Issue setting up GAM

[mowgli82]

Hi All,

 

I've setup GAM on multiple Google Tenancies but today I had one that just wouldn't go through.

 

It gets as far as authorising the scopes and it generates the link, I click through the sign in then it errors with

 

"Error 400: invalid request

[h=2]Request Details[/h]

• access_type=offline
  
• login_hint=admin@******.sch.uk
  
• response_type=code
  
• redirect_uri=urn:ietf:wg:oauth:2.0:oob
  
• state=lzZjuxm2ihJgGgJgRZp30R2LFidFGj
  
• code_challenge_method=S256
  
• hd=*******.sch.uk
  
• prompt=consent
  
• client_id=545738740653-b22m03noebm4aoh9no99che9vgn5613u
  
• code_challenge=HhHRjBC4r9sYeG_k-9pn9dtD7UNLlDUpie6KHpEozhI
  
• scope=https://www.googleapis.com/auth/admin.directory.user.security https://www.googleapis.com/auth/admin.directory.device.chromeos https://www.googleapis.com/auth/admin.directory.customer https://www.googleapis.com/auth/admin.reports.usage.readonly https://www.googleapis.com/auth/classroom.profile.photos https://www.googleapis.com/auth/admin.directory.user https://www.googleapis.com/auth/siteverification https://www.googleapis.com/auth/ediscovery https://www.googleapis.com/auth/admin.directory.rolemanagement https://www.googleapis.com/auth/classroom.courses https://www.googleapis.com/auth/classroom.profile.emails https://www.googleapis.com/auth/admin.directory.userschema https://www.googleapis.com/auth/admin.directory.resource.calendar https://www.googleapis.com/auth/cloud-identity.groups https://www.googleapis.com/auth/apps.licensing https://www.googleapis.com/auth/apps.groups.settings https://www.googleapis.com/auth/admin.chrome.printers https://www.googleapis.com/auth/admin.directory.group https://www.googleapis.com/auth/chrome.management.policy https://www.googleapis.com/auth/chrome.management.reports.readonly https://www.googleapis.com/auth/admin.datatransfer https://www.googleapis.com/auth/admin.directory.domain https://www.googleapis.com/auth/admin.directory.device.chromebrowsers https://www.googleapis.com/auth/admin.directory.device.mobile https://www.googleapis.com/auth/classroom.guardianlinks.students https://www.googleapis.com/auth/classroom.rosters https://www.googleapis.com/auth/admin.reports.audit.readonly https://www.googleapis.com/auth/admin.contact.delegation https://www.googleapis.com/auth/admin.directory.orgunit https://www.googleapis.com/auth/devstorage.read_only https://www.googleapis.com/auth/userinfo.email openid
  

 

Everything looks correct the API areas etc, has anyone else come across this?

 

I've done some Googling but not really found anything useful.

 

Any help would be appreciated.

 

Thanks

 

 

[gh5000]

Hi All,

 

I've setup GAM on multiple Google Tenancies but today I had one that just wouldn't go through.

 

It gets as far as authorising the scopes and it generates the link, I click through the sign in then it errors with

 

"Error 400: invalid request

[h=2]Request Details[/h]

• access_type=offline
  
• login_hint=admin@******.sch.uk
  
• response_type=code
  
• redirect_uri=urn:ietf:wg:oauth:2.0:oob
  
• state=lzZjuxm2ihJgGgJgRZp30R2LFidFGj
  
• code_challenge_method=S256
  
• hd=*******.sch.uk
  
• prompt=consent
  
• client_id=545738740653-b22m03noebm4aoh9no99che9vgn5613u
  
• code_challenge=HhHRjBC4r9sYeG_k-9pn9dtD7UNLlDUpie6KHpEozhI
  
• scope=https://www.googleapis.com/auth/admin.directory.user.security https://www.googleapis.com/auth/admin.directory.device.chromeos https://www.googleapis.com/auth/admin.directory.customer https://www.googleapis.com/auth/admin.reports.usage.readonly https://www.googleapis.com/auth/classroom.profile.photos https://www.googleapis.com/auth/admin.directory.user https://www.googleapis.com/auth/siteverification https://www.googleapis.com/auth/ediscovery https://www.googleapis.com/auth/admin.directory.rolemanagement https://www.googleapis.com/auth/classroom.courses https://www.googleapis.com/auth/classroom.profile.emails https://www.googleapis.com/auth/admin.directory.userschema https://www.googleapis.com/auth/admin.directory.resource.calendar https://www.googleapis.com/auth/cloud-identity.groups https://www.googleapis.com/auth/apps.licensing https://www.googleapis.com/auth/apps.groups.settings https://www.googleapis.com/auth/admin.chrome.printers https://www.googleapis.com/auth/admin.directory.group https://www.googleapis.com/auth/chrome.management.policy https://www.googleapis.com/auth/chrome.management.reports.readonly https://www.googleapis.com/auth/admin.datatransfer https://www.googleapis.com/auth/admin.directory.domain https://www.googleapis.com/auth/admin.directory.device.chromebrowsers https://www.googleapis.com/auth/admin.directory.device.mobile https://www.googleapis.com/auth/classroom.guardianlinks.students https://www.googleapis.com/auth/classroom.rosters https://www.googleapis.com/auth/admin.reports.audit.readonly https://www.googleapis.com/auth/admin.contact.delegation https://www.googleapis.com/auth/admin.directory.orgunit https://www.googleapis.com/auth/devstorage.read_only https://www.googleapis.com/auth/userinfo.email openid
  

 

Everything looks correct the API areas etc, has anyone else come across this?

 

I've done some Googling but not really found anything useful.

 

Any help would be appreciated.

 

Thanks

 

 

I had my tech installing Gam on a server yesterday and he was getting a 4xx error. Sure he said that he was doing it in powershell and when he moved to CMD prompt it went through but maybe something else was the issue more globally.

[gh5000]

Or try changing to an offline/no browser install

[mowgli82]

Hi,

 

Thanks for the replies, I normally do the install via the console.cloud (which wasn't working) I've just tried doing it via the msi installer and cmd prompt and still get the same error.

 

Management is going to be a paint with no GAM

 

Also noticed the in my orginal post it missed the actual error - Error 400: invalid_request Account restricted

Edited May 25, 2021 by mowgli82