Cannot log out from GooglePlus Auth. Homepage keeps calling its GooglePlus callback

[epetxepe]

Hi all,

I've correctly implemented the login with GooglePlus, but once I signed up with an account, I'm not able to logout / disconnect correctly, and use local or other Google accounts.

I'm using the login from the example:

            <script type="text/javascript">                    
                     var signInCallback = function (result) {
                    if (result['error']) {
                      alert('An error happened:', result['error']);
                    } else {
                      $('#code').attr('value', result['code']);
                      $('#at').attr('value', result['access_token']);
                      $('#google-plus').submit();
                    }
                };                    
               </script>
                  <script type="text/javascript">
                   (function () {
                       var po = document.createElement('script');
                       po.type = 'text/javascript';
                       po.async = true;
                       po.src = 'https://plus.google.com/js/client:plusone.js?onload=start';
                       var s = document.getElementsByTagName('script')[0];
                       s.parentNode.insertBefore(po, s);
                   })();
                    </script>
                  <li role="presentation">
                 <form id="google-plus" method="post" action="{% url "social:complete" backend="google-plus" %}">{% csrf_token %}
                    <input id="at" type="hidden" name="access_token" value="" />
                    <input id="code" type="hidden" name="code" value="" />

                    <div id="signinButton">
                      <span class="g-signin" data-scope="{{ plus_scope }}"
                                             data-clientid="{{ plus_id }}"
                                             data-redirecturi="postmessage"
                                             data-accesstype="offline"
                                             data-cookiepolicy="single_host_origin"
                                             data-callback="signInCallback">
                      </span>
                    </div>
               </form>
               </li>`

I've tried for logout both

url(r'^logout/$', 'django.contrib.auth.views.logout', {'next_page': '/'},  name='logout'),

and my own view

def logout(request):
    """Logs out user"""
    auth_logout(request)
    return redirect('/')
    #url(r'^logout', 'siteLogic.views.logout', name='logout'),

Regarding disconnect, it seems it works well since no association is found in the following code once executed the following

   <div class="social">
        {% for sublist in available_backends|social_backends %}
          <div class="row">
            {% for name, backend in sublist %}
              {% associated backend %}
              {% if association %}
                <form class="disconnect-form" action="{% url "social:disconnect_individual" backend=association.provider association_id=association.id %}" method="post">{% csrf_token %}
                  <button type="submit" name="{{ backend|backend_class }}" class="btn btn-danger">Disconnect {{ backend|backend_name }}</button>           
                </form>
              <!--{% else %}-->
              <!--  <a class="col-md-2 btn btn-default" name="{{ backend|backend_class }}" href="{% url "social:begin" backend=name %}">-->
              <!--    <i class="fa fa-{{ name|icon_name }}"></i>-->
              <!--    {{ backend|backend_name }}-->
              <!--  </a>-->
              <!--{% endif %}-->
            {% endfor %}
          </div>
        {% endfor %}

But once I load the homepage with the login code, it automatically signs in with the initial Google account, without letting me use local accounts or another Google account.

I've tried googling and stackoverflow without much luck and I'm stuck, so help is appreciated.

[crazyscorpio12]

@epetxepe did you find any solution to this yet?

[epetxepe]

@crazyscorpio12 Not yet, but right now I'm focussed on the development of the web-framework. I think it is matter of tweaking the javascript inserted in the main page to avoid automatically sign-in.

[rafa-munoz]

I'm having the same problem. I tried also all posibilities, and I have no clue how can this being solved. Maybe @omab knows the reason.

[omab]

The problem here is that the auth mechanism is done by the Google SDK and loggin out of your application, doesn't mean logging out of your Google account, which is then verified by the SDK when the page is reloaded, and the user is authenticated again.

This https://developers.google.com/+/web/signin/sign-out seems to be the fix to the problem.

[rafa-munoz]

Yes, this JS call function is exactly what I tried, but didn't work, but I think it's because some people are reporting that the logout function doesn't work on localhost. When I have it tested, I will update the Google README file on how to procedure for this functionality.

[epetxepe]

I've opted for an approach to show Logout for local users and Disconnect for python-social-auth, and to revoke the token given by Google plus, so when I try to login next time, it does not log in automatically and I can either log with local accounts or python-social-auth (having to give permission again).

I had to set the following in the settings.py file to revoke the given token:
SOCIAL_AUTH_REVOKE_TOKENS_ON_DISCONNECT = True
and
To make the changes I suggest at #484

The sign-out procedure reported above seems the most natural way.

[omab]

@epetxepe, disconnect will remove the association between the google account and the user in your db, you will need association by email to reconnect that account later.

[omab]

@Menda, maybe it's broken for localhost, but what happens if you setup an entry /etc/hosts to point to your local IP?

[epetxepe]

Dear @Menda @omab,

I've tried to use the SDK sign out solution (https://developers.google.com/+/web/signin/sign-out), and I've not been able to make the solution work. I've tried testing locally and from remote machines.

I've implemented the following:

<script> function signOut() { var auth2 = gapi.auth2.getAuthInstance(); auth2.signOut().then(function () { console.log('User signed out.'); window.location ="https://127.0.0.1:8000/logout"; }); } function onLoad() { gapi.load('auth2', function() { gapi.auth2.init(); }); } </script>

<script src="https://plus.google.com/js/client:plusone.js?onload=onLoad" async defer></script>
...
<a href="#" onclick="signOut();">Sign out</a>

I receive the console.log('User signed out.'); message and logout executes but it is automatically logged again.

Any pointers / example how you have implemented this?
How can I check at debug level if the user has been signed out?

[rafa-munoz]

Hi @epetxepe . In my case I also have the same problem as you, because after using the sign out also the users sign in again. This is not only happening in localhost, but in all servers. Let's see if anybody comes with a solution and document it.

[omab]

@epetxepe, @Menda, I've updated the docs (http://psa.matiasaguirre.net/docs/backends/google.html#google-sign-in) and the example application (https://github.com/omab/python-social-auth/blob/master/examples/django_example/example/templates/home.html#L331-L376) to an up-to-date SDK usage.

[epetxepe]

@omab Thanks for the updates, but I've not been able to get it working correctly.
I've tried:
1.- Updated example. I'm receiving the following error from Google:

1. That’s an error.
   Error: invalid_request
   Application: Si elegans web platform
   You can email the developer of this application at: ------------@gmail.com
   Permission denied to generate login hint for target domain.
   Request Details
   openid.realm=
   scope=email profile openid https://www.googleapis.com/auth/plus.login
   response_type=permission
   redirect_uri=storagerelay://http/127.0.0.1:8000?id=auth720879
   ss_domain=http://127.0.0.1:8000
   client_id=--------------------------
   fetch_basic_profile=true

I've tried it with 127.0.0.1 and localhost. Updated Google Developer Console with http://127.0.0.1/* to match redirect_uri following http://stackoverflow.com/questions/29201763/google-sign-in-is-not-working

No luck.

2.- Updated my original code with updated documentation http://psa.matiasaguirre.net/docs/backends/google.html#google-sign-in, but the same automatically sign-in after sign-out is repeated. Is there a way to see the changes is your documentation html? 

The documentation does not reflect sign out usage and the updated example makes a SDK usage not introduced in the documentation. The example makes a more clear use of the Google's JS SDK objects, while documentation reflects the callback way, which keeps calling complete/google_plus when the https://apis.google.com/js/client:plusone.js is loaded.