Unable to create new gam project, gam 6.22

[Bailey Malone]

Hello,

I'm trying to create a new GAM project but running into an error that isn't clear to me.

I've added the "GAM Project Creation" by Client ID (297408095146-fug707qsjv4ikron0hugpevbrjhkmsk7.apps.googleusercontent.com) to my Google Admin domain via Security > API Controls > App Access Control > Manage third-party apps and set it to "trusted". 

However, when I run "$ gam create project" from the command line and it redirects me to the browser to authorize as the google admin user I chose, and I select "Allow",

I'm seeing the error "something went wrong" with no details. 

I tried logging out and back in but no luck. It's worth mentioning I was using gam 6.10 before and upgraded to 6.22 (latest) today. I was able to create a new project with 6.10 just before this, before I realized the gam version was old.

Any ideas what I might be missing or doing wrong? Thanks!

[Ross Scroggs]

Bailey,

You don't need a new project, just update the version.

Ross

--
You received this message because you are subscribed to the Google Groups "GAM for Google Workspace" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/53ed1cde-33ec-4207-af75-d04e2e135b65n%40googlegroups.com.

--

Ross Scroggs

ross.s...@gmail.com

[Bailey Malone]

Hey Ross,

Thanks for getting back to me.

I actually need to create a new project. In my case, I need both the Google Cloud project and the admin account used to be changed.

I was able to successfully create a new GAM project with gam 6.10, but when I tried to create the oauth2.txt file I ran into this error:

I thought this might be an issue with either the gam version or changes in how Google o-authenticates types of apps (desktop vs web), so I upgraded my gam version. But with gam 6.22 I cannot create a project at all, and I get that "Something went wrong" error with no details.

Any ideas how I can further debug this or create my project? 
Should I try downgrading my gam version until project creation succeeds?

Thanks!

[Ross Scroggs]

You can create a project with 6.10 and use it with 6.22

Ross

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/5680645a-7b1a-434b-a9e8-d677bf9975d5n%40googlegroups.com.

--

Ross Scroggs

ross.s...@gmail.com

[Bailey Malone]

To clarify, you're suggesting I create the project with version 6.10, and then run the "gam oauth create/update" command with version 6.22? 
Am I understanding correctly?

[Ross Scroggs]

Yes

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/1108168e-05a5-4ce6-85ae-d39f94ff7b2cn%40googlegroups.com.

--

Ross Scroggs

ross.s...@gmail.com

[Bailey Malone]

Hey Ross,

Following up on this to provide an update, I tried as you suggested. Creating a GAM project with gam v6.10. worked, but when I ran $ gam oauth create to create the oauth2.txt file with gam v6.22 using the new client_secrets and oauth2service JSON files, I ran into the same error as before:



I dug into this specific error more and I think I found the source of this problem - in February of 2022, Google deprecated the OOB Oauth callbacks. it seems that when creating a new GAM project (at least in 6.10), and selecting Desktop App, it sets/uses that OOB value as a redirect_uri, which Google then blocks due to the deprecation. My original GAM project was a Desktop App project, which is why I selected that again.

So a GAM Desktop App cannot use the OOB redirect_uri which (older) GAM sets or expects, and a GAM Web App cannot set the OOB redirect_uri due to Google's deprecation. It seems like the correct fix for this is not the GAM version necessarily, but the type of application I make for a new GAM project. I think it needs to be a Web App and not a Desktop App, but with a different redirect_uri specified for the Oauth2 authorization callback. I found these migration guides from Google which should help me migrate and correctly create a new GAM project Web App:

• OAuth2 OOB Migration
  
• OAuth2 Loopback Migration
  

I'll sync back here after I go through those to figure out the new configuration. And I apologize if this is too much information, but I want to respect your time by staying in sync with you on this since I'm sure you have plenty to do already, and I really appreciate your help.

[Ross Scroggs]

Gam is a Desktop App, not a Web app.

Send me a  Meet/Zoom invitation directly.

Ross

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/96cb55ab-3592-4788-b1e2-72e79ffab5d2n%40googlegroups.com.

--

Ross Scroggs

ross.s...@gmail.com

[Bailey Malone]

Okay, sure. Thank you for making the time to help me.


One more update for discussion context:

I found more discussion threads related to this Google OAuth migration issue.

• https://groups.google.com/g/google-apps-manager/c/nC7IiZtOyQk
• https://groups.google.com/g/google-apps-manager/c/EpJ9aB41_JU

It sounds like I have to use gam v6.16+ to create my project to fix this OOB migration issue. However, I'm still experiencing the problem of being unable to create a GAM project using a GAM version greater than v6.15. I've tested creating a GAM project with various versions, and I can create projects successfully for versions up to 6.15. But I cannot create a new project for GAM v.6.16 or later, which is what I need.

I'm only aware of these 2 requirements to create a new GAM project, both of which are fulfilled:

1. the admin account provided is an organization admin (yes, and is a super admin in our Google Workspace/Admin)
2. the GAM Create Project ClientID is whitelisted and set to "trusted" Security > API Controls > App Access Control in Google Admin

Is there a change in the requirements needed for new projects starting in 6.16 that I'm missing or not completing, maybe?

[Bailey Malone]

This has been solved! Thank you so much, Ross!

The issue ended up being related to my network. For some reason google domains could be reached, but the redirect url in 6.16 and later was being blocked from loading.

Ross helped me workaround this by opening a Google Cloud Shell and running the GAM OAuth commands from there to finalize the authentication for my GAM project.