Select the authorized scopes for this token

1,267 views
Skip to first unread message

Kevin Kenneally

unread,
Feb 23, 2016, 5:19:21 PM2/23/16
to Google Apps Manager

I have inherited supporting some scrip that run GAM to move Chromebooks to between OUs in our  GAFE database. The scrips run nightly on a LINUX server. Like I said I inherited supporting this and my LINUX experience is somewhat limited.

  

Anyway the process has been working without issue for a while now but something is now messed up and the scrips no longer run. What happens is whenever a GAM command is run I get prompted “Select the authorized scopes for this token.” I can select option “24” Continue and get prompted go to https://goo.gl/*****.


From a windows workstation I use a browser and login to GAFE as the user that is running the LINUX scripts. Next I open the URL https://goo.gl/**** and get prompted to allow access to my google apps. Once I select allow access I receive a code with instructions to “Place copy this code, switch to your application and past it there”. This is exactly the way I believe it should work.


I past the code from my browser to where I am prompted on the UNIX host Enter verification code: and the GAM commands will work.  At this point my scrips will now run correctly


My problem is the next day the process fails again and I have to go through getting the code again. As far as I can tell everything is setup correctly. I have the client_secrets.json and oauth2service.json files in the GAM directory where the gam.py file lives. I have tried creating a file called nobrowser.txt and putting the code in it but that does not work. I seem to be missing something basic. Once I go through the process one time and enter the verification code GAM works fine for a while but at some point I believe the token expires and I am stuck.


 How do I keep the token from expiring or how do I put the code in some sort of file that GAM will reference?


--------------------------------------------------------------------------------------------------------------
This message has been sent by a student at Central Kitsap School District. To report abuse please contact dis-objectionablecontent@ckstudents.org
--------------------------------------------------------------------------------------------------------------

Ross Scroggs

unread,
Feb 23, 2016, 5:29:47 PM2/23/16
to google-ap...@googlegroups.com
Kevin,

Authorizing the scopes (with or without a browser) creates a file named oauth2.txt which should reside in the same location as client_secrets.son and oauth2service.json. Do you have this file?

Ross

This message has been sent by a student at Central Kitsap School District. To report abuse please contact dis-objectio...@ckstudents.org
--------------------------------------------------------------------------------------------------------------

--
You received this message because you are subscribed to the Google Groups "Google Apps Manager" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To post to this group, send email to google-ap...@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/270fa915-1a67-40e7-987b-1a35a7e989ca%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.



--

Luke Saintignan

unread,
Feb 24, 2016, 9:36:12 AM2/24/16
to Google Apps Manager
I'm having a similar issue that started yesterday morning. I thought it was just because gam needed an update, which I did, but the issue remains. I can add users with gam via command line with no issues, however, when it tries to add via our PHP, it wants to authorize scopes again. Hopefully we can figure this thing out. I started a new question as well. And I have those oauth2.tx files as well as the client_secrets.son and oauth2service.json. 

Luke

Nate Ferrell

unread,
Feb 24, 2016, 10:47:19 AM2/24/16
to Google Apps Manager
If you've upgraded, I suggest recreating the OAUTH file, as the scopes have changed:

gam oauth delete

gam oauth create

"28" to continue with default scopes selected (you will need to leave one scope unselected for it to process correctly)

Nate Ferrell

unread,
Feb 24, 2016, 10:49:26 AM2/24/16
to Google Apps Manager
Kevin,

Considering your option to continue is "24", it sounds like you may need to upgrade GAM and recreate the oauth file:

try this:

download the latest version (3.63) from the releases page and replace the current files with them, then run the following:

gam oauth delete

gam oauth create

"28" to continue with default scopes selected (you will need to leave one scope unselected for it to process correctly, it defaults to Notifications API being unselected)

Kevin Kenneally

unread,
Feb 25, 2016, 11:12:13 AM2/25/16
to Google Apps Manager
Do I also have to go through the process in the Google Developers Console of creating new json files?

Kevin Kenneally

unread,
Feb 25, 2016, 11:18:07 AM2/25/16
to Google Apps Manager
No i do not have an oauth2.txt file


On Tuesday, February 23, 2016 at 2:29:47 PM UTC-8, Ross Scroggs wrote:
Kevin,

Authorizing the scopes (with or without a browser) creates a file named oauth2.txt which should reside in the same location as client_secrets.son and oauth2service.json. Do you have this file?

Ross
On Tue, Feb 23, 2016 at 12:01 PM, Kevin Kenneally <kev...@ckschools.org> wrote:

I have inherited supporting some scrip that run GAM to move Chromebooks to between OUs in our  GAFE database. The scrips run nightly on a LINUX server. Like I said I inherited supporting this and my LINUX experience is somewhat limited.

  

Anyway the process has been working without issue for a while now but something is now messed up and the scrips no longer run. What happens is whenever a GAM command is run I get prompted “Select the authorized scopes for this token.” I can select option “24” Continue and get prompted go to https://goo.gl/*****.


From a windows workstation I use a browser and login to GAFE as the user that is running the LINUX scripts. Next I open the URL https://goo.gl/**** and get prompted to allow access to my google apps. Once I select allow access I receive a code with instructions to “Place copy this code, switch to your application and past it there”. This is exactly the way I believe it should work.


I past the code from my browser to where I am prompted on the UNIX host Enter verification code: and the GAM commands will work.  At this point my scrips will now run correctly


My problem is the next day the process fails again and I have to go through getting the code again. As far as I can tell everything is setup correctly. I have the client_secrets.json and oauth2service.json files in the GAM directory where the gam.py file lives. I have tried creating a file called nobrowser.txt and putting the code in it but that does not work. I seem to be missing something basic. Once I go through the process one time and enter the verification code GAM works fine for a while but at some point I believe the token expires and I am stuck.


 How do I keep the token from expiring or how do I put the code in some sort of file that GAM will reference?


--------------------------------------------------------------------------------------------------------------
This message has been sent by a student at Central Kitsap School District. To report abuse please contact dis-objectionablecontent@ckstudents.org
--------------------------------------------------------------------------------------------------------------

--
You received this message because you are subscribed to the Google Groups "Google Apps Manager" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsub...@googlegroups.com.



--
Message has been deleted

Kevin Kenneally

unread,
Feb 25, 2016, 11:49:59 AM2/25/16
to Google Apps Manager
I believe my issue is now corrected. However i am not exactly sure what the fix was. I am almost positive there was no oauth2.txt in the GAM directory on the linux server where the scripts run but now there is. The only difference is that i did notice in google admin console under security where you authorize the service client accounts that the only thing authorized for the client was google drive and the service was not listed at all. I added everything that is listed in the instructions for setting up GAM and now it seams to work. However like I say i am not sure if that was the fix or not. 


On Wednesday, February 24, 2016 at 6:36:12 AM UTC-8, Luke S. wrote:

Nate Ferrell

unread,
Feb 25, 2016, 7:48:26 PM2/25/16
to Google Apps Manager
Shouldn't need a new project or new JSON's if you have the current ones still, I would just ensure that you have the necessary API's enabled in the Dev Console for that project.

GAM would create the oauth2.txt file if it was not found, but you'd obviously get a popup asking for scope selection, etc, if so.

Not sure what the fix was directly from my point of view, but I'm glad you got it working! If you figure it out, please share =]

Kevin Kenneally

unread,
Feb 29, 2016, 1:55:24 PM2/29/16
to Google Apps Manager
Maybe I spoke too soon. Today I logged into the Linux host to verify the process was working and sure enough it was not. There was a oauth2.txt file in the Gam working dir created the last time the process was working. I went to https://goo.gl/**** and allowed access and got the code. Pasted the code where being prompted by GAM and its all good again. Now i have a new oauth2.txt file. Next I try ruining gam oauth delete. The command runs and the oauth2.txt gets deleted. Next i get a new code by running  https://goo.gl/****. Now i gun gam oauth create when prompted for scope i  answer "24" to continue, past in the new code and get "Authentication successful."

Looks like i am  back at the same spot, for some reason I believe the authorized scope is expiring. 

Nate Ferrell

unread,
Feb 29, 2016, 2:06:52 PM2/29/16
to google-ap...@googlegroups.com
Kevin,

Have you tried updating your GAM version as previously described?

The option to continue with the current version is "28", not "24", so it seems like you're using an old version that may be deprecated and causing that issue. Just by looking at the option number, there have been 4 API's added to GAM since the version you're using, I believe.

just a thought, it's worth updating to test and confirm.


Here's what I see using the current version (3.63):


Inline image 1

Thank you for your time,
Nate Ferrell
Systems Engineer | Google Apps Certified Administrator
x5120 | 817.494.0332


This message has been sent by a student at Central Kitsap School District. To report abuse please contact dis-objectio...@ckstudents.org
--------------------------------------------------------------------------------------------------------------

--------------------------------------------------------------------------------------------------------------
This message has been sent by a student at Central Kitsap School District. To report abuse please contact dis-objectio...@ckstudents.org
--------------------------------------------------------------------------------------------------------------

--
You received this message because you are subscribed to a topic in the Google Groups "Google Apps Manager" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/google-apps-manager/-Yz-OQh8Xr0/unsubscribe.
To unsubscribe from this group and all its topics, send an email to google-apps-man...@googlegroups.com.

To post to this group, send email to google-ap...@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/468c58c5-5d27-4d16-b08d-178df487a8a7%40googlegroups.com.

Ross Scroggs

unread,
Feb 29, 2016, 3:21:38 PM2/29/16
to google-ap...@googlegroups.com
Kevin,

gamcache seems to mess up the works occasionally; empty your gamcache folder and let us know what happens in the morning.

--
You received this message because you are subscribed to the Google Groups "Google Apps Manager" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.

Kenneally Kevin - DIS

unread,
Feb 29, 2016, 8:36:34 PM2/29/16
to google-ap...@googlegroups.com, ross.s...@gmail.com

How would I find the gamcache folder on a linux box?

Ross

 

This message has been sent by a student at Central Kitsap School District. To report abuse please contact dis-objectio...@ckstudents.org

--------------------------------------------------------------------------------------------------------------

 

--------------------------------------------------------------------------------------------------------------

This message has been sent by a student at Central Kitsap School District. To report abuse please contact dis-objectio...@ckstudents.org

--------------------------------------------------------------------------------------------------------------

 

--
You received this message because you are subscribed to the Google Groups "Google Apps Manager" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To post to this group, send email to google-ap...@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/468c58c5-5d27-4d16-b08d-178df487a8a7%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

 

--
You received this message because you are subscribed to a topic in the Google Groups "Google Apps Manager" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/google-apps-manager/-Yz-OQh8Xr0/unsubscribe.
To unsubscribe from this group and all its topics, send an email to google-apps-man...@googlegroups.com.


To post to this group, send email to google-ap...@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.

Nate Ferrell

unread,
Feb 29, 2016, 9:53:06 PM2/29/16
to google-ap...@googlegroups.com, ross.s...@gmail.com
Kevin,

It's in the same folder as the GAM installation, typically.

If accessing from a Windows computer, you'll need to likely use something like WinSCP to get to it.

Otherwise, if the Linux box has a user interface that you can just log into like Ubuntu Desktop, then login and find the GAM installation folder on the box directly.

Thank you for your time,
Nate Ferrell
Systems Engineer | Google Apps Certified Administrator
x5120 | 817.494.0332


To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/BY2PR01MB3486D65E258AFDAEE26D5BED5BB0%40BY2PR01MB348.prod.exchangelabs.com.
Reply all
Reply to author
Forward
0 new messages