Moodle in English: Google Drive repository in 3.3 with non-institutional accounts

Google Drive repository in 3.3 with non-institutional accounts

by Charles Fulton - Thursday, July 20, 2017, 3:01 AM

We've setup a new Oauth 2 Google Service per the documentation in the wiki: https://docs.moodle.org/33/en/OAuth_2_Google_service. This works fine for students, faculty, and staff who import documents from their institutional Google Drive accounts (that is, the account is tied to our domain). What doesn't work is trying to login to their personal (gmail.com) drive. Anyone who tries gets the following message:

Error: invalid_scope
This app hasn't been verified to access: {invalid = [https://www.googleapis.com/auth/drive]} Please contact the developer for assistance. Are you the developer? If this project needs these scopes, sign in to an account with access to edit your project and try again. If not, contact the developer for help.

It's not clear to me how to proceed. I know there's a form to request authorization, but that's not something we had to do with the pre-3.3 implementation of the repository, which worked with both institutional and non-institutional accounts.

Charles

Re: Google Drive repository in 3.3 with non-institutional accounts

by Eric Merrill - Friday, July 28, 2017, 12:05 AM

This could also be Google applying more security to OAuth 2 connections. I know there are some App domain settings that relate to how things can interact inside/out the institution.

Re: Google Drive repository in 3.3 with non-institutional accounts

by Eric Merrill - Friday, July 28, 2017, 12:23 AM

Note, that I was able to use my *@gmail.com account using out *@oakland.edu registered API keys.

Re: Google Drive repository in 3.3 with non-institutional accounts

by Charles Fulton - Friday, July 28, 2017, 2:30 AM

It fails differently now, for reasons I don't understand. Possibly Google continues to change things. This is the error I get now (screenshot attached):

This app hasn't been verified by Google yet. Only proceed if you know and trust the developer.

The user can click past it, but it's not the best experience in the world.

Charles

Re: Google Drive repository in 3.3 with non-institutional accounts

by Ryan Smith - Tuesday, August 8, 2017, 9:01 AM

The verification process has been a MAJOR pain so far. I've appealed twice, but they still want to know this:

Dear Developer,

Thank you for your response!

Can you please clarify for what functionality and purpose does your app need access to the following scopes respectively?

· https://www.googleapis.com/auth/drive

· https://www.googleapis.com/auth/drive.metadata

· https://www.googleapis.com/auth/drive.metadata.readonly

· https://www.googleapis.com/auth/drive.photos.readonly

· https://www.googleapis.com/auth/drive.readonly

· https://www.googleapis.com/auth/drive.scripts

For reference, a full list of OAuth scopes can be found on the OAuth 2.0 Scopes page.

Sincerely,

Google Cloud Platform/API Trust & Safety

It would be nice if we could get some official guidance on how to get verified, I have no idea what drive scopes the Moodle drive repository uses. Our users are getting hit with this "unverified" screen and running away scared (rightfully so, even though it is legit access).

Re: Google Drive repository in 3.3 with non-institutional accounts

by Ryan Smith - Tuesday, August 15, 2017, 8:20 PM

Are there any Moodle developers that can comment on how to achieve verification for Google Drive? Google needs to know the list of OAuth scopes that Moodle is using in the code.

Re: Google Drive repository in 3.3 with non-institutional accounts

by Stephen Bourget - Wednesday, August 16, 2017, 5:07 AM

Ryan,

I'm also trying to get google to verify my site, so far, not so much fun.

I did some digging through the Moodle codebase and it looks like the only scope we need is:

https://www.googleapis.com/auth/drive

It seems to be used in 2 places: the google drive repository:

https://github.com/moodle/moodle/blob/master/repository/googledocs/lib.php#L56

and the file converter:

https://github.com/moodle/moodle/blob/master/files/converter/googledrive/lib.php#L35

-Stephen

Re: Google Drive repository in 3.3 with non-institutional accounts

by Damyon Wiese - Wednesday, August 16, 2017, 1:31 PM

Hi - this seems to be a recent change from Googles side. We never had to do this extra step when working on these features for 3.3.

My guess is that it's a response to some recent phishing attacks involving OAuth (https://www.scmagazine.com/massive-google-docs-phishing-attack-targeted-credentials-permissions/article/654938/). It may also be related to the recent changes to EU privacy laws.

Regardless - it would be very helpful for anyone who has completed this process to post about it here so others can see how it works. The list of scopes that Moodle requires are: "openid profile email https://www.googleapis.com/auth/drive". This is the minimum user information we require to create a unique account - and the google drive API is required to manage files using the google drive repository. The google drive API is also required if you are using the google document converter.

Regards, Damyon

Repositories

Google Drive repository in 3.3 with non-institutional accounts