Hey Gang, since updating to v4.89.1, we've had a lot of failed calendar automations for users with multiple chrome profiles. Has anyone else seen this?

Same team as Dylan, we're also seeing this same issue with some users that have a single Chrome profile (domain matching our org) all have the same error:

create event on user calendar: create event on user calendar: retrieving Google calendar timezone: Get "<https://www.googleapis.com/calendar/v3/users/me/settings/timezone?alt=json&prettyPrint=false>": oauth2: cannot fetch token: 400 Bad Request
Response: {
  "error": "invalid_grant",
  "error_description": "Not a valid email or user ID."
}

Hi both, thank you for bringing this to our attention. Have either of you enabled the Google Workspace IdP integration that was released in 4.89.0 in settings/integrations/identity-provider?

@Dylan Diamond and I both work at the same org, so we can answer for each other. No this is not currently enabled.

That does not need to be enabled for the calendar integration. For those users, does their email show up correctly in the Fleet UI?

It does

Am I correct in assuming that the integration is working for some users, but not others?

yes it is working for most users. I would say this issue is affecting about 25% of our users (we dont have a lot of users)

Is there anything special about those users? For example, do they have a + or another special character in their email? Or is it just that they have multiple chrome profiles?

nope these are standard firstname@website.com emails. some of them have multiple chrome profiles that result in multiple emails being listed in the fleet details page, but some of them only have one email that shows up in that page and they get the error (though most of the folks getting that error have an additional non work chrome profile added)

Multiple profiles can definitely complicate things. Are you using Fleet free?

nope we're on fleet premium. And to clarify that this was working before we upgraded to 4.89.1 from 4.88, it didn't seem to care about the extra profiles before

Interesting. Let me see if I can hunt down any changes. Meanwhile, if you set the IdP user name using the Add user option on the host details page, Fleet should default to using that. Can you test for one of the users in question to see if that'll do as a workaround?

We're still seeing calendar automation failures after testing setting the IdP username, with the same error msg:

400 Bad Request
Response: {
  "error": "invalid_grant",
  "error_description": "Not a valid email or user ID."
}

Let me check in with engineering to see what we can come up with!

I've opened a GH issue for this bug: github.com/fleetdm/fleet/issues/49838

Thank you!