Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Not being able to choose the right channel when using OAuth 2.0 for Web Server Applications flow

My app follows the server side authorization flow as described in https://developers.google.com/youtube/v3/guides/auth/server-side-web-apps. I force prompt=select_account.

In the most basic case, on "Step 3: Google prompts user for consent", the user sees a screen with one or more accounts titled "Choose an account". If the account that the user chooses only has a single channel associated with it, the flow then proceeds directly to "Step 4: Handle the OAuth 2.0 server response".

If the user has many channels associated with the account then the user might see another screen titled "Choose your account or a brand account".

For me personally I have two Google accounts: personal and work account and I see them both on the "Choose an account" screen. If I choose my personal account, I get directly to the app. If I choose my work account I see the additional screen where I can choose my "personal" work YouTube channel/account or the company wide shared channel/account. In total I can manage and access 3 YouTube channels/accounts.

The problem is that some users don't see all of their channels listed in the "Choose your account or a brand account". If the users are logged in to YouTube at the same time, they can still access all of their channels from the top right corner account selector on YouTube, but they can't see them at all in the selector. I've tried calling YT API channels.list in these kinds of cases but it doesn't return the missing channels, only the one the user picked from the selector.

It feels like I'm missing something obvious here, but since I don't have much control over the OAuth flow, I'm not sure how to go about fixing this. Is this even a problem on my end or do I just need to instruct the users to do something on their end?

Possibly related things:

  • YouTube APIs - Access mutiple youtube channels (Brand Accounts) using Google Admin account
  • YouTube API v3 get all channels associated with a logged in user
  • Youtube Brand Manager API V3 Support
  • Content owner "umbrella" accounts https://support.google.com/youtube/answer/6301188
  • default channel https://support.google.com/youtube/answer/6019090?hl=en
  • https://youtube-eng.googleblog.com/2013/06/google-page-identities-and-youtube-api_24.html
  • "Default channel with main account authorization" https://issuetracker.google.com/issues/35177410
like image 891
Leo Lännenmäki Avatar asked Jul 27 '17 12:07

Leo Lännenmäki


People also ask

Which OAuth 2.0 grant type should be used for public untrusted client application?

For most cases, we recommend using the Authorization Code Flow with PKCE because the Access Token is not exposed on the client side, and this flow can return Refresh Tokens. To learn more about how this flow works and how to implement it, see Authorization Code Flow with Proof Key for Code Exchange (PKCE).

Which of the following is preferred way to authenticate a user when using OAuth2 protocol?

A standard for user authentication using OAuth: OpenID Connect. OpenID Connect is an open standard published in early 2014 that defines an interoperable way to use OAuth 2.0 to perform user authentication.

What is front channel in OAuth?

The front channel flow is used by the client application to obtain an authorization code grant. The back channel is used by the client application to exchange the authorization code grant for an access token (and optionally a refresh token). It assumes the Resource Owner and Client Application are on separate devices.


1 Answers

It could be that the unlisted accounts are accounts that the users are not owners of but just managers for and where the flag onBehalfOfContentOwner is not set.

In the channels.list API there are the parameters

managedByMe boolean

This parameter can only be used in a properly authorized request. Note: This parameter is intended exclusively for YouTube content partners.

Set this parameter's value to true to instruct the API to only return channels managed by the content owner that the onBehalfOfContentOwner parameter specifies. The user must be authenticated as a CMS account linked to the specified content owner and onBehalfOfContentOwner must be provided.

and

onBehalfOfContentOwner string

This parameter can only be used in a properly authorized request. Note: This parameter is intended exclusively for YouTube content partners.

The onBehalfOfContentOwner parameter indicates that the request's authorization credentials identify a YouTube CMS user who is acting on behalf of the content owner specified in the parameter value. This parameter is intended for YouTube content partners that own and manage many different YouTube channels. It allows content owners to authenticate once and get access to all their video and channel data, without having to provide authentication credentials for each individual channel. The CMS account that the user authenticates with must be linked to the specified YouTube content owner.

like image 59
Arigion Avatar answered Nov 27 '22 01:11

Arigion