Google+ based auth deprecation and replacement

[Tratcher]

Google is starting to shut down Google+ Signin for applications as early as January 28th 2019. ASP.NET and ASP.NET Core have been using the Google+ Signin APIs to authenticate Google account users in web applications. The affected NuGet packages are Microsoft.AspNetCore.Authentication.Google for ASP.NET Core and Microsoft.Owin.Security.Google for Microsoft.Owin with ASP.NET Web Forms and MVC. Mitigations and solutions will vary depending on which package and which version of that package you use.

Note that the replacement APIs Google has provided use a different data source and format. The mitigations and solutions given below account for the structural changes but applications will need to verify the data itself still satisfies their requirements. E.g. names, e-mail addresses, profile links, profile photos, etc. may provide subtly different values than before.

Microsoft.Owin with ASP.NET Web Forms and MVC

For Microsoft.Owin 3.1.0 and later a temporary mitigation is outlined here. Applications should do immediate testing with the mitigation to check for changes in the data format. We'll plan to release Microsoft.Owin 4.0.1 with a fix for this as soon as possible. Applications using any prior version will need to update to 4.0.1.

ASP.NET Core 1.x

The mitigation given above for Microsoft.Owin can also be adapted for ASP.NET Core 1.x. As 1.x is nearing end of life and has low usage there are no plans to patch the NuGet packages for this issue.

ASP.NET Core 2.x

For Microsoft.AspNetCore.Authentication.Google 2.x the mitigation is to replace your existing call to AddGoogle in Startup with:

            .AddGoogle(o =>
            {
                o.ClientId = Configuration["Authentication:Google:ClientId"];
                o.ClientSecret = Configuration["Authentication:Google:ClientSecret"];
                o.UserInformationEndpoint = "https://www.googleapis.com/oauth2/v2/userinfo";
                o.ClaimActions.Clear();
                o.ClaimActions.MapJsonKey(ClaimTypes.NameIdentifier, "id");
                o.ClaimActions.MapJsonKey(ClaimTypes.Name, "name");
                o.ClaimActions.MapJsonKey(ClaimTypes.GivenName, "given_name");
                o.ClaimActions.MapJsonKey(ClaimTypes.Surname, "family_name");
                o.ClaimActions.MapJsonKey("urn:google:profile", "link");
                o.ClaimActions.MapJsonKey(ClaimTypes.Email, "email");
            });

Applications should do immediate testing with the mitigation to check for changes in the data format. Expect a fix for this to be included in the February 2.1 and 2.2 patches that incorperates the above reconfiguration as the new defaults. No patch is planned for 2.0 since it has reached end of life.

ASP.NET Core 3.0 Preview

The mitigation given for 2.x can also be used for the current 3.0 preview. In future 3.0 previews we're considering removing the Microsoft.AspNetCore.Authentication.Google package and directing users to Microsoft.AspNetCore.Authentication.OpenIdConnect instead. We'll follow up with the final plan. Here's how to replace AddGoogle with AddOpenIdConnect in Startup. This replacement can be used with ASP.NET Core 2.0 and later and can be adapted for 1.x as needed.

            .AddOpenIdConnect("Google", o =>
            {
                o.ClientId = Configuration["Authentication:Google:ClientId"];
                o.ClientSecret = Configuration["Authentication:Google:ClientSecret"];
                o.Authority = "https://accounts.google.com";
                o.ResponseType = OpenIdConnectResponseType.Code;
                o.CallbackPath = "/signin-google"; // Or register the default "/sigin-oidc"
                o.Scope.Add("email");
            });
            JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();

See dotnet/aspnetcore#6486 for discussion.

[This announcement has been migrated to: dotnet/docs#14843]

[Tratcher]

Update: Microsoft.Owin.Security.Google 4.0.1 has been published to nuget.org with this fix.

[Tratcher]

Update: Microsoft.AspNetCore.Authentication.Google 2.2.2 and 2.1.8 have been published to nuget.org with this fix.