News:

On Tuesday September 6th the forum will be down for maintenance from 9:30 PM to 11:59 PM PDT

Main Menu

Connect Failed: 403 Forbidden;Token Error

Started by turtlejay, January 17, 2021, 04:29:56 PM

Previous topic - Next topic

turtlejay

I just received an email stating a service offline alert. i check my dashboard and this error is showing. I attached a screen shot. Any advice? Ive tried deleting and re adding my google account three times.


Thanks

JAY

jholme004

I too have been having a similar issue on my OBI212 -2 GV accounts, both showing "Connecting to 216.239.36.145;Token Error". I have removed the GV lines from ObiTalk, deleted the ObiDevice from ObiTalk, removed the device from my GV account, removed ObiTalk permissions from Google, Reset my GV passwords, factory reset the obi Device, then reactivate everything - all using "incognito mode".   Calls work fine in/out of voice.Google.com and GV smartphone app.  Poly insists it is a password issue (hence the password resets).  I have even pulled out an old OBI202 and having THE SAME ISSUES.

I agree, a token issue is usually due to a bad password, BUT I'm wondering if, since the only way to config GV is through ObiTalk, the ObiTalk issues with activating is related to this - like not refreshing the token properly or timing out, etc. I've noticed most of the time in the past 4 days, when I re-add the GV lines, it shows "connected" for a minute or two before going to "Token error" or "registration Not Required".

If anyone has any other thoughts, let us know!

Jay - if you haven't done all of the above and need help, let me know. Historically, I've seen the token issue randomly occur before and the above steps have always resolved it.

-J
-Jason

SteveInWA

Quote from: jholme004 on January 19, 2021, 08:41:21 PM
I too have been having a similar issue on my OBI212 -2 GV accounts, both showing "Connecting to 216.239.36.145;Token Error". I have removed the GV lines from ObiTalk, deleted the ObiDevice from ObiTalk, removed the device from my GV account, removed ObiTalk permissions from Google, Reset my GV passwords, factory reset the obi Device, then reactivate everything - all using "incognito mode".   Calls work fine in/out of voice.Google.com and GV smartphone app.  Poly insists it is a password issue (hence the password resets).  I have even pulled out an old OBI202 and having THE SAME ISSUES.

I agree, a token issue is usually due to a bad password, BUT I'm wondering if, since the only way to config GV is through ObiTalk, the ObiTalk issues with activating is related to this - like not refreshing the token properly or timing out, etc. I've noticed most of the time in the past 4 days, when I re-add the GV lines, it shows "connected" for a minute or two before going to "Token error" or "registration Not Required".

If anyone has any other thoughts, let us know!

Jay - if you haven't done all of the above and need help, let me know. Historically, I've seen the token issue randomly occur before and the above steps have always resolved it.

-J

Yah, the Poly person was incorrect; Google Voice on an OBiTALK device doesn't use passwords.  It uses OAUTH token authentication, which only authorizes the device to access the Google Voice service on a Google account, and not access to the entire account.  The problem you describe happened years ago, and was caused by a mismatch between changes Google had made on their side, and Obihai made to the firmware on their side.  That particular problem was fixed long ago.

However, here are some possibilities:  you said that Google Voice works "fine" on the app and the web GUI.  How recently did you test it that way?  Google has been suspending a lot of accounts lately, and suspension could cause your symptom.  A couple of long-shot issues could also be the cause:  1) you are signed into Google account "A" on your smartphone and website, but you provisioned Google account "B" on the OBi, and there is a problem with "B".  This is an easy mistake to make, since Google allows multiple accounts to be signed in on the same browser at the same time.  2) the account you're using on the OBiTALK device is not a consumer Gmail account.  Google Voice for Google Workspace does not support consumer-class OBiTALK devices.  Some OBiTALK devices that were on the old G Suite service might continue to work until the device is deleted and then a re-install is attempted.

Finally, at least when this happened a few years ago, when a user tried multiple times to (re)authorize a Google Voice account, Google would lock it out as a security precaution.  Generally waiting a day or so would result in a successful authorization.

jholme004

Thanks Steve. I remember that a few years ago...a nightmare!

I knew GV uses OAuth - the rep made it sound like it was me entering in the wrong password when signing in to GV. That didn't make sense since it was successful and I could make a call, until a few minutes later.

I've been testing everything the past three days although this started on 1/7. Today, in a desperate attempt,   I had logged out of all systems, including mobiles, and used Chrome in incognito mode. Calls could be made on account 1 via web, but I received the Token Error in the Obi.  I tested both accounts, both ways.  I'm a diagnostic engineer, so I made certain I was logged into the proper accounts for troubleshooting.  I am using consumer GV - both accounts are gmail.com.

I was actually wondering about a lock out - is that done at a device level? Again, web and app work and I had removed the device from Google voice and ObiTalk permissions from my Google accounts just in case.  I will remove the accounts from the Obi and give it a few days.

Didn't mention this before, but definite believe this is a "Google Related" issue.. I have Anveo on SP3 and BulkVS on SP4 and both of them work flawlessly.
-Jason

SteveInWA

The lock-out would be temporary, and it is on the Google Voice back-end.  There is nothing wrong with your OBiTALK devices.  Given your excellent troubleshooting, and the continuing failure, it seems that there may be some corrupted information on the failing Google account.  You probably can't get that fixed.  Did you check and confirm that there were no OBiTALK entries on both the new Google Voice UI settings, and the old, "Legacy" GV UI settings?

SteveInWA

On second thought, you may be able to fix this, if waiting doesn't help.

You may be able to transfer the failing GV number out of its current Google account, to a different Google account.  If it works on that account, you can then transfer it back.  That might clear out the mess.

See:  https://support.google.com/voice/answer/1065667#googlexfer

Note that the transfer procedure is very finicky.  You must a) not already have a GV number on the destination account, and b) that destination account must have already accepted the GV Terms of Use, and c) both accounts must be consumer Gmail accounts.

jholme004

Thanks Steve. I did verify both the new and "Legacy" GV UIs that the Obi was removed.
Poly got back to me today and suggested making a call in Gmail to reactivate the voice account (never heard of this before & I thought Hangouts was being decommed). When I clicked the phone icon in the lower left, I received the message: " Call phones feature is not available."  Google's own help site makes this sound like it is Hangout's obsolescence stating "Important: Phone calls in classic Hangouts will be turned off in early 2021. If you are in the US, you can continue to make phone calls when you upgrade to Google Voice."  I can still make and receive calls on Google Voice via web and mobile app.  Any thoughts on this step suggested by Poly?

I am hesitant at transferring the number, as it's our family line that we have had for almost 20 years - ported it in when we moved to a different state two years ago. Although, I'll try adding it in the Obi over the weekend and if it doesn't work, I am not sure I have a choice but to try transferring it.

@turtlejay - sorry for Hijacking your thread...hopefully you have since gotten back online.
-Jason

SteveInWA

Quote from: jholme004 on January 21, 2021, 04:46:22 PM
Thanks Steve. I did verify both the new and "Legacy" GV UIs that the Obi was removed.
Poly got back to me today and suggested making a call in Gmail to reactivate the voice account (never heard of this before & I thought Hangouts was being decommed). When I clicked the phone icon in the lower left, I received the message: " Call phones feature is not available."  Google's own help site makes this sound like it is Hangout's obsolescence stating "Important: Phone calls in classic Hangouts will be turned off in early 2021. If you are in the US, you can continue to make phone calls when you upgrade to Google Voice."  I can still make and receive calls on Google Voice via web and mobile app.  Any thoughts on this step suggested by Poly?

I am hesitant at transferring the number, as it's our family line that we have had for almost 20 years - ported it in when we moved to a different state two years ago. Although, I'll try adding it in the Obi over the weekend and if it doesn't work, I am not sure I have a choice but to try transferring it.

@turtlejay - sorry for Hijacking your thread...hopefully you have since gotten back online.


Holy shit.  I typed a very detailed set of instructions for you, on how to make the transfer, the forum hung, and I lost my work.  I'm out of time today.

Short answer:  there is very little risk in transferring the number.  You simply need to use a consumer Gmail.com account that doesn't already have a Google Voice number.   The tricky part is a catch-22:  you can't transfer a number into Google Voice, if the target account hasn't yet accepted the Google Voice Terms of Use.  So, you need to open the target account in an Incognito Browsing (Google Chrome or Edge) or Private Browsing (Firefox) window, go to the new account, go to Google Voice (https://voice.google.com/) and follow the steps to get a new number.  Get as far as it asking you to approve the ToS, do so, then cancel out.  Sign out of that account, sign into the account that now holds the problematic number, then kick off the transfer process.

jholme004

LOL - Sorry for laughing, but I can't tell you how many times that has happened to me on various forums.

So I did this with the GV Number for my office line. (I had two - the old home and the office). I"t;s been cooking for two hours now and still "Connected". Can make/receive calls no problems. I'll let it cook over the weekend and if it holds, I'll do the other number.

Does anything need to be done on the original account to "reset" it? I agree, it seems like account corruption on the GV side - I just don't want to transfer it back and have the same issue again.

Thanks again - I truly appreciate your insight and help and will do my best to pay it forward.
-Jason

SteveInWA

Quote from: jholme004 on January 22, 2021, 03:38:28 PM
LOL - Sorry for laughing, but I can't tell you how many times that has happened to me on various forums.

So I did this with the GV Number for my office line. (I had two - the old home and the office). I"t;s been cooking for two hours now and still "Connected". Can make/receive calls no problems. I'll let it cook over the weekend and if it holds, I'll do the other number.

Does anything need to be done on the original account to "reset" it? I agree, it seems like account corruption on the GV side - I just don't want to transfer it back and have the same issue again.

Thanks again - I truly appreciate your insight and help and will do my best to pay it forward.

Glad to hear that the GV number is now working on the target account (at least I think that's what you meant by "connected; -- did you test inbound and outbound calling)?

Transferring the number back and forth should reset the configuration.  Give it a try and let me know the outcome.

jholme004

Sadly, it is back to showing: "Connecting to 216.239.36.145;Token Error" (Still no the new account). Yes, I could make/receive calls via the Obi and the web when I sent my last reply.

I may have to keep my fingers crossed the Poly will have a solution (although I am NOT holding my breath).

I'm at whit's end on this one!
-Jason

SteveInWA

Help me by clarifying the current situation.  You have two GV DIDs.  Did you transfer one or both of them to two new Google accounts?  If so, did they work on the new Google accounts?  Did you transfer either or both of them back?

In other words, if you transferred one of the numbers to a new account, did the number work on that account?  If so, did it then fail later?  Please be very detailed in your description so we can try to isolate the issue.

jholme004

Ok...

I have two GV accounts - out old home account from a different state (line1) and an office line (line 2). Initially, I had these on an Obi202, FXS 1 & 2 respectively, and have since moved to a 212, since I have a landline for home service.

Approximately two weeks ago, both went to showing "Connecting to 216.239.36.145;Token Error". Despite the trouble shooting  in the posts above, they would work for about 15 minutes when deleted and re-added then back to "Connecting to 216.239.36.145;Token Error" and after several hours would change to "registration not required"

I followed the instructions on transferring the number. I have a third gmail.com account I use for my browser at work (We use MS Office for everything - this is NOT a GSUITE account, just a seperate account for syncing my browser across multiple work devices). Out of my irrational fear of losing the home number if something went wrong, I decided to transfer the office line, line2. 

Everything went smoothly, and I could make and receive calls via the web in my "work" gmail account. I did the transfer by logging into my Line 2 account using incognito mode in Chrome, and logging into my "work" account using MS Edge, the chromium based version,  "inPrivate" mode. After thr transfer was complete I did log out then log back in to each account to verify that the number no longer appeared on the "line 2" account and it did appear on the "work" account. I then re-added my factory reset Obi202 to ObiTalk then added the "work" google account (which now has my office line attached to it) to the Obi202. It was "connected" for a couple of hours. During that time, I placed and received several calls. When I noticed ObiTalk was stating "Connecting to 216.239.36.145;Token Error" again, I got the ""no response from the service provider" intercept when attempting outbound calls and inbound calls never rang the Obi. Like before, I can make/receive calls via the webUI and smartphone app. When writing this, I noticed it has changed to "Registration not Required"

So, In short and to directly answer your questions (I was trying to be detailed above):
     -I only transferred One DID (Line2/Office)
     -It worked on the new account via Web UI and Obi
     -It eventually stopped working on the Obi, with the same symptoms I previously had (works briefly
       then "Connecting to 216.239.36.145;Token Error" then eventually turns to "Registration not Required")
     -I did not transfer it back, as my assumption would be we would have the same results.
     - Yes, I am using two different Obi's. This was to verify it wasn't an issue with one of them
       (Hardware/Firmware/configuration). I am doing all my testing on my Obi202. The GV accounts are NOT registered to the 212, nor do the GV accounts have permissions for the Obi212 anymore.

I'll try transferring the home/Line1 number to a new account and transferring the office/line2 back to its original tomorrow. After the above today, I am not optimistic we will see different results.

Let me know if I inadvertently left any holes.

Thanks again Steve.
-Jason

jholme004

So today, I transferred the Office/Line 2 number BACK to its original account. As before, it said "Connected" for approximately 15 minutes, then changed to "Connecting to 216.239.36.145;Token Error".

I started thinking - I checked using two different Obis to be sure it wasn't a device issue; this is happening to two different gmail accounts and we suspected a potential account issue, so we transferred the number. For S&G's, I decided to create a *NEW* gmail account (from scratch, using Chrome Incognito mode) then chose a *NEW* number.  Before I moved on, I logged into ObiTalk in MS Edge and removed the the "Office/Line2" from my Obi202 (which at that point said "Registration not required"), then did a powercycle of the Obi Device. When it came back online, I went back into edge and added the new GV number using my new GMail account.  After a minute or so of "Connecting", it changed to "registration Not required".  Calls to **9 222 222 222 are successful, so the Obi Device is online.

I haven't tried transferring the "Home/Line1" number, as at this point it seems futile, given 2 transfers of an existing and a brand new account yield the same results.

I'm starting to wonder if this may be a configuration issue on the ObiTalk side, along with their other issues? 
-Jason

jholme004

For giggles, I added the "Home/Line1" and the "Office/Line2" accounts to the Obi202 and both went from "Connecting" to "registration not required".

Now I have SP1 (New) and SP2 (Office/Line2 xferred back to the original account) on the Obi202 and SP1 (Home/Line1) on the Obi212 saying "Registration Not Required". SP3 (Bulkvs) and SP4 (Anveo) on the 212 are showing "Registered" and both have tested working properly.

-Jason

jholme004

#15
This morning, I had the brainiac Idea of moving the Obi202 to the "New" account - might as well test EVERYTHING including my ObiTalk Account (What if somehow it was corrupt?)

Well, I should have known better - 3 hours later and I'm still trying to add it to the new ObiTalk account.

At the same time, I deleted the "Home/Line1" account from my 212, deleted it from Google Voice, and deleted the ObiTalk permissions from my Google account and re-added it as SP1. (Of Note: It took 3 tries to re-add it - the first two tries, said "Registration not required", yet never showed as a device in GV - New or Legacy) When it did get re-added, it showed "Connected". I was able to make and receive calls via SP1 on the Obi212. After 1hr, it was still connected, and I was very optimistic since that is the registration period (3600 sec). However, after 1hr 43 min, it changed to "Connect Failed: 403 Forbidden; Token Error (server=216.239.36.145; retry in 115s)", then approx 15 minutes later "Connect Failed: 403 Declined;Token Error (server=216.239.36.145; retry in 188s)". I did not make or receive any calls, change any setting in Google Voice or ObiTalk, or look at or breathe near the Obi212. Since it is a "Forbidden" error, I followed instructions from another post (http://www.obitalk.com/forum/index.php?topic=16034.0, unplugging the Obi, then checking my GV account in Chrome using Incognito mode - I could place/receive calls normally there, as I could also from my GV mobile app. After plugging the 212 back in and it powering up, SP1 then showed "Connecting to 216.239.36.145;Token Error" - back to where we were.

After this, I added the "Office/Line 2" account to SP2 (This was the one I transferred to a different GV account then transferred back). When I added it, both SP1 and sp2 showed as "Connected".  I tested outgoing call on SP2 and it went through. When I then went to test SP1, I received the "..has not received a response from the service provider" intercept. When I checked on the status in ObiTalk, both were now "Connecting to 216.239.36.145;Token Error[/b]". BTW, **9-222-222-222 is successful.

I decided to capture level 7 logs - Interestingly, when the Obi restarted there were these lines, that seem to show there is an issue when connecting via SSL:
Jan 24 19:44:16 Obi212 OBI212 TC:ssl connected 
Jan 24 19:44:16 Obi212 OBI212 BASESSL:Server name not matching...accounts.google.com vs google.com 
Jan 24 19:44:16 Obi212 OBI212 LHC:Server verification failed! 
Jan 24 19:44:16 Obi212 OBI212 GAPI:verify server error 
Jan 24 19:44:16 Obi212 OBI212 TC:ssl connected 
Jan 24 19:44:16 Obi212 OBI212 BASESSL:Server name not matching...accounts.google.com vs google.com 
Jan 24 19:44:16 Obi212 OBI212 LHC:Server verification failed! 
Jan 24 19:44:16 Obi212 OBI212 GAPI:verify server error 

(I've attached the start-up logs)

After the restart, both SPs show as "Connecting to 216.239.36.145;Token Error".


@SteveInWA - Any thoughts?

-Jason

jholme004

My GV accounts started working randomly last night.  This morning, Poly had sent me an emai that said:

QuoteWe are working on our servers recently to improve the performance of our service. We have this KB article that is about issues that we are fixing https://www.poly.com/us/en/support/knowledge-base/kb-article-page?type=Troubleshooting__kav&lang=en_US&urlName=KB24053&t=All&k=

Your devices could be affected positively and now are working.

I'm guessing this meant this was an issue with ObiTalk? The KB doesnt quite address the GV issue, but it works. 
-Jason

SteveInWA

Quote from: jholme004 on February 05, 2021, 08:21:21 PM
My GV accounts started working randomly last night.  This morning, Poly had sent me an emai that said:

QuoteWe are working on our servers recently to improve the performance of our service. We have this KB article that is about issues that we are fixing https://www.poly.com/us/en/support/knowledge-base/kb-article-page?type=Troubleshooting__kav&lang=en_US&urlName=KB24053&t=All&k=

Your devices could be affected positively and now are working.

I'm guessing this meant this was an issue with ObiTalk? The KB doesnt quite address the GV issue, but it works. 

That KB article, and the status page, are the first useful (and encouraging) information we've seen in a very long time.

If you look at the status page. you'll see that they have made two recent upgrades, and they have another one planned for tomorrow (6 Feb).  Hopefully, things will start to improve.

But more significant, is a new suggestion on how to deal with the issue.  The grammar is poor, but the recommendation is:  if it tells you that your code is being "sent to the server", during the 180 second countdown, but it seems to have failed (normally, it should only take a few seconds), then re-enter the same **5 xxxx code.  Do not abort and start over to get a new xxxx code, unless it reaches the end of the countdown and tells you it failed.  It's unclear, but repeatedly requesting new codes may just make things worse.