Google Data doesn't work with Google Workplace (ex GSuite)

[matiasgarciaisaia]

To Reproduce

Steps to reproduce the behavior:

1. Download OpenRefine 3.4.1 for macOS (dev versions will also do, but running the official discards any OAuth credentials issue)
2. Execute the OpenRefine app. The default browser navigates to http://127.0.0.1:3333/
3. On Create Project, navigate to Google Data, and click the sign in and authorize button.
4. Log in with a Google Workplace account (ie, a non-@gmail.com Google Account) and accept the OAuth scopes.

Current Results

OpenRefine throws a 500 due to an invalid_grant / Bad Request error.

Caused by: com.google.api.client.auth.oauth2.TokenResponseException: 400 Bad Request { "error" : "invalid_grant", "error_description" : "Bad Request" }

HTTP ERROR 500

Problem accessing /extension/gdata/authorized. Reason:

    Butterfly Error
Butterfly caught the following error while processing the request:
org.mozilla.javascript.WrappedException: Wrapped com.google.api.client.auth.oauth2.TokenResponseException: 400 Bad Request
{
  "error" : "invalid_grant",
  "error_description" : "Bad Request"
} (file:/private/var/folders/rw/36glvjk57y7f3xvffb5s90jc0000gn/T/AppTranslocation/F13E632F-1BC4-4D36-B36A-277357524DE1/d/OpenRefine.app/Contents/Resources/webapp/extensions/gdata/module/MOD-INF/controller.js#108)
	at org.mozilla.javascript.Context.throwAsScriptRuntimeEx(Context.java:1773)
	at org.mozilla.javascript.MemberBox.invoke(MemberBox.java:183)
	at org.mozilla.javascript.NativeJavaMethod.call(NativeJavaMethod.java:247)
	at org.mozilla.javascript.optimizer.OptRuntime.call2(OptRuntime.java:76)
	at org.mozilla.javascript.gen.c12._c3(file:/private/var/folders/rw/36glvjk57y7f3xvffb5s90jc0000gn/T/AppTranslocation/F13E632F-1BC4-4D36-B36A-277357524DE1/d/OpenRefine.app/Contents/Resources/webapp/extensions/gdata/module/MOD-INF/controller.js:108)
	at org.mozilla.javascript.gen.c12.call(file:/private/var/folders/rw/36glvjk57y7f3xvffb5s90jc0000gn/T/AppTranslocation/F13E632F-1BC4-4D36-B36A-277357524DE1/d/OpenRefine.app/Contents/Resources/webapp/extensions/gdata/module/MOD-INF/controller.js)
	at org.mozilla.javascript.optimizer.OptRuntime.call0(OptRuntime.java:57)
	at org.mozilla.javascript.gen.c12._c2(file:/private/var/folders/rw/36glvjk57y7f3xvffb5s90jc0000gn/T/AppTranslocation/F13E632F-1BC4-4D36-B36A-277357524DE1/d/OpenRefine.app/Contents/Resources/webapp/extensions/gdata/module/MOD-INF/controller.js:107)
	at org.mozilla.javascript.gen.c12.call(file:/private/var/folders/rw/36glvjk57y7f3xvffb5s90jc0000gn/T/AppTranslocation/F13E632F-1BC4-4D36-B36A-277357524DE1/d/OpenRefine.app/Contents/Resources/webapp/extensions/gdata/module/MOD-INF/controller.js)
	at org.mozilla.javascript.ContextFactory.doTopCall(ContextFactory.java:398)
	at org.mozilla.javascript.ScriptRuntime.doTopCall(ScriptRuntime.java:3065)
	at org.mozilla.javascript.gen.c12.call(file:/private/var/folders/rw/36glvjk57y7f3xvffb5s90jc0000gn/T/AppTranslocation/F13E632F-1BC4-4D36-B36A-277357524DE1/d/OpenRefine.app/Contents/Resources/webapp/extensions/gdata/module/MOD-INF/controller.js)
	at edu.mit.simile.butterfly.ButterflyModuleImpl$Controller.process(ButterflyModuleImpl.java:399)
	at edu.mit.simile.butterfly.ButterflyModuleImpl$Controller.run(ButterflyModuleImpl.java:377)
	at org.mozilla.javascript.Context.call(Context.java:515)
	at org.mozilla.javascript.ContextFactory.call(ContextFactory.java:507)
	at edu.mit.simile.butterfly.ButterflyModuleImpl.processScript(ButterflyModuleImpl.java:650)
	at edu.mit.simile.butterfly.ButterflyModuleImpl.process(ButterflyModuleImpl.java:427)
	at edu.mit.simile.butterfly.Butterfly.service(Butterfly.java:516)
	at com.google.refine.RefineServlet.service(RefineServlet.java:210)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:820)
	at org.mortbay.jetty.servlet.ServletHolder.handle(ServletHolder.java:511)
	at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1166)
	at org.mortbay.servlet.UserAgentFilter.doFilter(UserAgentFilter.java:81)
	at org.mortbay.servlet.GzipFilter.doFilter(GzipFilter.java:132)
	at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1157)
	at org.mortbay.jetty.servlet.ServletHandler.handle(ServletHandler.java:388)
	at org.mortbay.jetty.security.SecurityHandler.handle(SecurityHandler.java:216)
	at org.mortbay.jetty.servlet.SessionHandler.handle(SessionHandler.java:182)
	at org.mortbay.jetty.handler.ContextHandler.handle(ContextHandler.java:765)
	at org.mortbay.jetty.webapp.WebAppContext.handle(WebAppContext.java:418)
	at org.mortbay.jetty.handler.HandlerWrapper.handle(HandlerWrapper.java:152)
	at org.mortbay.jetty.Server.handle(Server.java:326)
	at org.mortbay.jetty.HttpConnection.handleRequest(HttpConnection.java:542)
	at org.mortbay.jetty.HttpConnection$RequestHandler.headerComplete(HttpConnection.java:923)
	at org.mortbay.jetty.HttpParser.parseNext(HttpParser.java:547)
	at org.mortbay.jetty.HttpParser.parseAvailable(HttpParser.java:212)
	at org.mortbay.jetty.HttpConnection.handle(HttpConnection.java:404)
	at org.mortbay.jetty.bio.SocketConnector$Connection.run(SocketConnector.java:228)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
	at java.lang.Thread.run(Thread.java:748)
Caused by: com.google.api.client.auth.oauth2.TokenResponseException: 400 Bad Request
{
  "error" : "invalid_grant",
  "error_description" : "Bad Request"
}
	at com.google.api.client.auth.oauth2.TokenResponseException.from(TokenResponseException.java:105)
	at com.google.api.client.auth.oauth2.TokenRequest.executeUnparsed(TokenRequest.java:287)
	at com.google.api.client.googleapis.auth.oauth2.GoogleAuthorizationCodeTokenRequest.execute(GoogleAuthorizationCodeTokenRequest.java:158)
	at com.google.refine.extension.gdata.GoogleAPIExtension.getTokenFromCode(GoogleAPIExtension.java:105)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at org.mozilla.javascript.MemberBox.invoke(MemberBox.java:161)
	... 40 more

Powered by Jetty://

Expected Behavior

OpenRefine should list the Google Sheets in the account.

Screenshots

Versions

• Operating System: macOS 10.15.7
• Browser Version: Firefox 86
• JRE or JDK Version: openjdk version "15.0.2" 2021-01-19
• OpenRefine: OpenRefine 3.4.1

Datasets

N/A

Additional context

I've tried using a standard GMail account on the same scenario, and it worked OK. Also, a different Google Workplace account yielded an Error 400: admin_policy_enforced Authorization Error as soon as the Google OAuth popup opened - but that didn't happen with the account yielding the Error 500.

I'll probably be able to test/troubleshoot things if you guide me, but I don't have a single clue on where to start.

[tfmorris]

It would be worth retesting with a build from the latest sources (you'll need your own client id & secret, as well as API key), because we just recently added the API key, which could possibly affect this (although I think it's somewhat unlikely).

Other than that, it's just going to require standard debugging by someone with access to the type of account that fails (ie probably no one on the core team).

[matiasgarciaisaia]

I've first experienced this on top of 389fa6257d560924157b1ba5e22b3222e2367706 (last night's master) while implementing OpenRefine/OpenRefine#3627, but then went back to the latest official release in order to rule out any mistake of my own while creating the OAuth credentials on Google (I've followed the wiki article, but the fact that it also happens with the official release seems to indicate that the issue is not there).

[tfmorris]

Apologies - those directions hadn't been updated yet to include the API key (it was just added a few days ago). It's added now, although I'm not 100% sure that the described method of editing refine.ini works. I think it didn't the last time I tried, but I didn't have time to track down whether I'd made an error or there was a problem with the code.

[matiasgarciaisaia]

Thanks @tfmorris. I've just tried adding the API Key, but with the same results.

Looking at the source code, the line that's raising the exception is this one:

            GoogleTokenResponse response = new GoogleAuthorizationCodeTokenRequest(HTTP_TRANSPORT,
                    JSON_FACTORY, CLIENT_ID, CLIENT_SECRET, code, redirectUrl).execute();

And I'm not sure how to debug that GoogleAuthorizationCodeTokenRequest since it comes from a dependency. I don't see any issue or release note regarding GSuite accounts on the dependency's repo either.

[goetzk]

hi,
I've just bumped in to this too. @matiasgarciaisaia did you get this working?

[matiasgarciaisaia]

@goetzk No, I was not able to fix this. And it turned out that we didn't need support for GSuite in my use case, so I didn't invest any more efforts on this.

Feel free to ping me if you make any progress and want me to help debugging or understanding it or something, though :)

[goetzk]

I've spent an hour poking around from the edges but I'm not making any real progress - I'll leave this problem for now but thanks for your offer of help.