodle logout, but as you said, that doesn't help students who just close the browser. However it might be more effective to patch the login system in Moodle since everyone has to login whether the browse was closed or open.

Solution #3: Change Google app links to their Logout pages

Another option might be to have links in the apps block link to the logout page of the particular service instead of the login page. Here are three URL's that look like they would do the job depending on the results you want:

https://accounts.google.com/Logout?hl=en&continue=https://mail.google.com/mail/

https://accounts.google.com/ServiceLogin?service=mail&continue=https://mail.google.com/mail/

https://mail.google.com/mail/logout?hl=en

This approach will result in them being prompted to login each time they click on the apps block.

The down side to all of the second and third approach is that it won't prevent students from accessing other students Google accounts if they bypass Moodle and go directly.

Hope this helps.

Best regards,

     Michael Milette


Average of ratings: -
In reply to Michael Milette

Re: Google apps integration: ending up in someone else's mailbox

by Vaya Willemen -

It isn't Moodle, it is Google. Students could access the previous users Google account just by going to Google without ever touching Moodle>

That is not the case. The Google for education accounts cannot be accessed directly. Students who try that are redirected to our Moodle platform to login there first.

While I haven't used this feature, I do have a few suggestions that might help.

Solution #1: Educate students

You need to teach your students the purpose of the "Stay signed in" checkbox appearing on the login page of Google apps like GMail. This will save them from problems in the future when they access their Google apps from public places.

We are constantly working on this. But that solution will never be sufficient since we offer citizenship courses for people from abroad (no native speakers), we offer distance learning to students we never see face to face, we do not offer linear education, but modular (students puzzle together their own schedules, the decide how many courses, which course, how many years they are willing to spend before graduating, ...) , where we have more than 8000 students spread over so many different campusses, a lot who do not master the language

Solution #2: Patch Login instead of Logout

You could possibly reduce the problem by patching the Moodle logout, but as you said, that doesn't help students who just close the browser. However it might be more effective to patch the login system in Moodle since everyone has to login whether the browse was closed or open.

This suggestion I do not understand. If it involves that we change code inside Moodle, it is not a feasible solution for us, unless it is described accurately somewhere what needs to be changed and how to do this.

Solution #3: Change Google app links to their Logout pages

Another option might be to have links in the apps block link to the logout page of the particular service instead of the login page. Here are three URL's that look like they would do the job depending on the results you want:

https://accounts.google.com/Logout?hl=en&continue=https://mail.google.com/mail/
https://accounts.google.com/ServiceLogin?service=mail&continue=https://mail.google.com/mail/
https://mail.google.com/mail/logout?hl=en

This approach will result in them being prompted to login each time they click on the apps block.

This suggestion completely defeats the purpose of implementing a Single Sign On environment where Moodle holds the database with user accounts to authenticate against. The whole point is that students only have to login in one place (Moodle) and that they do not have to do a login procedure when accessing thei Google account / apps. But the problem I described is that a particular user can be logged into Moodle, and gets access to someone else's Google account. That is a serious authentication bug in Google then!

It should be simple: logged in Moodle user = logged in Google account.

But that is not the case as described in my starter post.

  • User A logs into Moodle, clicks on gmail link in his apps block: Google account user A opens = CORRECT
  • User A closes his gmail tab, logs out of Moodle, leaves the computer
  • User B takes a seat, logs onto Moodle, clicks on his gmail link in apps block: Google account user A opens = INCORRECT

It should be taken care of that when a user logs out of Moodle, he is also logged out of Google. But that is not handled correctly by Moodle.


Average of ratings: -
In reply to Vaya Willemen

Re: Google apps integration: ending up in someone else's mailbox

by Ken Task -
Picture of Particularly helpful Moodlers

Question: are the computers being used internal to a school network in which the students have to login to the network before doing anything?    If that's true, talk to your server folks about setting up user profiles on the/an internal server.

Student A in Classroom B - uses FireFox ... accesses both Moodle and Google.  Just closes browser but does logout the computer from the network.   Student B comes along, sits at same computer, logs onto the network, Google is his/her own.  Moodle is his/her own.  Profiles (cookies/history) for all browsers coming from server.

Student B, in the meantime, has moved to Classroom D.  Sits at another workstation.  Logs into the network.   Cookies for Moodle and Google have not expired yet.  Student can access both without having to login again.

No network like that?   Ok, with each browser (Firefox, IE, and Chrome) set them such that the history and cookies are cleared on close.

No cookie/history remaining from previous user, no issues. ;)

Student/Teachers (ALL users)  however, should be taught safe practices as they won't always be on a network that's set up to prevent using other user credentials.

'spirit of sharing', Ken

Average of ratings: -
In reply to Ken Task

Re: Google apps integration: ending up in someone else's mailbox

by Vaya Willemen -

I am the server folks smile

Students do not need to logon with individual credentials.

All our browsers are set to delete cookies/history upon exiting. But when you open a browser with Moodle in one tab, then click on a Google app, this opens in another TAB, not another window. When a tab is closed, the cookies/history are not deleted. That only happens when the entire browser sessions stops.

So I am going to test if i can force that a new browser WINDOW is opened when clicking a Google app on the apps block. Maybe that should do the trick. I will le you guys know smile 

Thx for all the input so far.

Average of ratings: -
In reply to Vaya Willemen

Re: Google apps integration: ending up in someone else's mailbox

by Richard Oelmann -
Picture of Core developers Picture of Plugin developers Picture of Testers
  • User A logs into Moodle, clicks on gmail link in his apps block: Google account user A opens = CORRECT
  • User A closes his gmail tab, logs out of Moodle, leaves the computer
  • User B takes a seat, logs onto Moodle, clicks on his gmail link in apps block: Google account user A opens = INCORRECT

What happens if the user still has the google tab open when they log out of Moodle?

Although actually, I'd say you have a potential powder keg going there anyway! You appear to have open access PCs that students don't need to log in to with individual credentials, mixed with students who have not been taught to close a browser session properly, further mixed with school provided, account based tools that could include personal information, such as emails, personal drives, etc. I think you have a much bigger system wide issue than just whether google removes its session cookie when a student logs out of Moodle - and given your suggestion that they dont log out of google, just close the tab - who's to say they are not doing the same with Moodle and just closing the tab!

I think you should seriously consider the 'educate your students' suggestion above - even if that is combined with better technical solutions as well - geographical spread and language issues not withstanding. An animation/low language, or even translated, resource has to be better than just saying, they're not native English speakers so we cant do anything about it - Their language skills surely have to be good enough to pass your courses, therefore they should be good enough to be able to introduce the idea of basic browser security. sad
Sorry to be negative Vaya, but that attitude frustrates me beyond - if you read just about any literature on online learning, one of the key responsibilites of the online tutor is to make sure their learners can use the system they are using to teach with appropriately (just one example - E-moderating: The Key to Teaching and Learning Online By Gilly Salmon ). If 'you'/your tutors can't even teach them to close a browser session down, then how can you teach them other skills to make appropriate use of the VLE, and if they can use Moodle and Google appropriately then they can surely close down a browser!
Average of ratings: -
In reply to Richard Oelmann

Re: Google apps integration: ending up in someone else's mailbox

by Richard Oelmann -
Picture of Core developers Picture of Plugin developers Picture of Testers

Apologies that should be 'they're not native speakers' - I don't think anywhere you mention English as I have, but the point still holds.

Whatever the language of instruction/learning they must have sufficient language skills to be able to complete the learning, or you must be providing resources in the languages they need. Therefore, doing the same to ensure thay can appropriately use the technology that is an integral part of the learning is surely fundamental to that learning.

Average of ratings: -
In reply to Richard Oelmann

Re: Google apps integration: ending up in someone else's mailbox

by Vaya Willemen -

I think you should seriously consider the 'educate your students' suggestion above - even if that is combined with better technical solutions as well.

What makes you assume that we do not put considerable effort in this? We have an entire departement dedicated to educating teachers, staff and students (and then we are talking about a huge amount of people). But we cannot reach everyone with these presentations, lectures, hands on workshops, screenshot documents, animations, ....

We can order teachers and staff to attend, but we cannot order students. They attend on a voluntary basis.

Because our efforts do not reach our entire student population, i am just testing worst case scenario's and trying to avoid these scenarios with technical solutions.

We will not deploy the Moodle/GAFE integration unless we get this issue fixed. Sorry that this attitude to get to the bottom of this possible disaster scenario before considering deployment frustrates you. It makes good sense to me.

Part of our teachers and students have excellent IT skills, part of our teachers have not so good skills and we invest continuously in educating them. Part of our student population doesn't know one word of the native language and they start from scratch. It is a very mixed population, that is the reason why we are investigating everything first. We have so many different nationalities of students, that we cannot provide instructions in all their native languages.

I just came here to inform if there was a technical solution we might investigate further to be able to mitigate potential problems. Not in order to loose sight of educating the users in the proper use of the tools. But if you believe you can get the message through to everyone, or that people never accidentally forget to log-out (be it from a cloud based service, or from a workstation on the network) you are not being realistic. It is for these scenario's that I would like to have a technical solution in place.

Average of ratings: -
In reply to Vaya Willemen

Re: Google apps integration: ending up in someone else's mailbox

by Richard Oelmann -
Picture of Core developers Picture of Plugin developers Picture of Testers

Then I'll put it down to a misunderstanding of your earlier comment which to me came across as 'we can't educate all our students to use basic online skills because they aren't native speakers - even though we are happy to enrol them on our online courses'

THAT is the attitude that frustrates me, not your wish to see a better technical solution. If that's not what you meant then I apologise for the misunderstanding.

Average of ratings: -