Oracle APEX 18.1 Social Sign-In google

Hi Vikas,

debug output shows this

JSON POST https://www.googleapis.com/oauth2/v4/token request got HTTP status 401

{

"error": "invalid_client",

"error_description": "Unauthorized"

}

when APEX sends Client ID/Secret to get the access token. I think you must have a typo in the credentials, perhaps additional spaces.

Regards,

Christian

The scope defines what groups of attributes you want to receive from the authentication provider. OpenID standardizes a few and Google implements OpenID. However, you should check out the documentation of the provider for what is available. Enable LEVEL9 in your session to see the returned JSON for debugging.

Here is an example from one of my test apps:

• Scope: profile,email,https://www.googleapis.com/auth/gmail.metadata
• Username attribute: email
• Post-authentication procedure:
  procedure post_auth is
  begin
    :G_USER_INFO := 'Authenticated via Google. '||chr(10)||
                    'Profile: '||apex_json.get_varchar2('profile')||chr(10)||
                    'Picture: '||apex_json.get_varchar2('picture')||chr(10)||
                    'Email: '||apex_json.get_varchar2('email')||chr(10)||
                    'ID Token: '||apex_json.get_varchar2('id_token')||chr(10)||
                    'Access Token: '||apex_json.get_varchar2('access_token');
  end post_auth;
• PL/SQL region to query GMail labels (requires gmail.metadata scope)
  declare
      c clob;
  begin
      c := apex_web_service.make_rest_request (
           p_url                  => 'https://www.googleapis.com/gmail/v1/users/'||:APP_USER||'/labels',
           p_http_method          => 'GET',
           p_credential_static_id => 'GOOGLE' );
      htp.p(apex_escape.html(c));
  end;

The Social Sign-In Authn saves the OAuth2 access token in the session credentials store, so you can make additional REST calls to the authentication provider, like above. However, the access token's lifetime is different than the APEX session lifetime. We have not implemented automatic refresh yet, so once the access token expires, these calls will fail. You can use them to fetch additional data to set up the APEX session, though.

Google documentation:

• https://developers.google.com/+/web/api/rest/oauth#authorization-scopes
• https://developers.google.com/identity/protocols/googlescopes

Regards,

Christian

Social Sign-In uses APEX_WEB_SERVICE internally (or rather, it's implementation package). You have to set up your ACLs in a way that enables call-outs to the Google URLs (accounts.google.com, www.googleapis.com). If you are using the Authorized URLs feature, you need to white-list them, too.

Regards,

Christian