Login with Mobileclient to G-Apps Account with 2FA and app-password not working

[kettenbach-it]

Hi,

for a while now, my application is not able to login to gmusic using my g-apps username and a generated app-password. The login to gmail using the account password ist working.

I tested with some python code:

from gmusicapi import Mobileclient
api = Mobileclient(debug_logging=True)
print api.login('[email protected]', 'APP-PASSWORD', Mobileclient.FROM_MAC_ADDRESS)
print api.login('[email protected]', 'ACCOUNT-PASSWORD',Mobileclient.FROM_MAC_ADDRESS)

Output:

root@sbs:~# python test_gmusic.py
/root/.cache/gmusicapi/log/gmusicapi.log
/usr/local/lib/python2.7/dist-packages/Cryptodome/Math/_Numbers_gmp.py:230: UserWarning: implicit cast to 'char *' from a different pointer type: will be forbidden in the future (check that the types are as you expect; use an explicit ffi.cast() if they are correct) _gmp.gmp_snprintf(buf, c_size_t(buf_len), b("%Zd"), self._mpz_p)
False
True

I tested the app-password with some other app (calender): it works!

The logfile says:

2017-02-10 13:43:57,993 - gmusicapi.Mobileclient1 (shared:74) [INFO]: initialized
2017-02-10 13:43:57,993 - gmusicapi.Mobileclient1 (shared:98) [INFO]: logged out
2017-02-10 13:43:58,848 - gmusicapi.Mobileclient1 (mobileclient:113) [INFO]: failed to authenticate
2017-02-10 13:43:59,605 - gmusicapi.Mobileclient1 (mobileclient:117) [INFO]: authenticated

Is there something wrong with gmusicapi and app-passwords?

[simon-weber]

Hm, I'm not aware of any issues affecting app passwords.

I noticed that your example uses two different email addresses. Is that intentional?

[kettenbach-it]

The example is actually two examples:
one uses gmail (@gmail.com), the other one uses the Google-Apps Account with the app password.

Besides the warning, the example outputs "False" for G-Apps and "True" for gmail.
So, basically gmusicapi works.
And I verified with another app (calender), that the app-password works.

So why gmusic does not?

You say, that you're not aware. Have you verfied it?

[kettenbach-it]

Okay, I did a little debugging:

gpsoauth.perform_oauth

returns

{u'Error': u'DeviceManagementRequiredOrSyncDisabled'}

The reason for this is, that for this google-apps account, the enforcement of policies on mobil clients is enabled in admin console (enforce_android_policy).
If I disable this in admin-console, the authentication works.

[simon-weber]

Ah, interesting. I'll make a ticket to surface those kinds of errors better.

[orjanv]

enforce_android_policy

The setting is available here: https://admin.google.com/AdminHome?hl=no#MobileSettings:section=advanced&flyout=security (took me a while to find it..)

[drinkspiller]

Er...any idea where this setting lives in the Google Admin console nowadays? I can't find it.

[tjstum]

Hi @drinkspiller,

Google shut down Google Play Music at the end of 2020. This project interfaced with that product, and therefore is no longer really relevant.
This probably isn't the best place to get support for GApps administration.

Best of luck!