Help Needed: Google SSO Integration Error in Production

[JCasimiro]

Hello Google Cloud Community,

I’m seeking advice on a pressing issue we've encountered with our Google Single Sign-On (SSO) integration in production. After functioning seamlessly for several years, the process started failing a few months ago, presenting a "400 Bad Request" error specifically during user sign-in attempts.

Key Points
- The error occurs when users not currently logged into Google attempt to sign in through our SSO, resulting in a "400 Bad Request" message indicating the request is malformed. This problem does not arise for users who are already logged in (on Google).
- Crucially, this malfunction is exclusive to our production environment. In testing and other environments where a different clientID is used, the SSO integration operates flawlessly.

Error Message:

400. That’s an error.
The server cannot process the request because it is malformed. It should not be retried. That’s all we know.

Technical Context:
- The issue surfaces when users are prompted to choose their Google account for SSO.
- Our setup includes an appropriately encoded redirect URI and the SSO request involves openid, profile, and email scopes.
- Notably, our project’s clientID is utilized across two platforms: our main website for SSO and a Google Docs add-in requiring a wider range of scopes.

We recently identified that a crucial scope (https://www.googleapis.com/auth/documents) required by our Google Docs add-in was absent from our OAuth consent screen configuration. Despite the add-in’s continued performance for users (including new ones), and the application being marked as "VERIFIED" on the OAuth Consent Screen, we proceeded to add this missing scope and are currently awaiting Google’s verification. 

Given the integration’s historical reliability and the recent onset of this issue, could the missing scope and the user cap limit be contributing factors to the malfunctioning SSO process for non-logged-in users?

If anyone has insights into the "malformed request" error or suggestions for troubleshooting, your expertise would be invaluable to us.

Thank you in advance for your time and support.

[RonEtch]

Hi @JCasimiro 

Welcome to Google Cloud Community!

Error 400 is somehow hard to troubleshoot since it's a combination of different errors resulting to generic client error. Most common reason of this error is incorrect URL links as per this article.

Additionally, you can check this article that may help you to troubleshoot your issue

I hope this information is helpful.

If you need further assistance, you can always file a ticket on our support team.

[svenosa]

Hi,

We are seeing the exact same thing, actually from two different applications of ours that offers SSO with Google. It works fine if the Google user is already logged in, but if not, it fails, typically with 400 bad request. 

This was working fine for a long time, then suddently it stopped worked without us doing any change to the configuration. I have tried to delete the old SAML2 app in Google Admin and create a new one, but the exact same thing happens. 

It seems to happen on the HTTP-POST binding to https://accounts.google.com/o/saml2/idp?idpid= .  As far as I can tell there is a 302 redirect set up from this to https://accounts.google.com/o/saml2/continue?idpid which fails with 400 bad request. I have also sometimes seen 404 errors, but usually it is the 400 error.

[jordan25766]

Have you tried replacing the certificate X.509 Certificate: via the admin console under the SAML SSO profile?

[Prateek_Khurana]

Exactly same issue is faced by us and we haven't changed anything on our end
I am pretty confident that something has changed on Google's end
Any help in this regard will be appreciated.