OAuth2: Detect "Need admin approval"

[benbucksch]

Reproduction

• User tries to install Parula and starts email account setup
• User enters email address foo@duke.edu
• We find Office365 and propose EWS. User accepts the default
• User goes through OAuth2 authentication

Actual result

• He gets a screen saying "Need admin approval" (see screenshot below)

Expected result

• We detect the screen above
• We tell the user that his organization doesn't know about Parula yet, and that we'll try another way.
• We select OWA instead
• We try authentication again
• Login works, setup finishes
• User gets email
• User is happy

Fix

• In OAuth2, we need a way to detect that this approval screen appears
• The detection should support Microsoft Office365 and Google Suite
• I will then add code to the Setup sequence to switch to OWA and try again.

[NeilRashbrook]

I don't think trying to detect the screen itself is ideal; the user might actually be able to log in as an administrator and authorise consent. What we can do is to check the error code returned when the OAuth fails.

Microsoft claims that we can detect the difference between this and the user cancelling the regular auth screen because the error code should be 90094 in this case and 65001 in the regular user case. I don't have any way of testing that though.

For Google Suite, errors appear to be provided to the redirect URL via the error= parameter. The documentation is rather lacking but it seems to suggest that a user cancellation will result in error=access_denied but an administrative limitation will result in error=admin_policy_enforced.

Might it be be worth adding some sort of way of warning the user in advance that a particular selection will need consent?

[benbucksch]

Can you please write code for all these cases, including detecting the screen itself? I may want to show a dialog in parallel or instead of the dialog. Most likely, I will show our own dialog that a) explains the problem, b) allows the admin to see the page and approve (i.e. show the OAuth2 page again), or c) allows the user to switch to OWA.