What happened?
On January 29, 2019 Cirrus Identity received an automated message from “GoogleDevelopers-noreply@google.com” with a title of “[Action Required] Google+ APIs and OAuth requests are being shutdown on March 7, 2019” (see above).
Customers have received similar messages and asked if any action is needed. This posting outlines what Cirrus Identity has already done and our recommended action for customers.
What does this mean?
Because Google announced the end of their Google+ service last Fall, Cirrus Identity updated the Cirrus Gateway to no longer utilize the Google+ APIs for end user authentication. That change went into effect at the end of November 2019, and was transparent to our customers (see below for more detail).
What do I have to do?
Based on the information Cirrus Identity has at this time, we do not believe customers are required to take any action in response to this notice. There are some optional steps customers may choose to take depending on their operation environment.
If customers want to proactively remove Google+ from the API integration, the following two actions can be taken:
Action 1 -- Navigate to the “OAuth Consent Screen” tab of the currently defined API credential. Remove any extra scopes beyond the base of “email”, “profile”, and “openid”. In the example below, there is the typical case where there are both the base scopes, and the additional scopes provided by the Google+ API.
Action 2 - Navigate to the “Dashboard” of the “APIs & Services” in the Google console. Click on the “Google+ API” and in the next dialog, click “Disable API” in the upper menu ribbon.
Background
For background, Cirrus Identity contacted subscribing customers directly in October of 2018 when Google initially announced the Google+ shutdown. At that time we outlined a plan to move away from the Google+ APIs. Subsequent to that we were able to transparently move customers to Google’s industry standard OpenID Connect (OIDC) API. This work was completed at the end of November 2018.
The reason customers may have received the January 29 email from Google has to do with the history of Google’s social authentication APIs, and how Cirrus Identity implemented them prior to switching to OIDC. Customers performing Cirrus Gateway API integrations with Google prior to the fall of 2018 would have leveraged instructions that referenced the Google+ API which was the initial method used for social login by the Cirrus Gateway. With the move to Google’s standard OIDC API, that reference was removed. If customers performed the integration very recently, no notice may have been received.
If customers have questions or concerns about this notice from Google, please email “support@cirrusidentity.com”.
Thanks,
Mark
Mark Rank
Director, Product and Customer Success
Cirrus Identity
Phone: 414-331-1476
Email: mark.rank@cirrusidentity.com
Support: support@cirrusidentity.com