Skip to content
This repository has been archived by the owner on Oct 4, 2024. It is now read-only.

Token expired? #290

Closed
wills721 opened this issue Jan 31, 2021 · 12 comments · Fixed by #316
Closed

Token expired? #290

wills721 opened this issue Jan 31, 2021 · 12 comments · Fixed by #316
Assignees
@gilesknap
Labels
For Review

Comments

@wills721
Copy link

I had to re-install gphotos from scratch. I generated a new oauth key using the guide.....but still seem to be getting the error below at start up?

01-31 18:13:13 WARNING gphotos-sync 2.14.0+4.37fad11 2021-01-31 18:13:13.472700
01-31 18:13:13 ERROR
Process failed.
Traceback (most recent call last):
File "/home/will/.local/share/virtualenvs/will-PWwV11kO/lib/python3.6/site-packages/requests_oauthlib/oauth2_session.py", line 478, in request
url, http_method=method, body=data, headers=headers
File "/home/will/.local/share/virtualenvs/will-PWwV11kO/lib/python3.6/site-packages/oauthlib/oauth2/rfc6749/clients/base.py", line 198, in add_token
raise TokenExpiredError()
oauthlib.oauth2.rfc6749.errors.TokenExpiredError: (token_expired)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/home/will/.local/share/virtualenvs/will-PWwV11kO/lib/python3.6/site-packages/gphotos/Main.py", line 417, in main
self.setup(args, db_path)
File "/home/will/.local/share/virtualenvs/will-PWwV11kO/lib/python3.6/site-packages/gphotos/Main.py", line 309, in setup
self.google_photos_client = RestClient(photos_api_url, self.auth.session)
File "/home/will/.local/share/virtualenvs/will-PWwV11kO/lib/python3.6/site-packages/gphotos/restclient.py", line 38, in init
service_document = self.auth_session.get(api_url).json()
File "/home/will/.local/share/virtualenvs/will-PWwV11kO/lib/python3.6/site-packages/requests/sessions.py", line 543, in get
return self.request('GET', url, **kwargs)
File "/home/will/.local/share/virtualenvs/will-PWwV11kO/lib/python3.6/site-packages/requests_oauthlib/oauth2_session.py", line 497, in request
self.auto_refresh_url, auth=auth, **kwargs
File "/home/will/.local/share/virtualenvs/will-PWwV11kO/lib/python3.6/site-packages/requests_oauthlib/oauth2_session.py", line 446, in refresh_token
self.token = self._client.parse_request_body_response(r.text, scope=self.scope)
File "/home/will/.local/share/virtualenvs/will-PWwV11kO/lib/python3.6/site-packages/oauthlib/oauth2/rfc6749/clients/base.py", line 421, in parse_request_body_response
self.token = parse_token_response(body, scope=scope)
File "/home/will/.local/share/virtualenvs/will-PWwV11kO/lib/python3.6/site-packages/oauthlib/oauth2/rfc6749/parameters.py", line 431, in parse_token_response
validate_token_parameters(params)
File "/home/will/.local/share/virtualenvs/will-PWwV11kO/lib/python3.6/site-packages/oauthlib/oauth2/rfc6749/parameters.py", line 438, in validate_token_parameters
raise_from_error(params.get('error'), params)
File "/home/will/.local/share/virtualenvs/will-PWwV11kO/lib/python3.6/site-packages/oauthlib/oauth2/rfc6749/errors.py", line 405, in raise_from_error
raise cls(**kwargs)
oauthlib.oauth2.rfc6749.errors.InvalidGrantError: (invalid_grant) Bad Request
01-31 18:13:13 WARNING Done.
@gilesknap
Copy link
Owner

I think you had an expired authorisation token., Re-creating the client secret would not help with this. But running with --new-token would fix it right away (A full re-install would also have the side effect of deleting the expired token too).

I need to highlight this in the expired token error message.,

@wills721
Copy link
Author

wills721 commented Feb 1, 2021

Yes -- sorry -- I'm all good now.

@dougthor42
Copy link
Contributor

I had the same issue. Running --new-token does indeed resolve things, but this is not sustainable when gphoto-sync is run as a cron task, as it requires user input.

Is there a way to either (a) request a non-expiring token / set the token expiry to some absurdly large value, (b) use a different auth method that never expires, or (c) automatically refresh the token?

I'm definitely no guru at OAuth, but it seems like requests_oauth has some info on refreshing tokens?

@gilesknap
Copy link
Owner

I don't know what is happening here since my tokens have all lasted for a few years now. It's possible that your token is not set up to have a refresh token it maybe Google have introduced new token policies

If you would like me to investigate this please recreate your secret and post the screens you go through to do so.

@gilesknap
Copy link
Owner

gilesknap commented May 8, 2021 •
edited
Loading

Re Refresh tokens. Yes that is what we use and it usually works. I'm wondering if in setting up your secret you have somehow specified that refresh is not allowed.

@dougthor42
Copy link
Contributor

I kinda figured that I may have set up the OAuth token incorrectly. These are my notes on what I did to create the OAuth 2.0 client ID.

(Basically, I followed https://www.linuxuprising.com/2019/06/how-to-backup-google-photos-to-your.html)

Create Google Cloud project:

  1. https://console.cloud.google.com/cloud-resource-manager?pli=1
  2. Country: US
  3. Agree to ToS
  4. Create Project
  5. Project Name: Photos Sync
  6. Project ID: photos-sync-311223 (can’t be changed later!)
  7. Location: No organization
  8. Create

Enable the Photos API for the project:

  1. https://console.cloud.google.com/apis/library?project=_
  2. Select the Photos Sync project
  3. Search for Photos Library API by Google
  4. Enable it.

Create the Credentials:

  1. https://console.cloud.google.com/home/dashboard?project=photos-sync-311223
  2. API & Services > Credentials
  3. Configure Consent Screen
    1. User Type: External (internal is not available)
    2. Create
    3. App Registration - OAuth consent screen:
      1. App Name: Photos Sync
      2. User support email: my_email@gmail.com
      3. Everything else: empty
      4. Developer Contact Info: my_email@gmail.com
      5. Save and Continue
    4. App Registration - Scopes
      1. No changes
      2. Save and Continue
    5. App Registration - Test Users
      1. Add my_email@gmail.com
      2. Save and Continue
    6. App Registration - Summary
      1. Back to Dashboard
  4. Credentials
    1. Create Credentials > OAuth client ID
    2. Application Type: Desktop app
    3. Name: Photos Sync
    4. Save Client ID and Secret in Bitwarden “Photos Sync OAuth Client ID”
    5. Download OAuth client ID as JSON. Save somewhere as client_secret.json.

That's basically what I did. I went through those actions again and tried to look for any settings on the OAuth Client ID, but didn't see anything that might set the expiry.

@synman
Copy link

synman commented May 14, 2021

still happening weekly for me as well

@gilesknap
Copy link
Owner

gilesknap commented May 20, 2021 via email

@dougthor42
Copy link
Contributor

TL;DR:

Publish the Google App.

From https://developers.google.com/identity/protocols/oauth2#expiration (emphasis mine):

A Google Cloud Platform project with an OAuth consent screen configured for an external user type and a publishing status of "Testing" is issued a refresh token expiring in 7 days.

To publish the app, here's what I did:

  1. Head to the project's APIs & Services dashboard in GCP.
  2. Click on OAuth consent screen
  3. Press Publish App
  4. Confirm the notice about pushing to production
  5. Re-run gphotos-sync with the --new-token arg.
  6. Head to the link the gphotos-sync provides.
  7. You'll get a warning about unverified apps. Press Advanced and then Go to AppName (Unsafe).
    image
  8. Follow the rest of the steps as normal.

I'll try to report back here after 7 days and see if things are actually fixed. I'm betting they are.

Other notes that might be of interest

The oauthlib.oauth2.rfc6749.errors.InvalidGrantError message changes from "Token has been expired or revoked." to "Bad Request" 7 days after the expiry (this could cause some annoyances when investigating things):

$ grep -r "InvalidGrantError"
gphotos210514_230005.log:oauthlib.oauth2.rfc6749.errors.InvalidGrantError: (invalid_grant) Token has been expired or revoked.
gphotos210515_230005.log:oauthlib.oauth2.rfc6749.errors.InvalidGrantError: (invalid_grant) Token has been expired or revoked.
gphotos210516_230005.log:oauthlib.oauth2.rfc6749.errors.InvalidGrantError: (invalid_grant) Token has been expired or revoked.
gphotos210517_230004.log:oauthlib.oauth2.rfc6749.errors.InvalidGrantError: (invalid_grant) Token has been expired or revoked.
gphotos210518_230003.log:oauthlib.oauth2.rfc6749.errors.InvalidGrantError: (invalid_grant) Token has been expired or revoked.
gphotos210519_230003.log:oauthlib.oauth2.rfc6749.errors.InvalidGrantError: (invalid_grant) Token has been expired or revoked.
gphotos210520_230003.log:oauthlib.oauth2.rfc6749.errors.InvalidGrantError: (invalid_grant) Token has been expired or revoked.
gphotos210521_230003.log:oauthlib.oauth2.rfc6749.errors.InvalidGrantError: (invalid_grant) Token has been expired or revoked.
gphotos210522_230007.log:oauthlib.oauth2.rfc6749.errors.InvalidGrantError: (invalid_grant) Bad Request

@gilesknap
Copy link
Owner

gilesknap commented May 24, 2021 via email

@dougthor42
Copy link
Contributor

Well it's been over a week since I published the google app and things are still working wonderfully. I'm inclined to say this is resolved.

@gilesknap
Copy link
Owner

gilesknap commented May 31, 2021 •
edited
Loading

Thanks @dougthor42 that's great. I guess this requirement is not backdated since my 3 year old token still works.

Would you be interested in making a PR that adds your steps for creating the token.? Maybe we should start a separate MD file linked from readme.md

@dougthor42 dougthor42 mentioned this issue Jun 7, 2021
Merged
@Iceman248 Iceman248 mentioned this issue Nov 7, 2022
Closed
@deathtenk deathtenk mentioned this issue Mar 5, 2023
Closed
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@gilesknap gilesknap

Labels
For Review
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Add docs/google-project-setup.rst and link to it from README.rst.
4 participants
@gilesknap @synman @dougthor42 @wills721