Raise specific exception when unable to perform Google authentication to provide better debugging
@@ -265,13 +265,16 @@ class Google(Resource):
r = requests.post(access_token_url, data=payload)
token = r.json()
+ if 'error' in token:
+ raise Exception("Error issuing token: %s" % (token['error']))
+
# Step 1bis. Validate (some information of) the id token (if necessary)
google_hosted_domain = current_app.config.get("GOOGLE_HOSTED_DOMAIN")
if google_hosted_domain is not None:
current_app.logger.debug('We need to verify that the token was issued for this hosted domain: %s ' % (google_hosted_domain))
# Get the JSON Web Token
- id_token = r.json()['id_token']
+ id_token = token['id_token']
current_app.logger.debug('The id_token is: %s' % (id_token))
# Extract the payload
@@ -291,6 +294,9 @@ class Google(Resource):
r = requests.get(people_api_url, headers=headers)
profile = r.json()
+ if 'email' not in profile:
+ raise Exception("Unable to fetch user e-mail. Please ensure your application has Google+ API access")
+
user = setup_user(profile.get('email'), profile.get('groups', []), current_app.config.get('GOOGLE_DEFAULT_ROLE', 'View'))
# Tell Flask-Principal the identity changed
