Google blocked this access

[Redirts]

Describe the bug
When doing the google sign-in the first time I get in the browser "This app is blocked
This app tried to access sensitive info in your Google Account. To keep your account safe, Google blocked this access."

To Reproduce
Steps to reproduce the behavior:

1. Install plugin
2. In Options I selected "Use KeePass Google Sync 3.0 App Credentials
3. Go to Tools->KPSync For Google drive->Pick any option to upload/download/Sync
4. Browser opens and I select my Google account
5. See error

Expected behavior
No error

Screenshots

Please provide the following information:

• Windows 11
• Chrome
• 4.1.0
• 2.56
• Portable

Additional context
Add any other context about the problem here.

[lduczmal]

I have same issue

Please provide the following information:
Windows 10
Firefox 128
plugin version: 4.1.0
keepass version: 2.57 (not portable)

[NiteBr33d]

I have same issue.

Please provide the following information:

Windows 11
Brave
4.1.0
2.57
Portable

I have been using this addon for years and never seen this. Is there any fixes for this?

[liteCarma]

I found a solution

[tipitao]

Hello, I have tried to follow the steps but the screen to select the credentials does not appear....

Greetings

[liteCarma]

Hello, I have tried to follow the steps but the screen to select the credentials does not appear....

Hi. Unfortunately, I don't know how to help. I have done this on several of my computers, it works for me.

[tipitao]

Ok thanks El dom., 18 ago. 2024 12:29, Denis ***@***.***> escribió:

…

Hello, I have tried to follow the steps but the screen to select the credentials does not appear.... Hi. Unfortunately, I don't know how to help. — Reply to this email directly, view it on GitHub <#79 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AI2FXADNS4Y5JM33HQQORDDZSBZQBAVCNFSM6AAAAABEG7YVSGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDEOJVGIYTCMJWHE> . You are receiving this because you commented.Message ID: ***@***.***>

[Redirts]

Interestingly, I came back here to see if this is solved and I only had to enable "Use limited drive access" and now it is working for me. I don't see any constraints on having activated this option

[tipitao]

Interestingly, I came back here to see if this is solved and I only had to enable "Use limited drive access" and now it is working for me. I don't see any constraints on having activated this option

---

Hello, can you give some details of what you are talking about? For example, if you have selected something in the plugin settings, an option in the Google account... or something else.

Regards

[Redirts]

Interestingly, I came back here to see if this is solved and I only had to enable "Use limited drive access" and now it is working for me. I don't see any constraints on having activated this option

Hello, can you give some details of what you are talking about? For example, if you have selected something in the plugin settings, an option in the Google account... or something else.

Regards

I am the original creator of this issue. At the time, without the "use limited drive access" option selected I was getting the error indicated in the issue. I then saw @liteCarma's reply and as soon as I just enabled the "use limited drive access" option without doing any of the other steps, the sync started working!

[alexeylef]

I can confirm that simply checking "Enable Legacy OAuth 2.0 Credentials" and "Use limited Drive access" were sufficient to solve the issue.

[liteCarma]

Interestingly, I came back here to see if this is solved and I only had to enable "Use limited drive access" and now it is working for me. I don't see any constraints on having activated this option

Haha, I guess I made life difficult for myself.

[Antherase]

I can confirm that simply checking "Enable Legacy OAuth 2.0 Credentials" and "Use limited Drive access" were sufficient to solve the issue.

This work for me

[jecourtney]

If, after making the changes to "Enable Legacy.." and "Use limited.." you continue to get:

Client is not authorized for this flow.
Error 401: unauthorized_client
Request details: flowName=GeneralOAuthFlow

Then, delete the Keepass account KPSync was using and have it re-create on next sync then the above fix will work.

[Walop]

Unfortunately none of those instructions work. Enabling legacy and use limited gets me to a page where I select my account and then warns about giving the app access, but when I click Continue it fails with unknown error.

I don't get arror for unauthorized client and deleting the entry KPSync was using and letting it recreate it doesn't make any difference.

EDIT: Never mind, for some reason it worked with Edge, but not with Firefox.

[stefan-STMODE]

I can confirm that simply checking "Enable Legacy OAuth 2.0 Credentials" and "Use limited Drive access" were sufficient to solve the issue.

works for me, not in chrome, but in edge it works

[giacomociani]

I run into this error only recently (after years of happy and successful usage of this plugin).
I confirm that simply enabling "Use legacy Oauth 2", "use app credentials" and "use limited drive access" solved it immediatly.

[amyren1966]

I can confirm also, enabling "Use legacy Oauth 2", "use app credentials" and "use limited drive access" solved it.
It still failed in Chrome, but with Edge it worked

[Amenel]

Another confirmation here. My browser is Vivaldi though.
Thanks to all.

[Deleca7755]

I can confirm that simply checking "Enable Legacy OAuth 2.0 Credentials" and "Use limited Drive access" were sufficient to solve the issue.

Can also confirm this works

[Kadeluxe]

I had this problem and apparently stupid Google blocks this on Firefox? I can't sign in on Firefox because it says "This app is blocked" but I can do that on Edge.
"This app" means the browser? wtf

[desmaraisp]

I can confirm also, enabling "Use legacy Oauth 2", "use app credentials" and "use limited drive access" solved it. It still failed in Chrome, but with Edge it worked

Warning, this will break cross-app sync, you will no longer be able to sync with Keepass2Android, as this will cause your files on gDrive to get duplicated and no longer merge together, defeating the whole point of the plugin

[antmjones]

@desmaraisp, thanks for pointing this out - I'd been using this workaround and hadn't realised it was causing duplicate copies of the database, but now I check I can see that it is. Has anyone found a workaround that doesn't have the problem?!

[jecourtney]

It is true, you need to point your Android app at the new database created after enabling the workround. I use KPass (version 2.4.0) for Android and it works great. KPass: password manager by Korovan

[giacomociani]

Well, I don't know what's different for me. I also did not even check if the synch was still working after enabling the workaround. However, I checked after I read @desmaraisp post, and none of this happened to me. No other copies of the database were created, and the original copy keeps synching correctly. I use Kpass instead of Keepass2Android, but I don't know if that matters.

[desmaraisp]

Well, I don't know what's different for me. I also did not even check if the synch was still working after enabling the workaround. However, I checked after I read @desmaraisp post, and none of this happened to me. No other copies of the database were created, and the original copy keeps synching correctly. I use Kpass instead of Keepass2Android, but I don't know if that matters.

I actually looked into it, and it seems like there's a couple of factors. If you use the workaround, any new authentication requests to Google will be sent with the File.Drive scope, which causes a couple of things.

• Any files created by keepass will keep working as before
• Any files created by other applications will be invisible to keepass. When sending an upload to google drive, since another file already exists and Keepass doesn't have access to it, Google renames it transparently to something else, which causes the copy
• Other applications should still have access to files created by keepass, but they might have a similar issue if they use the same scope. I believe Keepass2Android uses the Drive scope, but goes through the atrocious and expensive Google review every year to not get the app blocked page

[Kadeluxe]

So what's an alternative? What to use?

[desmaraisp]

From where I stand, you've got three options

• Jump through some hoops to save your gdrive file in the right order (save from the extension to get the extension to have the correct permissions using limited scope, then, using the mobile app, select the newly-created file). In theory, that should work, but it's a pretty subpar solution, and it'll probably break if you reauthenticate for any reason. I also have not tested it, so I can't garantee it works
• Use another sync extension to sync to dropbox or something like that
• Wait a week while I work on a fork/PR to bring GDrive File Scope implementation with file picker #51 back to life, which should allow the extension to work as intended.

[stdesmar]

That would really be great.

I too am using Windows keepass with kp sync, as well as keepass2android, and both have lost full access to Google Drive recently. When I program both to use limited drive access, they don't access the same file anymore on google drive, they each have their own. It is really a pain.

It started a few weeks ago for me.

I am also using Strongbox on my iPhone, and that application is still able to see the file created KP Sync and they can sync correctly to each other.

I'll try to contact the developper of keepass2android to see if it can also be fixed on their side.

[Kadeluxe]

I switched to Dropbox + KeeAnywhere for now. I hate how Google approaches this. Keepass2Android works with Dropbox no problem too.

[stdesmar]

Yeah, but Dropbox free version is limited to 3 peripherals. I have more than that. I could try either Microsoft OneDrive. But I would really prefer using Google Drive.

[lions85]

Hello everybody,
I had the same issue at the beginning with keepass google sync plugin and I managed to solve exactly as it was shown above creating the credentials. Now i do not have this error anymore but a new one regarding the browser:

The meaning is that I am using an unsafe browser and they do not allow the access. Does anybody got the same problem and solved?
Thanks
regards

[desmaraisp]

I've created a fork over here to implement the required functionalities to avoid both "Google blocked this access" and the file duplication issues. With this new plugin version, you can, if you need to share a file across multiple devices, grant explicit access to the plugin so that it can update an existing file instead of creating a duplicate.

I've also made PR #86, though I'm not quite sure how quickly we can expect it to be looked at, if at all. In the meantime, you can simply use the compiled artifact from my fork over here

I suggest backing up your databases (both local and in gDrive) before you use it, since you might have accumulated a big delta between both. The syncing process should normally handle this without any issues (and that was the case for my database, by the way), but you never know. Always a good idea to back things up

[demod-au]

Thanks! Working. I had a little "too and fro" as I didn't remove the old sync plugin. Once removed it all settled down and is working and updating across devices. Thanks for spending time fixing this! Much appreciated.

[b-strauss]

I've created a fork over here to implement the required functionalities to avoid both "Google blocked this access" and the file duplication issues. With this new plugin version, you can, if you need to share a file across multiple devices, grant explicit access to the plugin so that it can update an existing file instead of creating a duplicate.

I've also made PR #86, though I'm not quite sure how quickly we can expect it to be looked at, if at all. In the meantime, you can simply use the compiled artifact from my fork over here

I suggest backing up your databases (both local and in gDrive) before you use it, since you might have accumulated a big delta between both. The syncing process should normally handle this without any issues (and that was the case for my database, by the way), but you never know. Always a good idea to back things up

How do I install this? @desmaraisp

[desmaraisp]

How do I install this? @desmaraisp

1. Navigate to the release.
2. Download the "KPSyncForDrive-5.0.0.zip"
3. Create a directory in your plugins directory (generally C:\Program Files\KeePass Password Safe 2\Plugins). Normally, this is where the google-drive-sync plugin should already be located.
4. Delete the google-drive-sync plugin from the plugin directory if it already exists
5. Extract the contents of the zip to that directory.

And your installation is done!

Optionally, only for security-conscious people, you can check the build attestation using the gh cli: gh attestation verify './KPSyncForDrive-5.0.0.zip' -R "desmaraisp/google-drive-sync". But that's entirely optional.