How to request offline access token from GoogleLoginProvider

Question

I need to be able to retrieve an access_token that is long lived and google does allow it. Looking at Azure Mobile
GoogleLoginProvider
line 95 needs another initializer type to request an offline token however it is hidden from the end user like me to be able to set it....
GoogleOAuth2AuthenticationOptions googleOptions = new GoogleOAuth2AuthenticationOptions
ClientId = settings.GoogleAppId,
ClientSecret = settings.GoogleSecret,
AuthenticationType = this.Name,
Provider = new GoogleLoginAuthenticationProvider()
So above I need to add AccessType = "offline" like I do below in my own class.
So I figured I extend MyGoogleLoginProvider : GoogleLoginProvider and override ConfigureMiddleware. After registering my own provider:
options.LoginProviders.Clear();
options.LoginProviders.Add(typeof(MyGoogleLoginProvider));
options.LoginProviders.Add(typeof(FacebookLoginProvider));
options.LoginProviders.Add(typeof(TwitterLoginProvider));
options.LoginProviders.Add(typeof(LinkedInLoginProvider));
However, I get 
<Error>
<Message>Authorization has been denied for this request.</Message>
</Error>
My full MyGoogleLoginProvider is
public class MyGoogleLoginProvider : GoogleLoginProvider
public MyGoogleLoginProvider(HttpConfiguration config, IServiceTokenHandler tokenHandler) : base(config, tokenHandler)
public override void ConfigureMiddleware(IAppBuilder appBuilder, ServiceSettingsDictionary settings)
if (appBuilder == null)
throw new ArgumentNullException("appBuilder");
if (settings == null)
throw new ArgumentNullException("settings");
var googleOptions = new GoogleOAuth2AuthenticationOptions
ClientId = settings.GoogleAppId,
ClientSecret = settings.GoogleSecret,
AccessType = "offline",
AuthenticationType = base.Name,
Provider = new GoogleLoginAuthenticationProvider()
if (!string.IsNullOrEmpty(settings.GoogleScope))
foreach (string scope in settings.GoogleScope.Split(' '))
googleOptions.Scope.Add(scope);
appBuilder.UseGoogleAuthentication(googleOptions);

Answer 1

So I've been able to reproduce the issue. Unfortunately, we cannot fix this by moving to Katana 3.0 at the moment due to some breaking API changes. However, I do have a workaround.
You need to use the Katana 2.1.0 packages that come with the Mobile Services Runtime. Then, use the following in place of MyGoogleLoginProvider:
public class MyGoogleLoginProvider : GoogleLoginProvider
public MyGoogleLoginProvider(HttpConfiguration config, IServiceTokenHandler tokenHandler)
: base(config, tokenHandler)
public override void ConfigureMiddleware(IAppBuilder appBuilder, ServiceSettingsDictionary settings)
if (appBuilder == null)
throw new ArgumentNullException("appBuilder");
if (settings == null)
throw new ArgumentNullException("settings");
var googleOptions = new GoogleOAuth2AuthenticationOptions
ClientId = settings.GoogleAppId,
ClientSecret = settings.GoogleSecret,
// AccessType = "offline",
AuthenticationType = base.Name,
Provider = new GoogleLoginAuthenticationProvider()
if (!string.IsNullOrEmpty(settings.GoogleScope))
foreach (string scope in settings.GoogleScope.Split(' '))
googleOptions.Scope.Add(scope);
appBuilder.Use(typeof(GoogleOfflineMiddleware), appBuilder, new OfflineOptions("googleoffline"));
appBuilder.UseGoogleAuthentication(googleOptions);
public class GoogleOfflineMiddleware : AuthenticationMiddleware<OfflineOptions>
public GoogleOfflineMiddleware(OwinMiddleware next, IAppBuilder app, OfflineOptions options)
: base(next, options)
protected override AuthenticationHandler<OfflineOptions> CreateHandler()
return new GoogleOfflineAuthenticationHandler();
public class OfflineOptions : AuthenticationOptions
public OfflineOptions(string authenticationtype) :base(authenticationtype)
AuthenticationMode = AuthenticationMode.Passive;
public class GoogleOfflineAuthenticationHandler : AuthenticationHandler<OfflineOptions> {
public override async Task<bool> InvokeAsync()
return false;
protected override async Task<AuthenticationTicket> AuthenticateCoreAsync()
return null;
protected override Task ApplyResponseChallengeAsync()
string redirectUri = Context.Response.Headers["Location"];
if (redirectUri != null && redirectUri.Contains("https://accounts.google.com")) {
redirectUri += "&access_type=offline";
Response.Redirect(redirectUri);
return Task.FromResult<object>(null);
The basic idea is that I'm setting another middleware which can look for redirects to the Google OAuth2 endpoint. When I see those, I add the offline request.
It's a bit of a hack, but it unblocks the scenario at least.