400 and 403 Error when running widget

[krischan314]

There is a 400 Error when running this widget. The pop up showed up when signing into my google account through this widget. Google Cloud Shell on the browser was used to run this widget.

When running the widget locally in my windows terminal, I was able to sign-in into my google account but nothing showed up. The 403 Error is shown in inspect element.

I have created and inputted the proper clientID into the public/config.json file and http://localhost:8080 is an Authorized JavaScript Origin

[bradycoye]

the 400 error you're getting is likely because you are running it in cloud shell which has a different javascript origin url. The “ http://localhost:8080 “ is the origin when running on your localmachine.

I'm encountering the same permissions issue however. {code: 403, message: "The caller does not have permission", status: "PERMISSION_DENIED"}

[sqrrrl]

Correct -- the origin is incorrect. It needs to be the origin as understood by the browser (proto://host:port in the browser url). Unfortunately using the web preview feature on Cloud Shell doesn't give you stable/predictable URLs you can register ahead of time, which makes running the quickstart on there a little more difficult.

[bradycoye]

It appears I may be having a permissions issue with Gsuite. I was routed to the cloud search API team by the support representative. my case number is #18126126

[ml9907]

We have the same issue, code: 403 message: "The caller does not have permission" status: "PERMISSION_DENIED" at this point: https://content-cloudsearch.googleapis.com/v1/query/suggest?alt=json Authentication was fine before this point as one can see:

Not too nice to see the wontfix label......

[sqrrrl]

@ml9907 is your account/domain and project correctly whitelisted for Cloud Search? Have you been able to make any other API calls or index content yet?

[ml9907]

We whitelisted our internal apache server name in Authorized javascript origin field. It must be good, since if it is not whitelisted it fails right before that point. We also moved to https and gave all possible API scopes related to cloud search in OAuth consent and we made the project internal also in OAuth consent page. We could not get anything up to now, nor query/search, nor query/suggest. Thanks for removing wontfix label :)

[dalbani]

I run into the same PERMISSION_DENIED issue. @sqrrrl: could you elaborate what you mean exactly with "account/domain and project correctly whitelisted for Cloud Search"? I enabled the API for the project and I created a OAuth client ID, but what do I need to do more?

[sqrrrl]

@dalbani IIRC enabling Cloud Search still requires some work on our side from sales/support to enable it for a domain. It's not like other G Suite or GCP APIs that are fully self-service. Enabling it the console isn't sufficient.

What happens when you go to cloudsearch.google.com with that user? Does it work or do you get an error?

[dalbani]

It works just fine when I search via https://cloudsearch.google.com, that's why I was surprised that the API wouldn't work. Is the signup page at https://cloud.google.com/products/search/apply/ supposed to be the way to ask to enable it? Or via another way?

[ml9907]

@sqrrrl what do you think, how we can go further? We are currently in the two weeks trial period for the larger Gsuite subscription but our decision depends what can we do with cloud search, how can we customize it to fit for our needs. As you see we are just in the beginning but we can not go further alone since we feel the problem is not at our side because the cloud search sample does not work the way we expected. This way at github is an official google support or we should escalate our case to other google support channel as well? For your question, yes at https://cloudsearch.google.com we can find our company documents and emails, everything looks like to be indexed and searchable from our domain.

[krsnaa]

@sqrrrl - facing the same issue. Also, approaching it from the GSuite angle, while access via https://cloudsearch.google.com works just fine querying stock GSuite data, trying to add a 3rd party source - https://admin.google.com/ac/apps/cloudsearch/datasources - does nothing and fails silently. There is no 'Third-party data sources' card in Apps > G Suite > Settings for Cloud Search page.

I realize now that this is due to the service not being provisioned on my GSuite/GCP account. What is the fastest way to request approval? Would upgrading to an enterprise GSuite account help? We are implementing a large scale proof of concept and any pointers to expedite would be greatly appreciated.

[sqrrrl]

I'm pretty sure the 403 issue isn't with the sample itself, but rather is a license issue. If it is a license issue, than you'd need to contact G Suite sales or support to work through that.

As a quick test, can you try making a query through the API Explorer?

https://developers.google.com/apis-explorer/#search/cloudsearch/cloudsearch/v1/cloudsearch.query.search?_h=1&resource=%257B%250A++%2522query%2522%253A+%2522test%2522%252C%250A++%2522requestOptions%2522%253A+%250A++%257B%250A++++%2522searchApplicationId%2522%253A+%2522searchapplications%252Fdefault%2522%250A++%257D%250A%257D&

[dalbani]

I personally get the same 403 error when I make the query through the API Explorer. The howto on https://developers.google.com/cloud-search/docs/guides/project-setup mentions using a service account, I suppose that won't make any difference??

I've contact the G Suite support via chat, but they couldn't provide me with a solution (outside the scope of their knowledge). Who am I supposed to contact and how?

[sqrrrl]

Service account is for indexing/identity mapping. Queries always use end-user oauth credentials.

I'll file a bug to improve the docs to make sure prerequisites are clearer in terms of licensing as well as provide some feedback about the friction around getting things set up. As for how to get help, I suggest contacting sales. Hopefully they can at least provide some guidance as to what you actually need on the licensing side of things. As mentioned before, it's not quite self-service like other APIs in terms of enablement, so start there.

Anyway, since neither the original issue nor the 403 appear to be bugs in the sample, I'm going to mark this as wontfix again but will keep it open a few more days.

[dalbani]

For the record, I got contacted by G Suite sales after I filled in the form available at https://cloud.google.com/products/search/apply/. But I've been told that the service is only available to "large / entreprise customers" at the moment, so it's not available to me as a single developer who simply wanted to try out the API. Too bad, I'll just have to wait I suppose.