Google OAuth2 access additional User information #1113

mo-cmyk · 2022-10-28T21:44:10Z

mo-cmyk
Oct 28, 2022

Hi, I implemented the Google OAuth2 Router as shown in the documentation, and created everything necessary on the Google Cloud Console (ID, Secret, etc.). In my Database, my User Model also requires the first and last name of each user which works excellently with a regular register endpoint. Is there any way to access the Google User's last and first name information in "FastAPI Users"?

For now, I am simply getting Validation Errors as soon as the OAuth endpoint is used, due to no first and last name being provided.
Any Help is greatly appreciated!

I was able to modify the Google OAuth Client to extract also the first and last name as such:

from typing import Any, Dict, List, Optional, Tuple, cast

import httpx
from typing_extensions import Literal, TypedDict

from httpx_oauth.errors import GetIdEmailError
from httpx_oauth.oauth2 import BaseOAuth2

AUTHORIZE_ENDPOINT = "https://accounts.google.com/o/oauth2/v2/auth"
ACCESS_TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token"
REVOKE_TOKEN_ENDPOINT = "https://accounts.google.com/o/oauth2/revoke"
BASE_SCOPES = [
    "https://www.googleapis.com/auth/userinfo.profile",
    "https://www.googleapis.com/auth/userinfo.email",
]
PROFILE_ENDPOINT = "https://people.googleapis.com/v1/people/me"


class GoogleOAuth2AuthorizeParams(TypedDict, total=False):
    access_type: Literal["online", "offline"]
    include_granted_scopes: bool
    login_hint: str
    prompt: Literal["none", "consent", "select_account"]


class GoogleOAuth2(BaseOAuth2[GoogleOAuth2AuthorizeParams]):
    def __init__(
        self,
        client_id: str,
        client_secret: <
8000
span class="pl-smi">str,
        scope: Optional[List[str]] = BASE_SCOPES,
        name="google",
    ):
        super().__init__(
            client_id,
            client_secret,
            AUTHORIZE_ENDPOINT,
            ACCESS_TOKEN_ENDPOINT,
            ACCESS_TOKEN_ENDPOINT,
            REVOKE_TOKEN_ENDPOINT,
            name=name,
            base_scopes=scope,
        )

    async def get_id_email(self, token: str) -> Tuple[str, str]:
        async with self.get_httpx_client() as client:
            response = await client.get(
                PROFILE_ENDPOINT,
                params={"personFields": "emailAddresses,names"},
                headers={**self.request_headers, "Authorization": f"Bearer {token}"},
            )

            if response.status_code >= 400:
                raise GetIdEmailError(response.json())

            data = cast(Dict[str, Any], response.json())
            user_id = data["resourceName"]
            user_email = next(
                email["value"]
                for email in data["emailAddresses"]
                if email["metadata"]["primary"]
            )
            first_name, last_name = next(
                (name.get('givenName'), name.get('familyName'))
                for name in data["names"]
                if name["metadata"]["primary"]
            )
            print("##########")
            print(first_name)
            print(last_name)
            print("##########")

            return user_id, user_email

With a lot of reverse engineering, it is kind of possible to at least create an account using google utilizing first and last name, but is there any way it is supported by the package without me having a local fork of the package or something ?

frankie567 · 2022-11-02T08:47:58Z

frankie567
Nov 2, 2022
Maintainer

IMO, your best bet is to define your own /callback route. Here is the one provided by FastAPI Users:

fastapi-users/fastapi_users/router/oauth.py

Lines 100 to 147 in baca17d

    
           async def callback( 
        
               request: Request, 
        
               response: Response, 
        
               access_token_state: Tuple[OAuth2Token, str] = Depends( 
        
                   oauth2_authorize_callback 
        
               ), 
        
               user_manager: BaseUserManager[models.UP, models.ID] = Depends(get_user_manager), 
        
               strategy: Strategy[models.UP, models.ID] = Depends(backend.get_strategy), 
        
           ): 
        
               token, state = access_token_state 
        
               account_id, account_email = await oauth_client.get_id_email( 
        
                   token["access_token"] 
        
               ) 
        
               try: 
        
                   decode_jwt(state, state_secret, [STATE_TOKEN_AUDIENCE]) 
        
               except jwt.DecodeError: 
        
                   raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST) 
        
               try: 
        
                   user = await user_manager.oauth_callback( 
        
                       oauth_client.name, 
        
                       token["access_token"], 
        
                       account_id, 
        
10000
account_email, 
        
                       token.get("expires_at"), 
        
                       token.get("refresh_token"), 
        
                       request, 
        
                       associate_by_email=associate_by_email, 
        
                   ) 
        
               except UserAlreadyExists: 
        
                   raise HTTPException( 
        
                       status_code=status.HTTP_400_BAD_REQUEST, 
        
                       detail=ErrorCode.OAUTH_USER_ALREADY_EXISTS, 
        
                   ) 
        
               if not user.is_active: 
        
                   raise HTTPException( 
        
                       status_code=status.HTTP_400_BAD_REQUEST, 
        
                       detail=ErrorCode.LOGIN_BAD_CREDENTIALS, 
        
                   ) 
        
               # Authenticate 
        
               login_return = await backend.login(strategy, user, response) 
        
               await user_manager.on_after_login(user, request) 
        
               return login_return 
        
           return router

As you can see, the first step is to call get_id_email. If you avoid this and make your own call to the Google API, you'll be able to retrieve all the information you need and going through the rest of the process.

10 replies

frankie567 Nov 3, 2022
Maintainer

Not necessarily, you could very well update the user in your router logic without touching the manager methods.

mo-cmyk Nov 3, 2022
Author

Where would I do that best and how? I am really sorry if my questions are bad I am just really trying to understand the logic here. So to make it easier to understand let's say I implemented everything in a way that I now have access to the user's name via a google API call inside my OAuth router in the callback method, how would I now store that name for the given user without touching my user_manager?

mo-cmyk Nov 3, 2022
Author

Edit:
I got it somewhat working by adding this code to my router:

        try:
            user = await user_manager.oauth_callback(
                oauth_client.name,
                token["access_token"],
                account_id,
                account_email,
                token.get("expires_at"),
                token.get("refresh_token"),
                request,
                associate_by_email=associate_by_email,
            )
            if user.first_name != first_name or user.last_name != user.last_name:
                await user_manager.update(user_update=UserUpdate(first_name=first_name, last_name=last_name),user=user, request=request)

the problem is that I needed to a) modify my database Model to make the name not required like this:

class OAuthAccount(BaseOAuthAccount):
    """
    OAuth Account Model
    """
    first_name: str = None
    last_name: str = None


class User(BeanieBaseUser[PydanticObjectId]):
    """
    User Base Model (Instructor)
    """
    oauth_accounts: List[OAuthAccount] = Field(default_factory=list)
    first_name: str = None
    last_name: str = None

and also my update/create models to this:

class UserRead(schemas.BaseUser[PydanticObjectId]):
    """
    Class for User Read Operations
    """
    first_name: Optional[str] = None
    last_name: Optional[str] = None


class UserCreate(schemas.BaseUserCreate):
    """
    Class for User Create Operations
    """
    first_name: Optional[str] = None
    last_name: Optional[str] = None


class UserUpdate(schemas.BaseUserUpdate):
    """
    Class for User Edit Operations
    """
    first_name: Optional[str] = None
    last_name: Optional[str] = None

Therefore if I register using the regular register endpoint it is not required anymore to enter a name which should still bel required.
Any ideas to fix that?

mo-cmyk Nov 3, 2022
Author

Maybe we also did talk past each other? @frankie567

mo-cmyk Nov 4, 2022
Author

Actually, I realized my approach isn't really the right, since my on after register, sends an email, addressing a user with their name which would be missing if I set it after register.

caniko · 2023-11-14T16:51:38Z

caniko
Nov 14, 2023

Thanks for this! This should be in the docs!

0 replies

saeedmv · 2023-11-29T15:07:43Z

saeedmv
Nov 29, 2023

Hi, I am trying to generate REFRESH TOKEN from Google Cloud Console for my Python code. Also, I already have client_id and client_secret.

could you help me generate REFRESH TOKEN from Google Cloud Console or any other way?

My 'Jason code' is as 'client_secret.json' as file name:
{ "web": { "client_id": "my_client_id", "client_secret": "my_client_secre", "redirect_uris": ["urn:ietf:wg:oauth:2.0:oob", "http://localhost"] } }
my 'credentials code' is as 'credentials.json' as 8000 file name:
{ "token": "my_token", "refresh_token": "my_refresh_token", "token_uri": "https://oauth2.googleapis.com/token", "client_id": "my_client_id", "client_secret": "my_client_secret", "scopes": [ "https://www.googleapis.com/auth/drive" ], "expiry": "2022-01-01T00:00:00Z" }
my refresh token code is :
`from google.oauth2.credentials import Credentials
import json

Load the client secret file

client_secret_file = "client_secret.json"

Load the credentials file

with open("credentials.json", "r") as f:
credentials_data = json.load(f)

Create the credentials object

creds = Credentials.from_authorized_user_info(info=credentials_data)

Print the refresh token

print("Refresh Token:", creds.refresh_token)`

Is my activities fine?

0 replies

dikwickley · 2025-03-18T20:38:11Z

dikwickley
Mar 18, 2025

thanks!

0 replies

dikwickley · 2025-03-18T20:57:49Z

dikwickley
Mar 18, 2025

for anyone out there

# TODO: Properly implement this https://github.com/fastapi-users/fastapi-users/blob/master/fastapi_users/router/oauth.py#L101-L154
@auth_router.get("/auth/github/custom-callback", tags=["auth"])
async def custom_github_callback(
    request: Request,
    code: str,
    state: str,
    user_manager: BaseUserManager[models.UP, models.ID] = Depends(fastapi_users.get_user_manager),):
    token = await github_oauth_client.get_access_token(code, redirect_uri="http://localhost:3000/api/auth/callback/github")
    account_id, account_email = await github_oauth_client.get_id_email(
            token["access_token"]
        )

    user = await github_oauth_client.get_profile(token['access_token'])

    # HERE it is!
    print(user)

    try:
        user = await user_manager.oauth_callback(
            github_oauth_client.name,
            token["access_token"],
            account_id,
            account_email,
            token.get("expires_at"),
            token.get("refresh_token"),
            associate_by_email=True,
            is_verified_by_default=True
        )
    except UserAlreadyExists:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail=ErrorCode.OAUTH_USER_ALREADY_EXISTS,
        )
    
    if not user.is_active:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail=ErrorCode.LOGIN_BAD_CREDENTIALS,
        )

    response = await auth_backend.login(auth_backend.get_strategy(), user)
    await user_manager.on_after_login(user, request, response)

    return response

and then in your FE just use the /custom-callback (PS import all necessary stuff)

0 replies

Uh oh!

Google OAuth2 access additional User information #1113

Uh oh!

Uh oh!

mo-cmyk Oct 28, 2022

Replies: 5 comments · 10 replies

Uh oh!

frankie567 Nov 2, 2022 Maintainer

Uh oh!

frankie567 Nov 3, 2022 Maintainer

Uh oh!

Uh oh!

mo-cmyk Nov 3, 2022 Author

Uh oh!

mo-cmyk Nov 3, 2022 Author

Uh oh!

mo-cmyk Nov 3, 2022 Author

Uh oh!

mo-cmyk Nov 4, 2022 Author

Uh oh!

caniko Nov 14, 2023

Uh oh!

Uh oh!

saeedmv Nov 29, 2023

Load the client secret file

Load the credentials file

Create the credentials object

Print the refresh token

Uh oh!

dikwickley Mar 18, 2025

Uh oh!

Uh oh!

dikwickley Mar 18, 2025

mo-cmyk
Oct 28, 2022

Replies: 5 comments 10 replies

frankie567
Nov 2, 2022
Maintainer

frankie567 Nov 3, 2022
Maintainer

mo-cmyk Nov 3, 2022
Author

mo-cmyk Nov 3, 2022
Author

mo-cmyk Nov 3, 2022
Author

mo-cmyk Nov 4, 2022
Author

caniko
Nov 14, 2023

saeedmv
Nov 29, 2023

dikwickley
Mar 18, 2025

dikwickley
Mar 18, 2025