How does GAS Authentication work within Google sites

user_14135239 0
Viewed 267

I have a very simple GAS project.

function doGet(e) {
  
  //User Database
  var username = Session.getActiveUser().getEmail(); //Authenticate using current User Email
  var page = HtmlService.createTemplateFromFile("menu");
  page.userName = username;
  return page.evaluate().setSandboxMode(HtmlService.SandboxMode.IFRAME).setXFrameOptionsMode(HtmlService.XFrameOptionsMode.ALLOWALL);;
  
}

This script is owned by x@y.com (GSuite Account on Business domain) It is published on a New Google Sites page, by embedding the published web app link. (/exec)

The Google Sites site is shared to n@z.com (different user on different GSuite Business domain) When you open the Google Sites page, in an incognito window in chrome, logged in as x@y.com, the script displays fine. If you open the Google Sites page, in a new incognito window in chrome, logged in as n@z.com, you can see the page as served by google sites, but the app itself is replaced by the "You Need Access" splash page from google. You Need Access Screenshot

If you open the published web app link while logged in as n@z.com, you get the "Review Permissions" splash page, and then the app works fine. Opening Google sites at this point, the app is still displaying "You Need Access"

What am I doing wrong here to enable authorised access to the app on the google site?

Publish Settings

google-sites-2016 google-workspace google-apps-script permissions web-applications
1 Answers

I believe there is a bug in the implementation of permissions in the STABLE version of the runtime. With the pictured permissions in the question, the app acts as though you need to share the script itself to the user in the other domain. This still does not enable access.

The solution is to enable V8 Runtime, republish the app and immediately the app works as expected.

user_141352390
Related