# Documentation confusion setting up Google OAuth2 in AMI tutor-v15.0.0

**URL:** <https://discuss.openedx.org/t/documentation-confusion-setting-up-google-oauth2-in-ami-tutor-v15-0-0/9666>\
**Category:** Tutor Help\
**Created:** [March 24, 2023, 2:33pm UTC](https://discuss.openedx.org/t/documentation-confusion-setting-up-google-oauth2-in-ami-tutor-v15-0-0/9666 "2023-03-24T14:33:45Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Richard\_Cooke](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/richard_cooke/32/5074_2.png) [@Richard\_Cooke](https://discuss.openedx.org/u/Richard_Cooke)\
**Post date:** [March 24, 2023, 2:33pm UTC](https://discuss.openedx.org/t/documentation-confusion-setting-up-google-oauth2-in-ami-tutor-v15-0-0/9666/1 "2023-03-24T14:33:45Z")

</div>

I spawned an instance of this AMI:  
aws-marketplace/tutor-v15.0.0-dc91f585-6f99-4dff-930d-db0b139892a8

To test out OpenEDX as a corporate training system for our staff. Really love how fast and easy it was to get it up and running.

But.

We use Google Workspace, so I want to enable Oauth2 for our staff, so they dont need to create “yet another” user ID for the training system.

I found what I thought were the correct [instructions](https://edx.readthedocs.io/projects/edx-installing-configuring-and-running/en/latest/configuration/tpa/tpa_integrate_open/tpa_oauth.html).

The first part, to setup OAuth2 credentials in our Workspace account went well. But when it says to edit the file **`lms.yml`** I ran into a problem: where is this file?

Elsewhere I learned to use this command to locate the config folder: `tutor config printroot`  
Which gave me: `/home/tutor/.local/share/tutor`

I found what (by contents) looks like the file, but with a different name:  
` ~/.local/share/tutor/env/apps/openedx/config/lms.env.yml`

The next step is to **ENABLE** ENABLE\_THIRD\_PARTY\_AUTH. But it is already enabled.

The next step is to edit the `THIRD_PARTY_AUTH_BACKENDS` list, if present. It is not, but the other variables mentioned are not present either.

The next step would be to add the Google secret. I stopped and aborted at this point to come here and verify I am doing this right.

It makes me profoundly nervous when what I see differs too much from what the guide predicted.

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![Richard\_Cooke](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/richard_cooke/32/5074_2.png) [@Richard\_Cooke](https://discuss.openedx.org/u/Richard_Cooke)\
**Post date:** [March 25, 2023, 4:25pm UTC](https://discuss.openedx.org/t/documentation-confusion-setting-up-google-oauth2-in-ami-tutor-v15-0-0/9666/2 "2023-03-25T16:25:35Z")

</div>

OK. I made an AMI image backup of my machine so I can try and hack this out safely.

Ignoring the instructions that appear to be done already, I skipped to:

_**[Add the Provider Configuration](https://edx.readthedocs.io/projects/edx-installing-configuring-and-running/en/latest/configuration/tpa/tpa_integrate_open/tpa_oauth.html#add-the-provider-configuration)**_

Which has me create a DB entry with my Google OAuth2 info from the first section.

This made the “Login with Google” button appear! But when I try to use it, I get an error:

**Error 401: invalid\_client**

So now I ask here, and seek everywhere, what I can learn about this error.

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![zameel7](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/zameel7/32/7981_2.png) [@zameel7](https://discuss.openedx.org/u/zameel7)\
**Post date:** [March 26, 2023, 7:26am UTC](https://discuss.openedx.org/t/documentation-confusion-setting-up-google-oauth2-in-ami-tutor-v15-0-0/9666/3 "2023-03-26T07:26:48Z")

</div>

Hey! Hope I can help you here.

You can find and add new plugins at `tutor plugins printroot`. You can also see all the enabled plugins by using the command `tutor plugins list`.

Since `ENABLE_THIRD_PARTY_AUTH` is already enabled, you don’t have to do anything on that. The next thing you are asked to do in the documentation which you have mentioned is to add the Google OAuth Client secret into the lms.env.yml file. Once you add that, all you have to do is, _**[Add the Provider Configuration](https://edx.readthedocs.io/projects/edx-installing-configuring-and-running/en/latest/configuration/tpa/tpa_integrate_open/tpa_oauth.html#add-the-provider-configuration)**_ as you mentioned above.  
`Please note that the client_id you provide at **LMS URI/admin/third_party_auth/oauth2providerconfig/** should be the one that matches the client_secret you have provided in the lms.env.yml file.`

## To create a plugin, do the following:

- Go to tutor plugins directory using `cd $(tutor plugins printroot)`
- If it doesn’t exist, create a folder named `tutor-plugins` in the same place where your tutor folder is.
- Then create a yml file as a plugin `(Eg: nano oauthconfig.yml)`
- Paste the code below into the file by substituting the client\_secret
- Enable the plugin, save your config file and relaunch your openedx
  - tutor plugins enable oauthconfig
  - tutor config save
  - tutor local launch

```auto
name: oauthconfig
version: 0.0.1
patches:
    SOCIAL_AUTH_OAUTH_SECRETS: {"google-oauth2": "your client secret here"}

```

---

<div class="post-metadata">

**Author:** ![Richard\_Cooke](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/richard_cooke/32/5074_2.png) [@Richard\_Cooke](https://discuss.openedx.org/u/Richard_Cooke)\
**Post date:** [March 30, 2023, 6:43pm UTC](https://discuss.openedx.org/t/documentation-confusion-setting-up-google-oauth2-in-ami-tutor-v15-0-0/9666/4 "2023-03-30T18:43:55Z")

</div>

Thanks! Good to know I was heading down the right rabbit hole.

I saw older docs talking about making a plugin shell for the secret. The docs I’m following - which I think are for the latest version (15) are different.

The section " _ **Add the Provider Configuration** _" had me put that same info into a db. They also mention you can put the secret here as well, instead of the yml file. Which I did because at that time I was not certain I had found the right ylm file. I see in your post you refer to it by the name I found, so I assume I did find the right one.

I’m starting to wonder if I have a problem with my domain. My test is for a client on domain A, but I am using my company DNS (domain B) - not the same root domain as my client. I am suspicious Google is balking at that.  
So I plan to redo the DNS on the clients domain, see if it likes that.

Unless you can tell me I still have a configuration problem?

---

<div class="post-metadata">

**Author:** ![zameel7](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/zameel7/32/7981_2.png) [@zameel7](https://discuss.openedx.org/u/zameel7)\
**Post date:** [March 31, 2023, 1:43am UTC](https://discuss.openedx.org/t/documentation-confusion-setting-up-google-oauth2-in-ami-tutor-v15-0-0/9666/5 "2023-03-31T01:43:13Z")

</div>

What is the issue that you are facing currently?

---

<div class="post-metadata">

**Author:** ![Richard\_Cooke](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/richard_cooke/32/5074_2.png) [@Richard\_Cooke](https://discuss.openedx.org/u/Richard_Cooke)\
**Post date:** [March 31, 2023, 1:15pm UTC](https://discuss.openedx.org/t/documentation-confusion-setting-up-google-oauth2-in-ami-tutor-v15-0-0/9666/6 "2023-03-31T13:15:43Z")

</div>

Thank you for your continued assistance, I appreciate it.

The Error I get trying to login is:

- **Error 401: invalid\_client**

I have screen clips of the button and the resulting error box. I shall try to attach them here for reference.

Nope. New users cannot upload files. Is there an Admin around?

---

<div class="post-metadata">

**Author:** ![Binh\_Ho\_Thai](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/binh_ho_thai/32/7823_2.png) [@Binh\_Ho\_Thai](https://discuss.openedx.org/u/Binh_Ho_Thai)\
**Post date:** [January 1, 2025, 4:35pm UTC](https://discuss.openedx.org/t/documentation-confusion-setting-up-google-oauth2-in-ami-tutor-v15-0-0/9666/7 "2025-01-01T16:35:42Z")

</div>

> [@zameel7](#):
>
> tutor plugins enable oauthconfig

Hi @zameel7 , thank you so much,  
I tried your instruction to the step tutor plugins enable oauthconfig, I got this error Error: Invalid patch ‘SOCIAL\_AUTH\_OAUTH\_SECRETS’ in plugin oauthconfig. Expected str, got \<class ‘dict’\>.  
Could you please help.

Thank you very much

---

<div class="post-metadata">

**Author:** ![zameel7](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/zameel7/32/7981_2.png) [@zameel7](https://discuss.openedx.org/u/zameel7)\
**Post date:** [January 2, 2025, 2:32am UTC](https://discuss.openedx.org/t/documentation-confusion-setting-up-google-oauth2-in-ami-tutor-v15-0-0/9666/8 "2025-01-02T02:32:18Z")

</div>

Instead of creating the plugin, you can directly enter your secret inside the Django admin page for OAuth setup. You may try that. The only thing that you will have to enable using a plugin would be the ENABLE\_THIRD\_PARTY\_AUTH variable.

---

<div class="post-metadata">

**Author:** ![Binh\_Ho\_Thai](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/binh_ho_thai/32/7823_2.png) [@Binh\_Ho\_Thai](https://discuss.openedx.org/u/Binh_Ho_Thai)\
**Post date:** [January 2, 2025, 4:29am UTC](https://discuss.openedx.org/t/documentation-confusion-setting-up-google-oauth2-in-ami-tutor-v15-0-0/9666/9 "2025-01-02T04:29:29Z")

</div>

Hi @zameel7  
Thank you so much for your quick response. I will try this.