Google Cloud Console: Invalid redirect URI

Question

The task I am working now is to set up google authorization to access resources of my organization.

But there is a problem with this task. My organization uses non standard domain for its local network: domain.off. And when I try to set 'http://dev.domain.off:12345/auth/google/callback.html' as a oauth2 callback in the Google Cloud Console (https://cloud.google.com/console) I get 'Invalid redirect URI' error.

I cannot use direct address with correct internet domain because there are many other services in private development domain of my organization I have to use that conflict with different addresses.

I cannot use production enviroment with direct address for the development purposes. Development enviroment has only private addresses, domain.off.

I cannot modify hole development enviroment to change all private dev addresses to public. This is a task of not my compenency.

Is there any solution to my problem? The only solution I see now is to ask google developers to remove or modify URI validator in oauth callback setting form to accept non standard domains.

Answer 1

What you probably want is to use one of the alternative Oauth workflows.

If all you want is to use the google cloud from your service, go for a service account as explained here: https://developers.google.com/console/help/new/#generatingoauth2 I have this working at teowaki.com for interacting with google bigquery and it works seamlessly. All you need is to generate a key on the cloud console and place the key on your server.

If you need to identify users, then you can go for the OAuth for installed applications as shown here https://developers.google.com/console/help/new/#generatingoauth2

In this case, you can choose beetween the users going to a URL in which they will be presented a token they need to paste back onto your application, or being redirected to a URL in localhost. Since I assume you are doing a webapp, you should choose the first option and present the users with a token they need to paste. It's probably not the best UX ever, but being an internal application it is probably doable.

Answer 2

since you cannot use direct address with correct internet domain

you could try something like this

You can create a master subdomain to get all google auth responses and redirect to correct subdomain using the "state" query parameter.

For example create google.mydomain.com and use it as your valid "Redirect URI" and Apache will redirect this url to each user with redirect (or rewrite) feature.

More info about apache redirects in http://www.simonecarletti.com/blog/2009/01/apache-query-string-redirects/

Here the code:

RewriteEngine On
RewriteCond %{HTTP_HOST} ^google\.
RewriteCond %{QUERY_STRING} state=([a-z0-9]+)
RewriteRule ^(.*)$ http://%1.mydomain.com/$1 [L]