Mojave 10.14.4 fails to Authenticate Gmail account

I had the same behavior after the update: GSuite mail and calendar not working, gmail.com mail and calender work okay.

The mail is not a big deal to me because I use Postbox mail client. If you switch to Postbox, Thuderbird, or other non-Apple mail you can work around the problem... and maybe have a better experience long term.

The calendar was a harder problem, but I found a workaround that works for me. I delegated my GSuite calendars to my gmail.com account and now I can get to all of my calendars in MacOS Calendar. - via my gmail.com account.

By "delegate" I mean:

• in your GSuite calendar (at calendar.google.com) choose Settings and sharing
• "Share with specific people" choose "Add people" and add your gmail.com account
• choose "Make changes and manage sharing".

If you don't have that option, it must be enabled by your GSuite administrator, which they may or may not be willing to do. I administer the two GSuite domains that I couldn't authenticate with 10.14.4, so it was possible for me to enable this workaround.

Here's a potential fix, and also another piece of the puzzle. Prior to "The Fix" (see below) my 10.14.4 system was in this state:

• GSuite account (grandfathered) was in the authentication loop.
• Standard "...@gmail.com" account was working
• In KeyChain I had deleted the "com.apple.account.Google.oauth-{token | expiry-date | refresh-token}" for the failing GSuite account only.

The Fix (for me...YMMV)

1. Quit Mail.app and Calendar.app (basically, all the apps that can sync with GSuite!)
2. Install Thunderbird - yes, that old chestnut!
3. Add your failing GSuite account to Thunderbird.
   1. Go through the OAuth dance (including 2FA if you're using it).
   2. Verify email is flowing in Thunderbird.
4. Quit Thunderbird...it's job is done.
5. Open KeyChain - you should have fresh "com.apple.account.Google.oauth-{token | expiry-date | refresh-token}" entries for the failing GSuite account!
6. Open Mail.app. and take your GSuite account ONLINE. Same deal with Calendar.app etc. The new auth tokens are (should be) working.

So what do we learn from this? Simply that Apple's OAuth dance in System Preferences DOESN'T populate the necessary tokens in KeyChain. This also means that as soon as my existing tokens expire again, I will likely need to open Thunderbird to get new ones again. It's clunky, but it "works".

To verify this fix, I did the following:

1. Quit Mail.app etc.
2. Deleted the tokens etc from KeyChain (again).
3. Tried to authenticate in "System Preferences -> Internet accounts" which just looped as we have all seen.
4. Fired up Thunderbird, which asked me to re-authenticate - expected because the oauth tokens are gone.
5. Verified mail access etc. then closed Thunderbird.
6. Confirmed new tokens in KeyChain.
7. Restarted Mail.app and Calendar.app - mail/calendar sync now operational again.

I CAN CONFIRM THE FOLLOWING PROCEDURE WORKS. Tried on 3 different accounts successfully.

Previously tried everything on this thread (even re-adding the account and certificate removal).

Important: After you're done with the authentication, you can remove the Charles application and Mail will continue to work:

We're going to use an app named Charles to rewrite a response from Google to include the email address (which is for some reason missing in google's own response). This is a one time setup only needed for verification.

1. Download, install and run Charles.
2. If this is your first time using Charles it should prompt you to authorize automatic proxy configuration. Do this. (Otherwise just make sure the macOS proxy is enabled and working)
3. From the Help menu choose SSL Proxying > Install Charles Root Certificate.
4. Once the certificate is installed, find it in your keychain (type Charles into the search), open it, expand the Trust section and set to ALWAYS TRUST. You will be prompted for your password when closing it.
5. Back in Charles, from the Proxy menu choose SSL Proxying Settings.
6. Add a new location with Host: people.googleapis.com
7. From the Tools menu choose Rewrite and click the Add button.
8. Add a new location with Host: people.googleapis.com
9. Add a new action with the following details:

• • Type: Body
  • Where: Response (uncheck "request")
  • Replace Value: {"names":[{"metadata":{"primary":true},"displayName":"Your Name Here"}],"emailAddresses":[{"value":"your@emailaddress.com"}]}
  • (Make sure you put in your name and email address).

Once you save this, we're all set. Go to your system Internet Accounts or (Mail) and authorize your account.

If everything thing is working, you can quit Charles and feel free to delete the certificate from Keychain.

If this worked for you, click the "helpful" button below.

(credits to "Gannet" at the MacRumors forum)

I have 6 G-Suite accounts and one vanilla Gmail account. Vanilla Gmail account worked following re-authentication but the G-Suites accounts did not.

Here's how I resolved it. For each G-Suite account,

1. Quit Mail App & Calendar App
2. Go to keychain and search for 'google.oa' keychains
3. Delete all keychains corresponding to the G-Suite account you want to resolve.
4. Go to https://accounts.google.com
5. login with the G-Suite account you want to resolve
6. Go to Security (4th item on left menu) -> "Manage third-part access" [or Security -> "Signing in with Google"]
7. click on macOS
8. Revoke macOS access
9. Sign out of https://accounts.google.com
10. On macOS System Preferences, re-authenticate the G-Suite account ensuring you allow macOS third party access to the Google account.
11. Confirm that new auth tokens are present in keychain
12. Open up Mail App and synchronize the account to get your mails
13. Open up Calendar App, hit Command+R to synchronize your calendar
14. Done

Seems problem is related to old macOS access on G-Suite apps still persisting on Google's side which 10.4.4 doesn't like. Problem lies between Apple & Google with users in between facing their wrath.

I have a corporate Google Apps account with 2FA. This is what worked for me:

1. Open 'System Preferences > Internet Accounts'
2. Delete existing Google account
3. Add new Google account
4. Follow the prompts to get a Safari window where you enter user ID. Don't enter the details yet!
5. In the Safari menu, go to 'Safari > Settings for this Website' and untick 'enable content blockers'
6. Now enter username, then password, then go through 2FA.
7. You should be prompted to enable Mail, Calendar, Contact, and Notes. Tick what you want

Now working...

Google changed their 2-step verification process for G Suite accounts within one day of the Mojave 10.14.4 release. Could be the culprit.

New 2-Step Verification options for G Suite accounts

March 26, 2019

What’s changing 

We’re updating how 2-Step Verification works for G Suite. This will make new 2-Step Verification methods available for some devices, and update the 2-Step Verification user interface on mobile and desktop devices. There are three key impacts:

• • New 2-Step Verification interfaces 
  • Different screens on different browsers (Safari, Edge, etc.) 
  • Expanded Bluetooth security key support 

https://gsuiteupdates.googleblog.com/2019/03/new-2-step-verification-options-for-g-suite.html

I was able to get my gmail account working again in Mail by doing the following:

1. Go into mail Preferences > Accounts
2. Select the Account Information tab for your Gmail account > Click the Email Address droplist
3. Select: Edit Email Addresses...
4. Click the "+" to add a new email address
5. Create a new email address identical to the original
6. Once the new email address is created, delete the original email address with the "-" button.
7. Click "OK"
8. Go through the Google authentication again.

Hopefully that will work for you. One note, my Gmail was previously setup for IMAP.

The steps below worked for me when 10.14.4 broke access to my GSuite-backed e-mail, calendars and notes. Hopefully it works for others as well as this problem is a real PITA.

• Delete the problematic Google account(s) from mail.app and Internet Accounts
• Remove any stored credentials for the impacted Google account(s) from Keychain Access.
• Add the account back (as a new account) via Internet Accounts or mail.app (via add Google account), but only select Mail, NOT Contacts, Calendars or Notes. (only connecting to Mail for the initial auth appears to make a difference for some reason)
• Complete the new account authentication process as you normally would.
• At this point, mail.app and Internet Accounts were able to successfully authenticate and connect to Google mail.
• (optional) Enable access to Contacts, Calendars and Notes as needed in Internet Accounts.

I am having a similar issue after upgrading to 10.4.4. Here is what I have noticed:

1. Regular Gmail account works fine, no issues.
2. iCloud account works find no issues
3. Gsuite account requires login after about 1-2 hours of access. It will take my username and password and it will work in apple mail but after 1-2 hours OR a drop in WIFI seems to also triggure the re-auth.

3a. I have also noticed some issues relating to the fact that my GSuite account has multiple alais email addresses. When I add the account through System Preferences > Internet accounts it adds the wrong (not default) email address and sometimes gives me the error that the email address doesn't match the account. I suspected this was an issue with icloud settings being synced from ios devices with the same account. Turning off icloud keychain and icloud systems setting sync appeared to fix this issue but didn't fix the re-authorization issue.

I suspect that a change in 10.4.4 is pulling inocrrect settings from ios devices into the mac mail app and a seperate bug is causing the authentication issues.

I have an iMac (Retina 5K, 27-inch, 2017) connected to the WIFI of my work and it happens to me. I spent a couple of days trying to solve it. But finally.....

What did I do and works for me?

1. I set mi iPhone as "personal Hotspot".
2. I connected my iMac to internet trough my iPhone. Not my work's wifi.
3. I did the authentication in Safari without any problem

That is it...!!!! good luck

This is what I did and it works:

1. Logon to your google account (not the Gmail account)
2. Click on "Security" left panel
3. Scroll down and find: Less secure app access
4. Click on "Turn on access"
5. Google will notify you of the changes--click "yes"
6. Go to you Mail account(s) and delete your Gmail account
7. In Mail click Mail >> Accounts
8. Click "Add another account"
9. Choose "Mail account" (just below AOL)
10. Type in your Gmail account info
11. That's it!

• Sign in to your Google Admin console. ... 
• Click Security > Basic settings. ... 
• Under Less secure apps, select Go to settingsfor less secure apps.
• In the subwindow, select the Allow users to manage their access to less secure apps radio button.

I have many gmail accounts. Once I upgraded to 10.14.4, I had to authenticate with all of them. It worked for each of them; i.e. for all my accounts. But, as soon as I close a Mail window, then reopen it, all my gmail accounts are offline. I have to re-establish the connection to each of my gmail accounts. The "take all mail online" does NOT work. Each account has to be re-taken online. All of these have failed:

1. deleting my accounts and re-establishing them through Mail/Network
2. deleting all gmail and google passwords and certificates in Keychain and re-establishing them
3. Clearing all caches and rebuilding the mail index (via Onyx)
4. The usual: rebooting, rebooting in Safe Mode, resetting NVRAM

Unbelievably frustrating.

MBP retina/touchbar/2016 macOs 10.14.4 (Mojave)

I followed your suggestion number one. The set up went normal but I have not realized a fix. Re-thinking, I didn't delete my old account and maybe there's a conflict. Before I do anything else:

1. Do I delete the old MAC Mail Google account?
2. Any other particulars I should know?

Thanks much, hope to hear something soon. This issue has stopped being fun!

GMAIL problems and account in general go on and OFF after updating Mac OS Mojave.

Resolved: DISABLE SOCKS Proxy because it can turning on by itself.

Mac OS devices running Mojave (any version): 

• SOCKS proxy is automatically re-enabled after every reboot/power cycle. 

By default, no proxy settings should be configured. 

The proxy is configured with: localhost port 8080

This causes all email apps to go offline intermittently.

Also it causes all web browsers to become "unable to load" any web page and this is why GMAIL can't authenticate the accounts even when you try to delete or add the account.

Once the proxy is manually disabled in Network Preferences; everything works fine. 

Recheck SOCKS Proxy in case of problem.