dialogflow messenger integration setup issues

[Joe_McFadden]

Hi,

Trying out the preview Agent app-type in Agent Builder, and want to integrate using dialogflow messenger to a simple firebase hosted website.

In agent console -> integrations -> manage dialogflow messenger
I only get the option to enable the authorised API, which will require users to authenticate using OAuth. That's okay for internal testing, but we eventually want to offer the chat serbice to end-users without requiring login. Is this not currently possible with the Agent app type?

I notice that when I set up the same integration with the Chat app type in Dialogflow CX (agent settings->integrations), it gives me the option for either authenticated or unauthenticated API acccess - but I don't get this option with the agent builder interface only the authenticated API.

A related question - the docs for the authenticated API setup (https://cloud.google.com/dialogflow/cx/docs/concept/integration/dialogflow-messenger) state you need to give end users the 'end-users the Dialogflow API Client role in IAM. However, in my testing this is not sufficient - I also need to give the viewer role for the Google Cloud project, otherwise the user account gets 'permission denied' when it sends a message to the chat agent. What are the minimum permissions actually needed?

[xavidop · Accepted solution]

Hi,

I am seeing the same. I think because it is too new? not sure. you can create an issue here: https://issuetracker.google.com/issues/new?component=956347

[xavidop · Accepted solution]

Hi,

I am seeing the same. I think because it is too new? not sure. you can create an issue here: https://issuetracker.google.com/issues/new?component=956347

[Joe_McFadden]

Hi @xavidop thank you for your response and sorry for slow reply (public holidays this week in UK). I have created an issue as you suggest, and will accept this as a solution and update if I get a response to my issue.

Btw, do you happen to know what the minimum IAM permissions for the authenticated API access are? As per my original post the docs say it just needs the Dialogflow API Client role, but I can't get it to work without giving the viewer role to the entire project as well.

[xavidop]

Have you tried all these steps?

 

[Joe_McFadden]

Yes, I've followed all those steps in the documentation including all the linked steps for the OAuth configuration. It only works if I give the test users the viewer role in IAM (they are in a group), but I tested it also assigning the role to a single principal. If I only give them the Dialogflow API client role as per the docs, they get a 'permission denied' response when they ask a question in the chat agent popup I've embedded on a webpage. 

[xavidop]

Understood, probably the docs are outdated. lets open another ticket about this issue

[wasantha]

"Hi, did you solve the issue? I also have the same problem. Please help me."

[Joe_McFadden]

Hi @wasantha - I still have an open support issue for this but I haven't found a solution yet I'm afraid. The support person Iwas actually having trouble reproducing the problem (i.e they did see option for the unauthorised API access). So it seems there is not a consistent experience which makes it harder to troubleshoot. I will update here if I do find an answer.

[jitvimol]

I have this issue as well and want to confirm that Joe_McFadden isn't the one who found this issue.   Only thing I think it Integration in Agent Console is in "preview" and it doesn't have option t choose "unauthorized".

Note that I tried generate  link using Dialogflow DX.  I can get unauthorized option but the bot doesn't behave the same way as when I test in Agent Console

[jitvimol]

I think I have a good lead.  Simply open Google Chat API doesn't work.  In google chat api configuration, it says "Google Chat API is only available to Google Workspace users"

[Chris_Grumbles · Accepted solution]

Looks like the documentation was update to include the Service Usage Consumer permissions set too. Not sure what documentation I was looking at, I think I followed the breadcrumbs from the Oauth Page to the DialogFlow integrations page... but I forget.