Google oauth2 with devise and omniauth processed as failure
<p>I'm trying to configure a new rails4.2 app to authenticate against Google Oauth2.</p>

<p>I seem to be successfully going through the process, but it's being treated as a failure.</p>

<p>The initial authorisations seems to go well until google sends to the callback. Then it seems to be incorrectly identified as a failure.</p>

<p>The error message given is:
<code>Could not authenticate you from Google because "Invalid credentials".</code></p>

<p>I've googled for a solution, but to no avail.</p>

<p>Is it possible to turn on additional logging to understand why it's choosing to process via the failure method?</p>

<p>Here's the log of a request:</p>

<pre><code>Started GET "/users/auth/google" for 127.0.0.1 at 2016-04-17 09:37:33 +0800
Started GET "/users/auth/google/callback?state=&lt;&lt;state&gt;&gt;&amp;code=&lt;&lt;code&gt;&gt;" for 127.0.0.1 at 2016-04-17 09:37:45 +0800
Processing by Users::OmniauthCallbacksController#failure as HTML
  Parameters: {"state"=&gt;"&lt;&lt;state&gt;&gt;", "code"=&gt;"&lt;&lt;code&gt;&gt;"}
Redirected to http://test_app.dev/sign_in
Completed 302 Found in 1ms (ActiveRecord: 0.0ms)
</code></pre>

<p>When testing, I clicked allow when google prompted me, and the url looks good, so why is this being processed as if it were a failure?</p>

<p><strong>config/initializer/devise.rb</strong></p>

<pre><code>  config.omniauth :google_oauth2, ENV['GOOGLE_CLIENT_ID'], ['GOOGLE_CLIENT_SECRET'],
         :strategy_class =&gt; OmniAuth::Strategies::GoogleOauth2,
         :name =&gt; 'google',
         :scope =&gt; 'email,profile,contacts',
         :access_type =&gt; 'offline',
         :image_aspect_ratio =&gt; 'square'
</code></pre>

<p><strong>routes.rb</strong></p>

<pre><code>  devise_for :users, :controllers =&gt; { omniauth_callbacks: 'users/omniauth_callbacks' }
  resources :users

  devise_scope :user do
    get 'sign_in', :to =&gt; 'devise/sessions#new', :as =&gt; :new_user_session
    get 'sign_out', :to =&gt; 'devise/sessions#destroy', :as =&gt; :destroy_user_session
  end
</code></pre>

<p><strong>controllers/users/omniauth_callbacks_controller.rb</strong></p>

<pre><code>class Users::OmniauthCallbacksController &lt; Devise::OmniauthCallbacksController
  def google
      logger.debug 'Omniauth callback called' # Never get's called
  end
end
</code></pre>

<p><strong>application_controller.rb</strong></p>

<pre><code>class ApplicationController &lt; ActionController::Base
  # Prevent CSRF attacks by raising an exception.
  # For APIs, you may want to use :null_session instead.
  protect_from_forgery with: :exception

  # Direct to user profile after sign in
  def after_sign_in_path_for(resource)
    user_path(current_user)
  end

  # Needed by Devise when using omniauth
  def new_session_path(scope)
    new_user_session_path
  end
end
</code></pre>

<p>My gems:</p>

<pre><code>Using warden 1.2.6
Using devise 3.5.6
Using oauth2 1.0.0
Using omniauth 1.2.2
Using omniauth-oauth2 1.4.0
Using omniauth-google-oauth2 0.4.1
</code></pre>