Cannot login to Empathy after setting up Google online account

[Rob Whalley]

Description: Ubuntu 12.10
Release: 12.10

empathy:
  Installed: 3.6.0.3-0ubuntu1
  Candidate: 3.6.0.3-0ubuntu1
  Version table:
 *** 3.6.0.3-0ubuntu1 0
        500 http://gb.archive.ubuntu.com/ubuntu/ quantal/main amd64 Packages
        100 /var/lib/dpkg/status

Expected behaviour:

* New installation of 12.10 Ubuntu
* Expected to be able to use Google Talk in Empathy after adding a Google account under Online Accounts

Actual behaviour:

* Account can be added successfully, however Empathy displays "Google Talk Account requires authorisation"
* Clicking on the icon opens Online Accounts but does not offer an option to perform any further authorisation.

Investigation:

* Seahorse shows two entries for the Google account, one of which lists the correct password, the other of which lists a seemingly random collection of characters separated by percentage symbols
* Checked Google account, Ubuntu has permission to access: Picasa Web Albums, Profile Information, Google Docs, Google Talk
* Google account is not set up to use 2-step verification
* Removed account and seahorse entries, set up from scratch
* If possible, will use non-alphanumeric characters in passwords, so tested with only alphanumeric password - no difference
* Not going through a proxy

Activating empathy-debugger shows:

wocky/-DEBUG: 21/10/12 11:22:20.784214: _end_element_ns: Received stanza
* failure xmlns='urn:ietf:params:xml:ns:xmpp-sasl'
    * not-authorized
    * missing-username xmlns='google:auth'
wocky/-DEBUG: 21/10/12 11:22:20.784320: auth_failed: wocky-sasl-auth.c:274: Authentication failed!: Authentication failed: not-authorized
gabbleauthentication-DEBUG: 21/10/12 11:22:20.784421: gabble_server_sasl_channel_fail (server-sasl-channel.c:929): auth failed: WOCKY_AUTH_ERROR_FAILURE (#6): Authentication failed: not-authorized
gabbleconnection-DEBUG: 21/10/12 11:22:20.784534: connector_error_disconnect (connection.c:1760): Interactive authentication error, reason 3, dbus error org.freedesktop.Telepathy.Error.AuthenticationFailed

So, it seems that seahorse has the correct password in place, and the Google account is set up in such a way as to allow the application to work. That being the case, it makes no sense to be getting an authorisation error, unless there is something else that isn't immediately obvious.

Have checked for open bugs here:

* https://bugs.launchpad.net/ubuntu/+source/empathy/+bugs
* https://bugs.freedesktop.org/buglist.cgi?quicksearch=telepathy

However nothing that matched this exact problem jumped out - a lot of issues seem to be with 2-step verification (but as mentioned earlier this has not been enabled).

Asked for advice here:
* http://askubuntu.com/questions/204062/cannot-login-to-empathy-after-setting-up-google-online-account

Was advised to log a bug report.

ProblemType: Bug
DistroRelease: Ubuntu 12.10
Package: empathy 3.6.0.3-0ubuntu1
ProcVersionSignature: Ubuntu 3.5.0-17.28-generic 3.5.5
Uname: Linux 3.5.0-17-generic x86_64
NonfreeKernelModules: nvidia
ApportVersion: 2.6.1-0ubuntu3
Architecture: amd64
Date: Sun Oct 21 21:21:36 2012
InstallationMedia: Ubuntu 12.10 "Quantal Quetzal" - Release amd64 (20121017.5)
ProcEnviron:
 LANGUAGE=en_GB:en
 PATH=(custom, no user)
 XDG_RUNTIME_DIR=<set>
 LANG=en_GB.UTF-8
 SHELL=/bin/bash
SourcePackage: empathy
UpgradeStatus: No upgrade log present (probably fresh install)

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Baldur Norddahl (baldur-norddahl-gmail)]

I have the same problem. Mine is not a new installation but an upgrade from 12.04. Empathy had no trouble with Google Chat before the upgrade.

I am using two factor authentication on the Google account. I tried generating a new application key and entered as password but that did not fix the problem.

[Dan Mooray (dmooray)]

Same problem here after upgrade from 12.04, I am not using 2-factor authetication.

[Steven Roose (stevenroose)]

I had this problem too. Turned out to be because of the new Online Accounts feature.
But sometime like 2 weeks ago they released an update for Online Accounts (Google part) and it was fixed.

I'm on 12.10 and was on the 12.10 beta when the fix came.

[Bilal Shahid (s9iper1)]

every body having this bug need an update steven is right there is an update release for the online accounts few days ago.

[Bruno França (qrntt)]

I'm using the latest version of the gnome-online-accounts package, and i'm experiencing this issue.

$ apt-cache policy gnome-online-accounts
gnome-online-accounts:
  Installed: 3.6.0-0ubuntu1
  Candidate: 3.6.0-0ubuntu1
  Version table:
 *** 3.6.0-0ubuntu1 0
        500 http://br.archive.ubuntu.com/ubuntu/ quantal/main amd64 Packages
        100 /var/lib/dpkg/status

[Bilal Shahid (s9iper1)]

hmm yes thats the latest version
any way that you can attach the empathy debug log the log present above has not enough info ?

[humboink (humboink)]

same error here after upgrade from 12.04 to 12.10, with latest version of gnome-online-accounts

[humboink (humboink)]

killing all empathy & telepathy processes then lauching empathy-auth-client by hand gives this error at login :
(empathy-auth-client:3995): empathy-CRITICAL **: empathy_sasl_auth_google_async: assertion `!tp_str_empty (access_token)' failed

[Steven Roose (stevenroose)]

Empathy in Ubuntu doesn't use gnome-online-accounts but ubuntu-online-accounts. The gnome-online-accounts are not really used by anything anymore, and I thought they are no longer on the Settings screen.

[humboink (humboink)]

Ok I've got it. In my case, I was using a two-step auth account.
The password configured in empathy was an application-specific password, which method seems not supported with OAUTH2.
After removing the empathy account and recreating it, I've got the login/password that clearly specify to not enter the application-specific password but the account password, then the 2nd step password.
Then it worked.

[Steven Roose (stevenroose)]

So the solution seems to be to remove an old Google Account that was configured with a(n application-specific) password and add a new one with OAuth2 using your regular password (+ phone code) and allowing Ubuntu to access your account.

[Steven Roose (stevenroose)]

If some people confirm, this bug is solved. I have no idea how to set this bug to solved and how to mark a comment as a solution...

[Bruno França (qrntt)]

My Gtalk account was configured as a Jabber account on Empathy. I removed the Jabber account and created a Google account instead. Now everything works fine.

[Sera (seraphim6x7)]

Bruno's solution works for me. However this gives me a new problem. I only want to use Google Talk but creating a 'Google account' instead of Jabber automatically comes with access to Picase and Google docs.

[Steven Roose (stevenroose)]

You could report to the ubuntu online accounts project that it should be
possible to turn off certain integrations and/or choose specifically what
integration you want.

On Wed, Oct 24, 2012 at 4:16 PM, Sera <email address hidden> wrote:

> Bruno's solution works for me. However this gives me a new problem. I
> only want to use Google Talk but creating a 'Google account' instead of
> Jabber automatically comes with access to Picase and Google docs.
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1069531
>
> Title:
> Cannot login to Empathy after setting up Google online account
>
> Status in “empathy” package in Ubuntu:
> Incomplete
>
> Bug description:
> Description: Ubuntu 12.10
> Release: 12.10
>
> empathy:
> Installed: 3.6.0.3-0ubuntu1
> Candidate: 3.6.0.3-0ubuntu1
> Version table:
> *** 3.6.0.3-0ubuntu1 0
> 500 http://gb.archive.ubuntu.com/ubuntu/ quantal/main amd64
> Packages
> 100 /var/lib/dpkg/status
>
> Expected behaviour:
>
> * New installation of 12.10 Ubuntu
> * Expected to be able to use Google Talk in Empathy after adding a
> Google account under Online Accounts
>
> Actual behaviour:
>
> * Account can be added successfully, however Empathy displays "Google
> Talk Account requires authorisation"
> * Clicking on the icon opens Online Accounts but does not offer an
> option to perform any further authorisation.
>
> Investigation:
>
> * Seahorse shows two entries for the Google account, one of which lists
> the correct password, the other of which lists a seemingly random
> collection of characters separated by percentage symbols
> * Checked Google account, Ubuntu has permission to access: Picasa Web
> Albums, Profile Information, Google Docs, Google Talk
> * Google account is not set up to use 2-step verification
> * Removed account and seahorse entries, set up from scratch
> * If possible, will use non-alphanumeric characters in passwords, so
> tested with only alphanumeric password - no difference
> * Not going through a proxy
>
> Activating empathy-debugger shows:
>
> wocky/-DEBUG: 21/10/12 11:22:20.784214: _end_element_ns: Received stanza
> * failure xmlns='urn:ietf:params:xml:ns:xmpp-sasl'
> * not-authorized
> * missing-username xmlns='google:auth'
> wocky/-DEBUG: 21/10/12 11:22:20.784320: auth_failed:
> wocky-sasl-auth.c:274: Authentication failed!: Authentication failed:
> not-authorized
> gabbleauthentication-DEBUG: 21/10/12 11:22:20.784421:
> gabble_server_sasl_channel_fail (server-sasl-channel.c:929): auth failed:
> WOCKY_AUTH_ERROR_FAILURE (#6): Authentication failed: not-authorized
> gabbleconnection-DEBUG: 21/10/12 11:22:20.784534:
> connector_error_disconnect (connection.c:1760): Interactive authentication
> error, reason 3, dbus error
> org.freedesktop.Telepathy.Error.AuthenticationFailed
>
> So, it seems that seahorse has the correct password in place, and the
> Google account is set up in such a way as to allow the application to
> work. That being the case, it makes no sense to be getting an
> authorisation error, unless...

[Bilal Shahid (s9iper1)]

@borish
is that a full log we need the full log file make a text file and attach it
thanks

[Rob Whalley (mail-robwhalley)]

@Steven Roose - I'm not sure that the proposed fix is correct for the bug that was originally raised, after all I'm not using 2-step verification. Those who have fixed their problem using the proposed workaround are using 2-step verification from what I can tell?

[Steven Roose (stevenroose)]

I tried to state my solution for non 2-step verification users as well. I
think previously the Google Login stored a password and now works with
OAuth2 by giving Google access to your account and using an API Key.

On Wed, Oct 24, 2012 at 8:06 PM, Rob Whalley <email address hidden>wrote:

> @Steven Roose - I'm not sure that the proposed fix is correct for the
> bug that was originally raised, after all I'm not using 2-step
> verification. Those who have fixed their problem using the proposed
> workaround are using 2-step verification from what I can tell?
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1069531
>
> Title:
> Cannot login to Empathy after setting up Google online account
>
> Status in “empathy” package in Ubuntu:
> Incomplete
>
> Bug description:
> Description: Ubuntu 12.10
> Release: 12.10
>
> empathy:
> Installed: 3.6.0.3-0ubuntu1
> Candidate: 3.6.0.3-0ubuntu1
> Version table:
> *** 3.6.0.3-0ubuntu1 0
> 500 http://gb.archive.ubuntu.com/ubuntu/ quantal/main amd64
> Packages
> 100 /var/lib/dpkg/status
>
> Expected behaviour:
>
> * New installation of 12.10 Ubuntu
> * Expected to be able to use Google Talk in Empathy after adding a
> Google account under Online Accounts
>
> Actual behaviour:
>
> * Account can be added successfully, however Empathy displays "Google
> Talk Account requires authorisation"
> * Clicking on the icon opens Online Accounts but does not offer an
> option to perform any further authorisation.
>
> Investigation:
>
> * Seahorse shows two entries for the Google account, one of which lists
> the correct password, the other of which lists a seemingly random
> collection of characters separated by percentage symbols
> * Checked Google account, Ubuntu has permission to access: Picasa Web
> Albums, Profile Information, Google Docs, Google Talk
> * Google account is not set up to use 2-step verification
> * Removed account and seahorse entries, set up from scratch
> * If possible, will use non-alphanumeric characters in passwords, so
> tested with only alphanumeric password - no difference
> * Not going through a proxy
>
> Activating empathy-debugger shows:
>
> wocky/-DEBUG: 21/10/12 11:22:20.784214: _end_element_ns: Received stanza
> * failure xmlns='urn:ietf:params:xml:ns:xmpp-sasl'
> * not-authorized
> * missing-username xmlns='google:auth'
> wocky/-DEBUG: 21/10/12 11:22:20.784320: auth_failed:
> wocky-sasl-auth.c:274: Authentication failed!: Authentication failed:
> not-authorized
> gabbleauthentication-DEBUG: 21/10/12 11:22:20.784421:
> gabble_server_sasl_channel_fail (server-sasl-channel.c:929): auth failed:
> WOCKY_AUTH_ERROR_FAILURE (#6): Authentication failed: not-authorized
> gabbleconnection-DEBUG: 21/10/12 11:22:20.784534:
> connector_error_disconnect (connection.c:1760): Interactive authentication
> error, reason 3, dbus error
> org.freedesktop.Telepathy.Error.AuthenticationFailed
>
> So, it seems that seahorse has the correct password in place, and the
> Google account is set up in such a way as to allow the app...

[Rob Whalley (mail-robwhalley)]

Could be missing something but believe the solution was:
"So the solution seems to be to remove an old Google Account that was configured with a(n application-specific) password and add a new one with OAuth2 using your regular password (+ phone code) and allowing Ubuntu to access your account."

If so, doesn't that imply that a user would be forced to set-up 2-step verification if they were not using it already? What about users that don't have a phone to use with 2-step verification? From the instructions on Google, understand that you can generate an application specific password for Ubuntu and not require a phone, but what about other applications that involve a Google account; would you not require a phone for those?

Is this a correct assessment - if not, please could you expand upon the solution?

For info:
* Removed all accounts, checked seahorse and ensured any stored information was removed.
* Re-created the Google account only.
* Seahorse stores two entries, one containing the account password (right click > properties shows "signon-type: 1").
* The other entry appears to be urlencoded (right click > properties shows "signon-type: 3").
* Unable to see from seahorse source code where signon-type is returned from or what it suggests about the data stored (not a programming expert, did find the approximate place in seahorse-gkr-item-properties.xml where the graphical elements are defined, cannot see where the application gets the data though).
* Have attempted to urldecode the information stored, wasn't able to do this completely cleanly, and due to security concerns will not paste the whole string into this comment.
* However, basic layout of data stored appears to be:
Tokens<random_string>.apps.googleusercontent.com timestamp Py refresh_token Token <random_string>Expiry

A little research suggests this data may be being stored for use when creating an OAuth token, see also:
http://code.google.com/p/google-mail-oauth2-tools/wiki/OAuth2DotPyRunThrough

[Jesse van Herk (jesse-imaginaryrobots)]

I'm not using 2-factor auth, and the problem was resolved for me by following Bruno's suggestion, i.e. removing the old googletalk/jabber account item, and creating/using a new google account item instead (same username and password).

It seems like the bug is that previously-created google talk accounts just don't migrate successfully to the online accounts feature.

[Steven Roose (stevenroose)]

@Rob That solution I suggested doesn't at all implies you should have 2-factor auth. All 2-factor auth options were between brackets.
What I think happened is that before, online-accounts stored your raw password and now works by giving itself access via the default Google Auth API. So people with 2-factor auth give this permission another way that people without do.

Of course I'm not sure of this, that's just what is looks like if I see what people are experiencing.

[Rob Whalley (mail-robwhalley)]

@Steven - thanks, that makes sense... unfortunately no matter how many times the accounts are removed and re-added (and the stored credentials in seahorse deleted), this does not resolve the problem here. Have created a blank user account on the machine and reproduced the problem.

A different google account works - the account name is in the format "<email address hidden>".
The account that does not work is connected to a non-gmail address, in the format "<email address hidden>".

Wouldn't be surprised if that's where the problem lies...

[Rob Whalley (mail-robwhalley)]

Ok, mostly sorted now, it was the account.

Although chat from Google+ was possible when logged into the account in Firefox, the account associated with the non-gmail address started life as a youtube account, hence it had never been connected to a gmail account. This seems to be a requirement, see also:

http://support.google.com/talk/answer/141360?hl=en
http://superuser.com/questions/444262/using-google-talk-with-a-non-apps-non-gmail-google-account

So, added a gmail account, removed it and re-established the non-gmail account as the primary login.
Can now sign in to Empathy properly.

Tested by sending an invite to a second gmail account not already displayed in the G+ chat list of online users. This worked properly and could send message back and forth as expected.

However, as yet all of the existing G+ contacts are showing as offline (which they are not - the second gmail account has a contact that is visible to both accounts and can see that contact fine).

This could be a result of the account having been messed around with, won't know for sure for a while, as it's possible any changes may take a while to propogate, just a heads up if anyone else has the same problem.

[Rob Whalley (mail-robwhalley)]

http://support.google.com/a/bin/answer.py?hl=en&hlrm=en&answer=182084
"It can take up to 10 minutes for a new primary email address to be reflected throughout the system, 24 hours for domain and personal contact changes to take effect, and up to 3 days before the user can use Google Talk."

[Rob Whalley (mail-robwhalley)]

All seems fine now, marking as invlaid, as wasn't due to a bug but rather the account itself.

[Vadim Lopatyuk (qnub)]

Empathy just not working. Google account siccessfull connected, but empathy doesn't connect to gtalk… I use 2-step authentication.

[Paulo J. S. Silva (pjssilva)]

I have "the same bug". I do not use two factor authentication.

If I run empathy from the command line, I get the following message when the connection fails:

(empathy:12075): folks-WARNING **: Failed to reach quiescence normally (0 backends and 1 persona stores still haven't reached quiescence). Forcing IndividualAggregator quiescence due to reaching the timeout.

I have tried to use the same Google account to upload a photo to Picasa and it works, so online accounts seems to be working, the problem is probably with empathy.

[Hannes Romppainen (hannes-romppainen)]

Confirmed the bug and the workaround. Note that this also applies to Facebook IM account.

[kimj (emailadhoc)]

I have the same problem. I don't need/like to add a "google account", I only need to use it for empathy.
When adding it to ubuntu-online-accounts as a jabber account, in the format accountname -AT- gmail.com, empathy can't connect and asks for authentication, the following message is sent to stderr:

(empathy:8345): folks-WARNING **: Failed to reach quiescence normally (0 backends and 1 persona stores still haven't reached quiescence). Forcing IndividualAggregator quiescence due to reaching the timeout.

the account works if it's set up as a "google account", it works in pidgin and in empathy running in other distributions which use gnome online accounts.

[Maxim Kuznetsov (mackuzzz)]

The same problem.
12.10, clean install.
I have many accounts: Google, Jabber (livejournal.com), Facebook, Yahoo, ICQ, etc. And problem may appear with each one of them. For now I can't grant access to Livejournal though yesturday it worked fine. The day before yesturday the problem was with Facebook and Google: Empathy was losing connection with them. Today Livejournal wants authorisation and after pressing "Grant access", it wants it again and again.

[Maxim Kuznetsov (mackuzzz)]

Livelournal works now. After removing it from accounts list, cleaning all links on it in Seahorse, creating account again and changing properties to use the old SSL protocol. Yesturday it worked fine with normal SSL/TLS settings.

[Martin Vysny (vyzivus)]

Each time I boot up my computer, Empathy shows that Google account requires registration. However, the Online Accounts System Setting window does not show registration being required.
when I select the "Available" option from the drop down list a few times, Empathy eventually is able to connect to Google.

[Hendrik Schrieber (hennekn)]

Same problem with 2-step authorization in Ubuntu Precise.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Jedna Dvatři (spiro-multimax+launchpad)]

I'm affected by this problem. My account is not new, and I do not use two-factor authentication. The only workaround I've found is to reboot and hope it works next time, or remove and readd my account in Online Accounts (and repeat when the problem happens again two or three reboots later).

[Brian Pitts (bpitts)]

Is this related to bug #754569?

[Hendrik Schrieber (hennekn)]

No, it is not related. I just checked the upstream bug. This seems to be a different problem. It is working for me right now. Not sure why.

[Chow Loong Jin (hyperair)]

Interestingly, I just noticed that if I kill all signonpluginprocess instances, and then select "available" from Empathy's IM status dropdown, it logs in successfully.

[mucku (dereinsameberg)]

Chow Loong Jins solution worked for me. Killing signonpluginprocess did the trick.

[cserpell (cristian-v)]

I have the same bug, using Ubuntu 13.04. Killing signonpluginprocess fixes the issue temporarily. After a disconnection, it doesn't come back online. I have two accounts: Google (without 2-step verification), and a facebook account. Sometimes only one fails. Why is it so random? Removing the accounts and adding them again also works, but it is a pain.

This affects Ubuntu image.

Maybe it is a problem of signond package? Has someone debugged into why this happens?

Does it happen with any other program than empathy?

[cserpell (cristian-v)]

I noticed that when it fails to connect to an account, the following processes keep running until you kill them and then it works. It may help...

 PPID PID STAT COMMAND
...
    1 4389 Sl /usr/lib/empathy/empathy-auth-client
    1 4395 SLl /usr/bin/signond
 4395 4397 S \_ /usr/bin/signonpluginprocess oauth2
 4397 4399 S \_ sh -c /usr/lib/x86_64-linux-gnu/libproxy/0.4.7/pxgsettings org.gnome.system.proxy org.gnome.system.proxy.http org.gnome.system.proxy.https org.gnome.system.proxy.ftp org.gnome.system.proxy.socks
 4399 4400 Sl \_ /usr/lib/x86_64-linux-gnu/libproxy/0.4.7/pxgsettings org.gnome.system.proxy org.gnome.system.proxy.http org.gnome.system.proxy.https org.gnome.system.proxy.ftp org.gnome.system.proxy.socks
    1 4405 Sl /usr/bin/signon-ui
 4405 4411 S \_ sh -c /usr/lib/x86_64-linux-gnu/libproxy/0.4.7/pxgsettings org.gnome.system.proxy org.gnome.system.proxy.http org.gnome.system.proxy.https org.gnome.system.proxy.ftp org.gnome.system.proxy.socks
 4411 4412 Sl \_ /usr/lib/x86_64-linux-gnu/libproxy/0.4.7/pxgsettings org.gnome.system.proxy org.gnome.system.proxy.http org.gnome.system.proxy.https org.gnome.system.proxy.ftp org.gnome.system.proxy.socks

[cserpell (cristian-v)]

I also found this log line in syslog:

Sep 6 13:01:58 XXX signond[4040]: ../../../../src/signond/signondaemon.cpp 360 init Failed to SUID root. Secure storage will not be available.

[Jeff Van Epps (lordbah)]

Killing signonpluginprocess worked for me too. 13.10.

[Roberto Leibman (roberto-1)]

For what is worth.... this issue is still not fixed, and yes killing signonpluginprocess makes it all magically work. 14.04

[Harm van Bakel (hvbakel)]

If you're only using your Online Accounts for Empathy integration, try removing the following 4 packages: evolution-data-server, evolution-data-server-online-accounts, gnome-contacts, and libfolks-eds25. Removing these packages seems to have fixed my login issues without any further need for killing the signonpluginprocess. Note that without these packages you will loose some application integration options, leaving only "Empathy", "Shotwell", the "Photos search plugin" and the "Google Drive search plugin".

[atom32k (atomekk)]

14.10 kill signonpluginprocess fixes it ...