6

I am relying on Google OAuth to authorize a user for a site I'm building. At the time I'm requesting permission, I already know which Google Account he wants to use (I'm using Google OAuth as a second level auth). However if the User is logged in to several Google Accounts at once, Google redirects the user to a SelectSession interface.

When the user is directed to https://accounts.google.com/o/oauth2/auth?... he ends on https://www.google.com/a/SelectSession. This is unnecessary, because I already know which session he wants to use.

Does anyone know a way to automatically select a specific account, so that the user does not need to manually select the session at https://www.google.com/a/SelectSession?

Rob W
  • 341,306
  • 83
  • 791
  • 678
lucasvo
  • 61
  • 1
  • 2
  • @RobW Yeah, but the question is: What is so special about the OP's design, that it won't work to let any user sign in, then access his email address and see "ah, this is xxx@gmail.com"? – Jan Gerlinger Sep 20 '12 at 08:16
  • @JanGerlinger The email address is already chosen/given. Now, we only need to verify that the email address indeeds belongs to the user. Any other account is not relevant, hence it's desired that the email address can be selected programatically, in order to reduce the number of user interactions. – Rob W Sep 20 '12 at 08:20
  • @RobW Yeah, that's obviously already clear to me. But as this is not possible, my intention was to get more background info about the design decisions behind this, to see if there are alternatives to it. – Jan Gerlinger Sep 20 '12 at 09:33
  • @JanGerlinger I admit, it's not the most typical use case. But in a situation where I want to give the user a way to link his Google Account to his existing account on my site. I want to avoid having to tell him that he didn't link the correct account and would have to reauthenticate again. I agree though, that OAuth probably doesn't have such a feature. – lucasvo Sep 20 '12 at 15:41
  • @lucasvo Why not let the user connect *any* account he chooses independent of his existing account? That's the way most websites that have such an option handle it. – Jan Gerlinger Sep 20 '12 at 15:58
  • Removed my first comment, as it was proved wrong by Steve's answer. – Jan Gerlinger Sep 29 '12 at 09:20

2 Answers2

19

If you already know the user's email address you can add the query parameter user_id= as a hint. If the user is logged in as that account, it'll skip the account selection and go straight to the approval.

It doesn't guarantee the user will actually authorize with that account. Its just a hint and there are still opportunities for them to switch to a different account. If you need to know for sure which account they selected, you'd need to verify that afterwards (e.g. call the userinfo endpoint.)

Steve Bazyl
  • 11,002
  • 3
  • 21
  • 24
  • Thanks, this user_id= option was the one I'm looking for. I know I can't force it but I'm doing the checks you mentioned anyway. I wanted to solve that user experience issue of making the choice for them. – lucasvo Sep 21 '12 at 14:45
  • By the way, is that documented somewhere on the Google OAuth documentation or is that a standard feature of OAuth? I did not find it in the IETF draft. – lucasvo Sep 21 '12 at 15:03
  • 3
    AFAIK its neither standard nor documented. Well, it shows up in various places in our docs (e.g. our Google Drive samples) but not in the OAuth docs. – Steve Bazyl Sep 27 '12 at 19:10
  • I have the opposite requirement. I *always* want to ask them which account to proceed with. I guess I can try tacking on `user_id=` or something... – ThaDon Jun 08 '16 at 17:37
  • @ThaDon - use prompt=select_account – Steve Bazyl Jun 22 '16 at 18:42
  • @SteveBazyl I'll give that a shot! If you'd like to put that as an answer on my SO question then after I test I'll mark it as the answer: http://stackoverflow.com/questions/37711665/forcing-a-user-to-choose-an-account-via-google-oauth2?noredirect=1 – ThaDon Jun 27 '16 at 19:32
  • @SteveBazyl this doesn't seem to work if i want to avoid the user choosing the account while using the webViewLink and sending an intent to Google Drive – Steve Mar 29 '17 at 17:11
-1

The point of oAuth is that the app doesn't know login/pass, so what you propose is not usable. If you are in a mobile app (you didn't specify), then the credentials will be stored in cookies.

You can delete cookies for user to log in to an account instead of selecting a new account, but for that you should consider signing out from previous account.

DarthMike
  • 3,471
  • 1
  • 22
  • 18