Bug 486576 - Cannot log into Google account with two factor authentication enabled
Summary: Cannot log into Google account with two factor authentication enabled
Status: REOPENED
Alias: None
Product: kio-gdrive
Classification: Frameworks and Libraries
Component: general (show other bugs)
Version: 24.02.2
Platform: Other Linux
: NOR normal
Target Milestone: ---
Assignee: Elvis Angelaccio
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-05-04 14:38 UTC by Edmund Laugasson
Modified: 2024-10-18 10:23 UTC (History)
5 users (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments
Google error message when tried to log in with KDE Online Accounts (30.17 KB, image/png)
2024-05-04 14:38 UTC, Edmund Laugasson
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Edmund Laugasson 2024-05-04 14:38:11 UTC
Created attachment 169190 [details]
Google error message when tried to log in with KDE Online Accounts

SUMMARY
Cannot log into Google account with two factor authentication enabled

STEPS TO REPRODUCE
1. Google account with two factor authentication enabled
2. open online account in KDE
3. try to login with Google - impossible

OBSERVED RESULT
Google says:
This browser or app may not be secure. Learn more
Try using a different browser. If you’re already using a supported browser, you can try again to sign in.

EXPECTED RESULT
Login without issues.

SOFTWARE/OS VERSIONS
Linux:  Endeavour OS
KDE Plasma Version: 6.0.4
KDE Frameworks Version: 6.1.0
Qt Version: 6.7.0

ADDITIONAL INFORMATION
Tried to create application password but due to Google restriction with two factor authentication this is not possible anymore - https://support.google.com/accounts/answer/185833?hl=en
Comment 1 Justin Zobel 2024-05-05 03:51:13 UTC
By two factor authentication do you mean a One Time Password or the authentication that's done via a device such as a phone where it prompts you to confirm that it is you signing in?

I've just been able to add my Google Account to Online Accounts using the second method.
Comment 2 Edmund Laugasson 2024-05-06 21:57:32 UTC
(In reply to Justin Zobel from comment #1)
> By two factor authentication do you mean a One Time Password or the
> authentication that's done via a device such as a phone where it prompts you
> to confirm that it is you signing in?

via device

> I've just been able to add my Google Account to Online Accounts using the
> second method.

To be honest, Online Accounts does not even reach to second factor. The error message, which screenshot I added, will appear right after email is entered and Next clicked. I do frequent, usually every day updates and tried again after fresh updates (which didn't update any KDE part) and still same issue. Although I use 24.02.2 version (https://archlinux.org/packages/extra/x86_64/kio-gdrive/), there is 24.04.80 waiting in KDE unstable (https://archlinux.org/packages/kde-unstable/x86_64/kio-gdrive/).

Reason is here - https://support.google.com/accounts/answer/185833?hl=en

If you’ve set up 2-Step Verification but can’t find the option to add an app password, it might be because:
Your Google Account has 2-Step Verification set up only for security keys.
You’re logged into a work, school, or another organization account.
Your Google Account has Advanced Protection.

Advanced Protection
https://support.google.com/accounts/answer/7539956
With 2-Step Verification, the second step could be a:
Prompt sent to your phone
Verification code
Security key

I'm using Prompt and Verification code.

Also there is written:
Also, Advanced Protection limits third-party app access to your data, puts stronger checks on suspicious downloads, and tightens account recovery security to help prevent unauthorized access.

This is the case. This Advanced Protection is very common - widely used and this does not allow to create app password e.g. for KDE Online Accounts.

I have also another GMail account, which does not have 2FA enabled and there I could reach to password field and could log in and add account. Even it required for security reasons SMS-confirmation and sent me SMS and I could even enter confirmation code and it logged in. But no 2FA is enabled with that account.

But with account, where 2FA is enabled, I cannot login. Although I have 14 third party app enabled and in that sense I'm using already that 2FA enabled Google account with 3rd party apps like KDE Online Accounts also is as I see under that non-2FA Google account, where I could log in.

With that experiment I showed clearly, that 2FA is preventing to use KDE Online Accounts. Also as referred upwards, Google itself confirms, that when Advanced Protection by 2FA (Prompt sent to your phone, Verification code) is enabled, then Advanced Protection limits third-party app access to your data, puts stronger checks on suspicious downloads, and tightens account recovery security to help prevent unauthorized access. So, I experience that limitation as I don't see any way to allow KDE Online Accounts to be used while 2FA (Advanced Protection) is enabled.

OAuth2 seems to be in use - https://developers.google.com/identity/account-linking/oauth-linking

Why do you change importance to normal when this issue is still critical as there is not possible to log in?
Comment 3 Edmund Laugasson 2024-05-06 22:10:04 UTC
This is possibly another issue but with that non-2FA account, where I could log in - there I could create a folder via Dolphin but could not create a file directly in Google Drive via Dolphin or upload any file form computer. Even it shows file is uploaded, the file is not visible in Dolphin (even with refresh, also with CTRL+F5) and also in web interface of Google Drive there is no file uploaded.
I tried to upload *.odt file. But tried with *.txt and then succeeded to upload. If only *.txt is allowed, then this is very limited :(
Comment 4 ivanlucchese 2024-07-14 09:44:58 UTC
Well, I have the same problem if I try to login using my email as userid BUT I am able to complete the  login procedure  using my phone number...
Comment 5 ivanlucchese 2024-07-14 09:47:49 UTC
Sorry, I forgot to mention that I'm using  Manjaro with kio-gdrive 24.05.01-1
Comment 6 ivanlucchese 2024-07-14 09:51:34 UTC
And file management through dolphin is OK.
KDE Plasma: 6.0.5
KDE Frameworks: 6.3.0
Comment 7 ivanlucchese 2024-07-14 10:09:11 UTC
(In reply to ivanlucchese from comment #6)
> And file management through dolphin is OK.
At least on root folder (see https://bugs.kde.org/show_bug.cgi?id=487021)
Comment 8 Rose Reed 2024-10-18 10:23:52 UTC
I have the same issue when trying to log in. I could imagine it could be having to do with the UserAgent and the limited features in the WebView login window. Is there any way to get the login token to try and complete the process in Firefox or Chrome, or could the login open in the users default browser instead of its own window?