Latest macOS update breaking Google G-suite accounts

[DrMacintosh]

Apple recently updated macOS Mojave to 10.14.4 with these release notes:

Spoiler

The macOS Mojave 10.14.4 update adds support for Apple News+, includes bug fixes and improvements, improves the stability and reliability of your Mac, and is recommended for all users. 

Apple News+ 
- Apple News+ is a new subscription service that extends to the Apple News experience with hundreds of magazines and top newspapers 
- Our editors handpick top articles and magazine issues, and you also get personalized recommendations on the topics most interesting to you 
- Automatic downloads make it easy to read magazine issues offline 
- Apple News is now available in Canada, with a free experience that includes handpicked Top Stories, a personalized Today feed, and support for both English and French 
- Apple News+ is available in the U.S. and Canada, with dozens of additional Canadian Magazines. 

Safari 
- Adds Dark Mode support for websites that support custom color schemes 
- Streamlines website login when filling credentials with Password Autofill 
- Allows push notification prompts only after interacting with a website 
- Adds a warning when an insecure webpage is loaded 
- Removes support for the expired Do Not Track standard to prevent potential use as a fingerprinting variable; Intelligent Tracking Prevention now protects against cross-site tracking by default 

iTunes 
- Shows more editorial highlights on a single page in the Browse tab, making it easier to find new music, playlists, and more in Apple Music 

AirPods 

- Adds support for new AirPods (2nd Generation) 

More 
- Supports Air Quality index in Maps for US, UK, and India 
- Improves the quality of audio recordings in Messages 
- Supports real-time text (RTT for phone calls made through a nearby iPhone on Mac 
- Provides enhanced support for external GPUs in Activity Monitor 
- Fixes an App Store issue that may have prevented adoption of the latest versions of Pages, Keynote, Numbers, iMovie, and GarageBand 
- Improves the reliability of USB audio devices when used with the MacBook Air, MacBook Pro and Mac mini models introduced in 2018 
- Corrects the default screen brightness for MacBook Air (Fall 2018) 
- Fixes a graphics compatibility issue that may occur on some external displays connected to a Mac mini (2018) 
- Resolves Wi-Fi connection issues that may occur after upgrading to macOS Mojave 
- Fixes an issue where re-adding an Exchange account may cause it to disappear from Internet Accounts 
- Fixes an issue where AOL passwords may be frequently requested in Mail

The most notable "fix" in regards to this post is the "Fixes an issue where AOL passwords may be recently requested in Mail". 

 

This "fix" appears to not have had any QA testing and seems to have caused issues with G-suite Google accounts. Users that are affected are reporting being prompted to enter their passwords in Safari to authenticate their accounts. Upon doing so the authentication process immediately fails and the user is prompted to enter their information again in an endless loop.

above: Example of an account that was removed and added back. Already existing accounts will replace "(null)" with the account email. 

 

The Apple Support Communities have a thread with over 1400 people reporting a similar issue:

https://discussions.apple.com/thread/250259379?page=1

 

So far a workaround exists but requires tinkering and was posted by Gannet on the MacRumors Forums:

Quote

 

Okay, so I've tried to make this as easy as possible. We're going to use Charles to rewrite a response from google to include the email address which is for some reason missing in google's own response. This is a one time setup only needed for verification.

1. Download, install and run Charles.
2. If this is your first time using Charles it should prompt you to authorize automatic proxy configuration. Do this. (Otherwise just make sure the macOS proxy is enabled and working)
3. From the Help menu choose SSL Proxying > Install Charles Root Certificate.
4. Once the certificate is installed, find it in your keychain (type Charles into the search), open it, expand the Trust section and set to Always Trust. You will be prompted for your password when closing it.
5. Back in Charles, from the Proxy menu choose SSL Proxying Settings.
6. Add a new location with Host: people.googleapis.com.
7. From the Tools menu choose Rewrite and click the Add button.
8. Add a new location with Host: people.googleapis.com.
9. Add a new action with the following details...
   • Type: Body
   • Where: Response
   • Replace Value: {"names":[{"metadata":{"primary":true},"displayName":"Your Name"}],"emailAddresses":[{"value":"your@email"}]}
   • (Make sure you put in your name and email address)
10. Once you save this, we're all set. Go to your system Internet Accounts or (Mail) and authorize your account.
11. If everything thing is working, you can quit Charles and feel free to delete the certificate from Keychain.

 

 

 

As of right now Apple Engineers have been made aware of the issue and it could take anywhere up to 4 days before an official patch is released. Preliminary analysis shows that this may be an issue with how Keychain is handling certificates since this workaround adds a certificate to fix the issue. It could also be an issue on Googles end, nobody knows for sure. Someone who claims to be "Apple" (who also called me a "shit") seems to believe its not Apples problem. I was about to quote him so he could get reprimanded but he deleted his comments. 

 

 

Another possible fix involves removing references to your account in Keychain

Affected users can still log into their accounts via a web browser, but macOS G-suite integration is broken atm. If your Google accounts are important, do not update your Mac to 10.14.4

 

Sources: 

https://discussions.apple.com/thread/250259379?page=2

https://forums.macrumors.com/threads/mac-mail-app-broken-for-some-gmail-users-in-macos-mojave-10-14-4.2175312/page-4#post-27232575

https://www.reddit.com/r/applehelp/comments/b707j0/cannot_add_google_accounts_to_my_mac/?utm_source=share&utm_medium=web2x

 

Update: The issue was fixed on either Apple’s or Googles end remotely. 

 

[Princess Luna]

And people like to bash only Microsoft for lack of proper Alpha/Beta testing before releasing updates... tendency is spreading to whatever software there is.

[DrMacintosh]

13 minutes ago, Princess Cadence said:

And people like to bash only Microsoft for lack of proper Alpha/Beta testing before releasing updates... tendency is spreading to whatever software there is.

Yep. Seems that way. 

[justpoet]

As somebody that used to work on a team that interacted with Google accounts (setups and use) while I was at Apple…Google was rather annoying to work with on the account side of things, and would sometimes tell us one thing would work, but then once they made their next server side update, it wouldn't.

 

This does sound like some testing wasn't done as it could've been, though.  However, because of what I mentioned first, that's also a good reason as to why things can get weird with so much special casing going on in the code for accounts, and why it isn't as simple as saying "they didn't test this".

[Guest]

Worked fine for me scrub, I’m on 10.14.5 now. 

On 3/30/2019 at 7:46 AM, Princess Cadence said:

And people like to bash only Microsoft for lack of proper Alpha/Beta testing before releasing updates... tendency is spreading to whatever software there is.

It’s all user based feedback for Apple’s beta. No telemetry.

[DrMacintosh]

Oh btw this was fixed. 

[williamcll]

The only google thing I have on my computer is chrome, I do all my other google services on the browser.

[BuckGup]

On 3/29/2019 at 1:46 PM, Princess Cadence said:

And people like to bash only Microsoft for lack of proper Alpha/Beta testing before releasing updates... tendency is spreading to whatever software there is.

Probably because software is beyond hard to fully understand 

[RejZoR]

Well, you can't expect perfect support for something that's essentially not an Apple service (G-Suite). It's not uncommon that things break when one or the other side changes something...

[HarryNyquist]

On 3/29/2019 at 2:46 PM, Princess Cadence said:

And people like to bash only Microsoft for lack of proper Alpha/Beta testing before releasing updates... tendency is spreading to whatever software there is.

At least in part, because the QA is outsourced to users and/or offshore firms.

 

For the users part, I understand, because you can have all the test cases in the world written up for your application but a user will find something within minutes that no test case covered. It doesn't make it acceptable, though, because users are not obligated to file bug reports etc while a hired employee WOULD be.

 

Offshore firms are just generally incapable of doing anything except exactly what they're told to do.