Login access denied by Google

I tried logging in to my APPSheet account today and Google is telling me I that Access is denied. The full error message is as follows:
“Access denied by a security policy established by the Google Apps administrator of your organization. Please contact your administrator for further assistance.”

I checked my admin setting and APPSheet “Data Access” is granted to everyone in my org.

Any suggestions??

1 50 10.9K
50 REPLIES 50

Tim_Martin
Participant IV

I’ve run into the same thing @DougCrann.
I’ve not logged into this particular app sheet app (I’ve created different apps for different co’s. so I use a company email/app) in a LONG time…

Where did you find the AppSheet ‘Data Access’?
In ‘Security’ in Google’s Admin panel, I found ‘API Permissions’ and I granted ‘trust’ to AppSheet specifically, but that didn’t seem to help either.(even tho I’ve not had to do that elsewhere…)

Any thoughts anyone?

@Tim_Martin Have you had any luck resolving this? We came up with a workaround that’s been successful. Pretty simple.

Thx for the response @Tim_Martin: Update on my issue… I tried logging in using my other computer this morning (mac book air) and have not encountered the same error. So I can now access my APP sheet account just not on my MacBook Pro (not issues logging into the mobile APP either). Spent 45 minutes online yesterday with Google tech support (who are really quite helpful and incredibly accessible and responsive I might add) and they could not find any errors in access settings or permissions etc. Still stumped… I even did a hard drive erase and reinstalled my O/S on the Mac Book Pro and the issue still persists…

Max1
Participant I

I too am having the same issue across my company. It started yesterday.

Steve
Participant V

This message suggests to me that your Google account is likely your work account, not your personal account, and that your employer has changed the policies for your work account in a way that prevents AppSheet from interacting with your work account. You should probably talk to you employer’s IT staff.

I’m having the same issue, and I am the IT staff! I haven’t changed anything.

I’d think the appropriate escalation path would be Google support first (as @DougCrann tried), then AppSheet support.

The nature of the message suggests to me something to do with Google, but I have no experience at all with policy or app permissions, so it could just as easily be an AppSheet thing for all I know.

Dave2
Participant IV

Count me in here as well. Just noticed it happening today with a couple staff. Seems to be device and not account related. I can sign in on my iMac, Android phone, but not my iPad.

Any resolution on this?

UPDATE: I signed out of my appsheet account on my iMac. When I attempted to sign back in, I got the “Access denied…” message.

If the AppSheet site itself is denying you, go straight to AppSheet support: email support@appsheet.com.

Something is amiss with the third party authentication between AppSheet and (it seems like) just Google specifically. Given @DougCrann 's 45 minutes with Google support with no resolution, it is probably some internal/back end matter. I am going to contact AppSheet support, though.

We have been trying to reproduce this problem with our own Google Domain, but to no avail. Quite frustrating.

This is definitely not a platform-wide problem — we have thousands of customers with Google domains and only a few have reported this problem in the last few days. So it is probably a behavioral change or new admin feature Google has introduced that is biting us in these instances.

If one of you is a google admin for your own domain and is willing to work with us on this, please send me an email (praveen@appsheet.com). We’ll probably need to do a live screenshare session, open the google admin console on your side, and look at each of the options in the security pane. I’ve learnt that it takes 5-10 minutes for security changes to the domain to percolate out to all the Google servers. So it might be a slow trial-and-error process.

This would be one thing to look at if you are a Google admin: https://admin.google.com/AdminHome?fral=1#MarketplaceSettings:flyout=basic

Also, this should show an audit history of successful and failed attempts at app authentication.

https://admin.google.com/AdminHome#Reports:subtab=token-audit

I just spent an hour in an online call with @DougCrann (thanks Doug!). But alas, we could not get to the bottom of this.

In Doug’s case, three of his four machines (an Android phone, an iOS Tablet, and a macbook) work fine. But one Macbook Pro alone fails the google security policy. We checked the audit log in the google admin console, and it shows no failures. So this is quite wierd.

Doug also created a dummy account for me in his domain. When I try signing in from my machine with that dummy account, it works fine.

I hope @Max will be able to help us troubleshoot this on Monday, since everyone in his domain seems to be hitting this failure.

I know at least a couple of you are talking with Google cloud support and are being told that the error message is not generated by Google. This is not true, and please push back on them. Here for example is a stackoverflow thread where other folks ran into the same issue with the same error message. https://stackoverflow.com/questions/25508740/policy-enforced-error-when-exchange-oauth2-token-for-go...

I suspect the root cause is that Google is deprecating the Google+ APIs. We used to request user email via an authorization scope tied to the Google+ API. That has since changed to using a different scope. We are now only requesting the new scopes. However, when old authentication tokens are being renewed, I notice from audit logs that Google seems to still be requesting the older scopes as well (things like profile.email). My suspicion is that Google is starting to roll out some change, it has rolled it out to just a few of their authentication servers to test for issues, and this is one of the effects of that.

If you are engaged with Google’s product support, please pass along my theory. We have no way to verify it on our side. We cannot reproduce the problem ourselves on our logins, but we know what our login code does. When it gets an error from Google, it shows the error.

Good morning, Praveen.

I’ve been talking to David about the authentication problem. He informed me that according to the logs he does not use Google+ as the scope of authorization.

I feel front-line Google support is giving us the same info we already know — they are looking at the audit logs in the Admin console. We’ve looked at those with a couple of customers. The basic problem is that Google logs that the permissions were successfully provided, but their code returns an error to our system. And we are doing some kind of trial-and-error to see what might rectify it.

@praveen I was able to resolve this issue for our organization by simply removing the effected users from an app and then adding them again, along with a new invitation/install email. Once they clicked through and completed the install process they were able to access that app as well as any others to which they previously had access. The error seems to have effected only users that I had added individually before adding the entire domain. So far, this has worked for all users that have tried it.

@Dave how did you add the “entire domain”? Did you do this from the Google domain admin console by making AppSheet a trusted app?

@praveen I did this entirely on the AppSheet side, in the users pane of the app editor. I usually deploy new apps to a few users for debugging before opening them up to all users with the “add domain” feature. Initially it seemed like it was just these users who were effected, but I’ve since had a couple people report the same problem who were not in that group. So that is not related, it seems. But for whatever reason, having users reinstall an app resolves the issue for us.

I’m a G Suite reseller and AppSheet and I’m experiencing the same problem with only one user in my domain. The failure happens regardless of the machine where the machine is accessing.

I am willing to solve the problem through remote access.

Anyone who has the time to investigate this today, please LMK — praveen@appsheet.com. I’m on the US west coast, pacific time.

Google has given me these steps as a work around. It is still unclear why the issue is occurring but this at least is a temporary fix.

  1. Log into a G Suite account that cannot get access to AppSheet ( logout of all other google account ).
  2. Go to https://myaccount.google.com/security .
  3. Scroll to “Third-party apps with account access”.
  4. Click “Manage third-party access”.
  5. Select AppSheet and remove access from the list.
  6. Wait 24 hours.
  7. Sign into the Google Drive with the same account in incognito mode ( no extensions or cookies visible ).
  8. Select a Google document that is being used by AppSheet.
  9. Right click and “Open with” -> AppSheet.
  10. This should bring you to the authorization screen for which resources AppSheet is requesting access.
  11. Allow the requested permissions by AppSheet and hopefully this will resolve your issue.

So I think @Rosie_Gossett has some good information here.

If you have used the “Manage third-party access” mechanism to mark AppSheet as a trusted app, then it appears that it might cause login problems for users who were already signed into AppSheet before that. So the solution Rosie followed is to remove AppSheet from the list of trusted third-party apps. Each user can still sign in individually to AppSheet. This is still odd, because even in Rosie’s case before this “fix”, we found that certain users could sign in just fine from some machines, but not from others.

If you are not using this “trusted apps” mechanism, then I’m not sure this explains the cause of the problem.

I tried this
but I still have the same problem

Hi, you must contact appsheet support

Hi, I am having the same problem. I have tried to enter the AppSheet platform from my two different PCs and it showed the same error message: “Access denied by a security policy established by the Google Apps administrator of your organization. Please contact your administrator for further assistance.”

Then, I logged out from the PC we have at work and I couldn’t enter again.

I have just read your suggestions. I can’t believe that we have to wait 24 hours! However, I will folow those steps. If there is a better solution, please let us know.

Hi David, installing the app actually should have nothing to do with the authentication process. I know the code on our side and it just does not get to that path at all. It might just be that those users went thru the login on a different device or they were on a different network and therefore connected to a different Google server. The fact that you get unpredictable behavior for the same users keeps leading me back to this conclusion that the problem is some bug on a few of Google’s servers.

It doesn’t make any sense to me either, but we’ve done this with 3 iOS devices and my personal iMac and it works each time. Every staff person is assigned an ipad which they use exclusively to access our apps. Here’s a screen shot of the error page they were getting.


(To clarify, the app they’re reinstalling is one of our created apps, not the AppSheet platform app)

If you are seeing this problem, are you using the “trusted apps” feature of Google domain admin? If so, I would suggest not doing that. Leave that section blank, no need to make AppSheet a trusted app and definitely do not block access to other apps.

FYI, I just talked with Google support. They said they helped one of our customers and gave them the following workaround (I think … he’s going to send me the details):
*) tell the end user to go to https://account.google.com and revoke permissions for AppSheet
*) ask the end user to sign into AppSheet again
Apparently this worked for one customer they helped (one of you, I’m guessing). I don’t believe this is actually the solution, but happy if it is — so please try it and let me know if it work for you. And in general, I encourage you to contact GSuite support with this issue.

it did not work

From Google support …
"
This workaround has worked for all users so far who are presented with the error message “Access denied by a security policy established by the Google Apps administrator of your organization.” while trying to use AppSheet. These steps are done using a Google Chrome browser. These steps also assume AppSheet has domain wide availability to users and not installed on a individual basis.

  1. Open a Chrome browser window.

  2. Go to google.com.

  3. Log out of all Google accounts if multiple accounts are being used (Click on the Google account image icon located at the top right corner of the window and then click the “Sign out” button ).

  4. Sign into your G Suite account only ( Only one account is now signed ). Direct URL: https://accounts.google.com.

  5. Go to https://myaccount.google.com/security .

  6. Scroll down to “Third-party apps with account access”.

  7. Click “Manage third-party access”.

  8. Select AppSheet and remove access from the list.

  9. Go to www.appsheet.com and sign out and back in using your Google G Suite account as the credentials and give permission to AppSheet for the new API scopes being used and also replacing the revoked access token AppSheet is using due to step 8. ( Very important ).

  10. If you are signed out already to this site www.appsheet.com just sign in with this link: https://www.appsheet.com/Account/Login and “sign in with” Google for the same reasons as step 9.

  11. The errors should be gone because the access token Appsheet is using, is now currently authorized to access account data.

I hope this information helps you.
"

Good morning, Praveen, can you tell me if by doing this you can lose access to applications already created within the AppSheet platform?

Thanks a lot! this worked for me!

You are the man Praveen!


This worked very well.

If anyone is still seeing this problem, please let me know. Thanks

Hi Praveen, This is UmaShankar, eadmin of www.rglsi.org.in
We are facing the problem of access to the appsheet since yesterday.
Could you please guide us to a resolution
Regards,
Umashankar RV

Top Labels in this Space