Auth process with Google fails

[mr-brunes]

I've tried this a few times but I just can't auth with Gmail to use this app.

I check the Google account tickbox ( I have several Google accounts) then click connect, it pops up with "Verifying that it's you…"

Then I try to complete 2FA sign-in "Complete sign in using your passkey", get prompted to enter my Microsoft Windows admin PIN and then that's it. Nada.

Shame really as I'd hoped it was going to solve my TB signature issue (just want my simple 3 line Gmail one that TB just can't display).

[mr-brunes]

There is a weird "" drop down box too next to one of my Gmail accounts, which expands to "Please select a Gmail alias (send as) " which makes no sense. No idea if this is relevant but it's confusing!
As is the "Last sync: null" message above.
Also it mentions something about a red annotation in case of any troubles. I'm red/greeen colour blind so I may be missing something - colours alone should not be used for alerts.

This process is dying out for a wizard!

[kam193]

Hey, thanks for the report! I'll try to take a look at it, I haven't been using the extension for a while, so maybe something has been changed in the auth answers from Gmail or API. I may eventually ask you to look into Thunderbird logs, where an error could be logged.

There is a weird "" drop down box too next to one of my Gmail accounts, which expands to "Please select a Gmail alias (send as) " which makes no sense.

Here is where you should see addresses you use in Gmail (you can have multiple signatures and/or addresses). It's quite weird it's empty, as if the auth worked, but couldn't get the right answer from Gmail.

Also it mentions something about a red annotation in case of any troubles. I'm red/greeen colour blind so I may be missing something - colours alone should not be used for alerts

I'm sorry this is misleading, but I'm sure you didn't miss anything - the error annotation should start with "Last error...", so it should be clear regardless of the colour!

[mr-brunes]

Appreciate Google changes stuff. I'm happy to provide whatever diags you need as the add-on sounds ideal, espec since TB just can't seem to provide a simple rich text sig editor!

When I first enable the add-on , the error console says:

Error: Can't find the actor ID for objects-manager from root or target actor's form. types.js:551:11
sendRemoveListener on closed conduit signature-sync@thunderbird.extensions.kam193.137438954809 ConduitsChild.sys.mjs:122:13
sendRemoveListener on closed conduit signature-sync@thunderbird.extensions.kam193.137438954923 ConduitsChild.sys.mjs:122:13
Cannot get send-as for undefined background.js:75:13
Cannot refresh access token background.js:76:13
Cannot get send-as for undefined background.js:75:13
Cannot refresh access token background.js:76:13
Cannot get send-as for undefined background.js:75:13
Cannot refresh access token background.js:76:13

[kam193]

I'll try to do my best! Could you look what the error console says during the auth to Gmail? Although I'm not 100% sure it will be in this console, there were a few possible places where it could be logged

[mr-brunes]

OK removed add-on, restarted TB and then reinstalled.
Add-on Settings shows all my email accounts (inc. non-Gmail domains)
I tick my main account and do nothing else:

Cannot get send-as for undefined background.js:75:13
Cannot refresh access token background.js:76:13

Then hit 'connect'

Pop-up shows with two Gmail accounts but not my main one. Select Add account:

Content-Security-Policy: The page’s settings blocked an inline script (script-src-elem) from being executed because it violates the following directive: “script-src 'nonce-e3TRhPQtpTtOuUtrrVUNrg' 'unsafe-inline' 'unsafe-eval'” index.js:6167:27
Content-Security-Policy: The page’s settings blocked an inline script (script-src-elem) from being executed because it violates the following directive: “script-src 'nonce-W02NhHQBKcg77Q7rGiK-zg' 'unsafe-inline'” index.js:6167:27
Content-Security-Policy: The page’s settings blocked an inline script (script-src-elem) from being executed because it violates the following directive: “script-src 'unsafe-eval'” index.js:6167:27

add my other account address, and get promtp for my local Windows PIN
​
Content-Security-Policy: The page’s settings blocked an inline script (script-src-elem) from being executed because it violates the following directive: “script-src 'nonce-aat-qALbq58PA8bElgPVWg' 'unsafe-inline'” index.js:6167:27

​Pop-up says:
Verifying that it's you…

Complete sign-in using your passkey

and it stops.

Uncaught (in promise)
Object { stack: "ua@https://accounts.google.com/v3/signin/challenge/pk?TL=ADgdZ7TzqeNMGIGqZodMMfbwn_2dm7qT--EhubJJdpSE2RaVhtLT2NvNdQSiPzs3&cid=1&continue=https://accounts.google.com/signin/oauth/legacy/consent?authuser%3Dunknown%26part%3DAJi8hAO1RaInDFsYsuioqNqsoA8LxhlxdxmBDiqQf8-by3NerQM_Luci-4A6P8ltGqo1H_h7yaOTPG83aIES8I7B4zwOAWNfLShXrbrFUAOaIysffUrvXQk--l449mjoGjw55bmmvBmgHGvP1RiFBBDasrwlJF7gzmBH9FbAw7BvyBxJ0Tmq4qZE68haf_guC2LeNNUQLFnQe6u4oHrXdFWheHozRKfTw1Fxf273ddlB9t95vk7O0iMn3ujvmp9oj7BtUCqOe8hJRnXe-IRC_exLmPmaCwSmTPiS3RS9CFUSoLi1rZYeFjcc_BeBXee-ATFNGwU7Z777CV1eHn7lV0pKhhlvoH2odo0RDQJwYkzE63zfCnhqJ2I8xprJaTeEPoyEvYQFPo55qXkeKMhzRBbLP0fLB70rc0qS3UtxxowezNgIqOplUM-GR7NaNBdXZG36AiZsIzxX5nYDPC1lSV5NJ53JD3hO0w%26flowName%3DGeneralOAuthFlow%26as%3DS1965768170%253A1739371126939730%26client_id%3D924192971684-d6jptvsivvmaq8o5au57od35hqjspj59.apps.googleusercontent.com%23&dsh=S-368549609:1739371218000705&flowEntry=AddSession&flowName=WebLiteSignIn&oauth=1:60:546\nva@https://accounts.google.com/v3/signin/challenge/pk?TL=ADgdZ7TzqeNMGIGqZodMMfbwn_2dm7qT--EhubJJdpSE2RaVhtLT2NvNdQSiPzs3&cid=1&continue=https://accounts.google.com/signin/oauth/legacy/consent?authuser%3Dunknown%26part%3DAJi8hAO1RaInDFsYsuioqNqsoA8LxhlxdxmBDiqQf8-by3NerQM_Luci-4A6P8ltGqo1H_h7yaOTPG83aIES8I7B4zwOAWNfLShXrbrFUAOaIysffUrvXQk--l449mjoGjw55bmmvBmgHGvP1RiFBBDasrwlJF7gzmBH9FbAw7BvyBxJ0Tmq4qZE68haf_guC2LeNNUQLFnQe6u4oHrXdFWheHozRKfTw1Fxf273ddlB9t95vk7O0iMn3ujvmp9oj7BtUCqOe8hJRnXe-IRC_exLmPmaCwSmTPiS3RS9CFUSoLi1rZYeFjcc_BeBXee-ATFNGwU7Z777CV1eHn7lV0pKhhlvoH2odo0RDQJwYkzE63zfCnhqJ2I8xprJaTeEPoyEvYQFPo55qXkeKMhzRBbLP0fLB70rc0qS3UtxxowezNgIqOplUM-GR7NaNBdXZG36AiZsIzxX5nYDPC1lSV5NJ53JD3hO0w%26flowName%3DGeneralOAuthFlow%26as%3DS1965768170%253A1739371126939730%26client_id%3D924192971684-d6jptvsivvmaq8o5au57od35hqjspj59.apps.googleusercontent.com%23&dsh=S-368549609:1739371218000705&flowEntry=AddSession&flowName=WebLiteSignIn&oauth=1:60:783\nv@https://accounts.google.com/v3/signin/challenge/pk?TL=ADgdZ7TzqeNMGIGqZodMMfbwn_2dm7qT--EhubJJdpSE2RaVhtLT2NvNdQSiPzs3&cid=1&continue=https://accounts.google.com/signin/oauth/legacy/consent?authuser%3Dunknown%26part%3DAJi8hAO1RaInDFsYsuioqNqsoA8LxhlxdxmBDiqQf8-by3NerQM_Luci-4A6P8ltGqo1H_h7yaOTPG83aIES8I7B4zwOAWNfLShXrbrFUAOaIysffUrvXQk--l449mjoGjw55bmmvBmgHGvP1RiFBBDasrwlJF7gzmBH9FbAw7BvyBxJ0Tmq4qZE68haf_guC2LeNNUQLFnQe6u4oHrXdFWheHozRKfTw1Fxf273ddlB9t95vk7O0iMn3ujvmp9oj7BtUCqOe8hJRnXe-IRC_exLmPmaCwSmTPiS3RS9CFUSoLi1rZYeFjcc_BeBXee-ATFNGwU7Z777CV1eHn7lV0pKhhlvoH2odo0RDQJwYkzE63zfCnhqJ2I8xprJaTeEPoyEvYQFPo55qXkeKMhzRBbLP0fLB70rc0qS3UtxxowezNgIqOplUM-GR7NaNBdXZG36AiZsIzxX5nYDPC1lSV5NJ53JD3hO0w%26flowName%3DGeneralOAuthFlow%26as%3DS1965768170%253A1739371126939730%26client_id%3D924192971684-d6jptvsivvmaq8o5au57od35hqjspj59.apps.googleusercontent.com%23&dsh=S-368549609:1739371218000705&flowEntry=AddSession&flowName=WebLiteSignIn&oauth=1:60:945\nx@https://accounts.google.com/v3/signin/challenge/pk?TL=ADgdZ7TzqeNMGIGqZodMMfbwn_2dm7qT--EhubJJdpSE2RaVhtLT2NvNdQSiPzs3&cid=1&continue=https://accounts.google.com/signin/oauth/legacy/consent?authuser%3Dunknown%26part%3DAJi8hAO1RaInDFsYsuioqNqsoA8LxhlxdxmBDiqQf8-by3NerQM_Luci-4A6P8ltGqo1H_h7yaOTPG83aIES8I7B4zwOAWNfLShXrbrFUAOaIysffUrvXQk--l449mjoGjw55bmmvBmgHGvP1RiFBBDasrwlJF7gzmBH9FbAw7BvyBxJ0Tmq4qZE68haf_guC2LeNNUQLFnQe6u4oHrXdFWheHozRKfTw1Fxf273ddlB9t95vk7O0iMn3ujvmp9oj7BtUCqOe8hJRnXe-IRC_exLmPmaCwSmTPiS3RS9CFUSoLi1rZYeFjcc_BeBXee-ATFNGwU7Z777CV1eHn7lV0pKhhlvoH2odo0RDQJwYkzE63zfCnhqJ2I8xprJaTeEPoyEvYQFPo55qXkeKMhzRBbLP0fLB70rc0qS3UtxxowezNgIqOplUM-GR7NaNBdXZG36AiZsIzxX5nYDPC1lSV5NJ53JD3hO0w%26flowName%3DGeneralOAuthFlow%26as%3DS1965768170%253A1739371126939730%26client_id%3D924192971684-d6jptvsivvmaq8o5au57od35hqjspj59.apps.googleusercontent.com%23&dsh=S-368549609:1739371218000705&flowEntry=AddSession&flowName=WebLiteSignIn&oauth=1:61:26\nAd/<@https://accounts.google.com/v3/signin/challenge/pk?TL=ADgdZ7TzqeNMGIGqZodMMfbwn_2dm7qT--EhubJJdpSE2RaVhtLT2NvNdQSiPzs3&cid=1&continue=https://accounts.google.com/signin/oauth/legacy/consent?authuser%3Dunknown%26part%3DAJi8hAO1RaInDFsYsuioqNqsoA8LxhlxdxmBDiqQf8-by3NerQM_Luci-4A6P8ltGqo1H_h7yaOTPG83aIES8I7B4zwOAWNfLShXrbrFUAOaIysffUrvXQk--l449mjoGjw55bmmvBmgHGvP1RiFBBDasrwlJF7gzmBH9FbAw7BvyBxJ0Tmq4qZE68haf_guC2LeNNUQLFnQe6u4oHrXdFWheHozRKfTw1Fxf273ddlB9t95vk7O0iMn3ujvmp9oj7BtUCqOe8hJRnXe-IRC_exLmPmaCwSmTPiS3RS9CFUSoLi1rZYeFjcc_BeBXee-ATFNGwU7Z777CV1eHn7lV0pKhhlvoH2odo0RDQJwYkzE63zfCnhqJ2I8xprJaTeEPoyEvYQFPo55qXkeKMhzRBbLP0fLB70rc0qS3UtxxowezNgIqOplUM-GR7NaNBdXZG36AiZsIzxX5nYDPC1lSV5NJ53JD3hO0w%26flowName%3DGeneralOAuthFlow%26as%3DS1965768170%253A1739371126939730%26client_id%3D924192971684-d6jptvsivvmaq8o5au57od35hqjspj59.apps.googleusercontent.com%23&dsh=S-368549609:1739371218000705&flowEntry=AddSession&flowName=WebLiteSignIn&oauth=1:117:1187\nZ.prototype.C/<@https://accounts.google.com/v3/signin/challenge/pk?TL=ADgdZ7TzqeNMGIGqZodMMfbwn_2dm7qT--EhubJJdpSE2RaVhtLT2NvNdQSiPzs3&cid=1&continue=https://accounts.google.com/signin/oauth/legacy/consent?authuser%3Dunknown%26part%3DAJi8hAO1RaInDFsYsuioqNqsoA8LxhlxdxmBDiqQf8-by3NerQM_Luci-4A6P8ltGqo1H_h7yaOTPG83aIES8I7B4zwOAWNfLShXrbrFUAOaIysffUrvXQk--l449mjoGjw55bmmvBmgHGvP1RiFBBDasrwlJF7gzmBH9FbAw7BvyBxJ0Tmq4qZE68haf_guC2LeNNUQLFnQe6u4oHrXdFWheHozRKfTw1Fxf273ddlB9t95vk7O0iMn3ujvmp9oj7BtUCqOe8hJRnXe-IRC_exLmPmaCwSmTPiS3RS9CFUSoLi1rZYeFjcc_BeBXee-ATFNGwU7Z777CV1eHn7lV0pKhhlvoH2odo0RDQJwYkzE63zfCnhqJ2I8xprJaTeEPoyEvYQFPo55qXkeKMhzRBbLP0fLB70rc0qS3UtxxowezNgIqOplUM-GR7NaNBdXZG36AiZsIzxX5nYDPC1lSV5NJ53JD3hO0w%26flowName%3DGeneralOAuthFlow%26as%3DS1965768170%253A1739371126939730%26client_id%3D924192971684-d6jptvsivvmaq8o5au57od35hqjspj59.apps.googleusercontent.com%23&dsh=S-368549609:1739371218000705&flowEntry=AddSession&flowName=WebLiteSignIn&oauth=1:109:439\n", message: "Assertion failed" }

​
I opt for "try another way":

Content-Security-Policy: The page’s settings blocked an inline script (script-src-elem) from being executed because it violates the following directive: “script-src 'nonce-1esuoSLqgOhiatGcRRnbjA' 'unsafe-inline'” index.js:6167:27

Select 'Enter my password'

Content-Security-Policy: The page’s settings blocked an inline script (script-src-elem) from being executed because it violates the following directive: “script-src 'nonce-O0lLAB9h20q_xxJ5EaK0VQ' 'unsafe-inline'” index.js:6167:27
Content-Security-Policy: The page’s settings blocked an inline script (script-src-elem) from being executed because it violates the following directive: “script-src 'unsafe-eval'” index.js:6167:27

​ener password

Content-Security-Policy: The page’s settings blocked an inline script (script-src-elem) from being executed because it violates the following directive: “script-src 'nonce-TImUUlniT3BAYsTgfh_0sA' 'unsafe-inline'” index.js:6167:27

I get prompted for 2FA:
I confirm login on another device:

Content-Security-Policy: The page’s settings blocked an inline script (script-src-elem) from being executed because it violates the following directive: “script-src 'nonce-TImUUlniT3BAYsTgfh_0sA' 'unsafe-inline'” index.js:6167:27
Content-Security-Policy: The page’s settings blocked an inline script (script-src-elem) from being executed because it violates the following directive: “script-src 'nonce-O4rE_lC5qoqMOEIdwQEDIg' 'unsafe-inline'” index.js:6167:27
Content-Security-Policy: The page’s settings blocked an inline script (script-src-elem) from being executed because it violates the following directive: “script-src 'nonce-7TDSseJcvJAXpD86V2wubA' 'unsafe-inline'” index.js:6167:27
Content-Security-Policy: The page’s settings blocked an inline script (script-src-elem) from being executed because it violates the following directive: “script-src 'nonce-7veaP3qdgbSBRQ4isTNmrg' 'unsafe-inline' 'unsafe-eval'” index.js:6167:27

​Allow Google permissions.
Pop-up disappears and goes back to add-on page which looks no different i.e. indicates Last sync: null and 'connect' button.

I try the 'Sync Now' button and it now says 'Last sync 2025-02-12' !
(it could do with adding a timestamp)
But the button still says 'connect'.

I compose a new email but the sig is the same as configured in TB:

At some point the below appeared but not sure when:
Unchecked lastError value: Error: URL constructor: //fonts.googleapis.com/css?family=Google+Sans is not a valid URL. 4 index.js:4210

I try 'connect' again, this time my main account is listed so I select it and grant the add-on permission.

Content-Security-Policy: The page’s settings blocked an inline script (script-src-elem) from being executed because it violates the following directive: “script-src 'nonce--CVozv33SejlUaUzMPLbjg' 'unsafe-inline' 'unsafe-eval'” index.js:6167:27
Content-Security-Policy: The page’s settings blocked an inline script (script-src-elem) from being executed because it violates the following directive: “script-src 'nonce-9WOkB23c96lWLtzQQz0fmA' 'unsafe-inline' 'unsafe-eval'” index.js:6167:27

Compose email - no different.
​
Then I use the 'Please select a Gmail address (Send As)' drop-down box and now my acccount is listed so I select it.
Compose - no diff.
Sync Now -page flickers.
Compose - success! It's picked up my Gmail sig!

Phew.
I've no idea what made the difference but it wasn't at all obvious for a newbie. It'd be good to have a bit more 'process' e.g. a wizard or numbered config steps and some more diag info.
Looks forward to using this now! Hope the above helps.

​

​

​

[kam193]

Thanks for the very detailed walk-through! From what you have found out in logs, it looks like the issue is with the support for Passkeys / Windows Hello in Thunderbird. This part is entirely out of my hand, I use here the built-in functions :/ However, it seems like I don't handle such issues good enough. If you e.g. break the auth process, the add-on shows an error. In your case was nothing from my side.

Pop-up shows with two Gmail accounts but not my main one.

This surprises me a lot. Do you recognize those accounts? This list comes not from me, it should be based on your previous logins.

I've no idea what made the difference but it wasn't at all obvious for a newbie. It'd be good to have a bit more 'process' e.g. a wizard or numbered config steps and some more diag info.

Thanks for that feedback, I'll try to do something! This is very important feedback as for me, it was clear - but it's always so when you created it!

[mr-brunes]

The pop-up's list of accounts were my other Gmail accounts (that are also configured on TB). No idea why my main one wasn't listed at first. And yes I recall the format from other (non-TB) occasions, maybe I'd got logged out of my main one.

Tx for being responsive and receptive to suggestions, espec with a beta.
I'm so glad the add-on finally works as it solves a TB headache for me! :-)

[kam193]

Great it finally worked, I'm glad it could help you! I've created the extension because I had a problem, and though I don't use Gmail at the moment, I'm happy it can help others.

I've started preparing an instruction and small changes in the settings menu based on your feedback, I'll publish it when I find a while.

The sad news is that soon using the addon may be additionally complicated - the deadline for annual security attestation required by Google for public application accessing some APIs is due in March. Sadly, there is a change since last year and it's no longer possible to do it for free - and I won't pay ~$500 for that. If I understand correctly the terms, the extension should still work up to some number of users, but Google may add warnings during the auth. As alternative, one can register own OAuth application and use it instead of the default one, but it's another complication :/

[mr-brunes]

Understand the ongoing potential limitations with these types of integrations. Happy to give OAuth app. reg. a go if necessary.
Happy for this issue to be closed for now if that helps.

[kam193]

I'd keep it open until I finish a tutorial :)