Authentication on G Suite domain/scope

[Kai Hendry]

Hi there,

I posted a related question here: http://stackoverflow.com/questions/40098541/g-suite-identity-provider-for-an-aws-driven-browser-based-app

Nonetheless, I'm taking a quick look at Firebase and wondering if I can solve my problem.

https://firebase.google.com/docs/auth/web/google-signin

We use G suite at work, lets call the domain @example.com.

I want to only allow @example.com / employees to use my "serverless" JS app. Is this called a scope? I got a bit lost upon https://developers.google.com/identity/protocols/googlescopes

Thank you!

[Jacob Wenger]

Hey Kai,

You are in luck since this feature was actually just recently added! You can do this via the setCustomParameters() method. Check out step three in the instructions here. Instead of login_hint, you'll want to use hd (short for "hosted domain"). The full list of available parameters is here. To limit sign-ins to @example.com Google accounts, your code would look something like this:

var provider = new firebase.auth.GoogleAuthProvider();

provider.setCustomParameters({

  hd: "example.com"

});

firebase.auth().signInWithPopup(provider)

  .then(function(result) {

    // This gives you a Google Access Token. You can use it to access the Google API.

    var token = result.credential.accessToken;

    // The signed-in user info.

    var user = result.user;

    // ...

  })

  .catch(function(error) {

    console.log("Error signing in:", error);

  });

Cheers,

Jacob

--
You received this message because you are subscribed to the Google Groups "Firebase Google Group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to firebase-talk+unsubscribe@googlegroups.com.
To post to this group, send email to fireba...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/firebase-talk/c6ed3096-8e96-4543-b68b-9ae85056f800%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Quentin Veyret]

Hi Jacob,

Thank you for this very useful feature!

Is there a way to specify more than one domain?

For example if a customer has multiple domains but only wants to allow the login to a few of them.

Thanks for your help.

Best regards,

Quentin

To unsubscribe from this group and stop receiving emails from it, send an email to firebase-tal...@googlegroups.com.

[Jacob Wenger]

Hey Quentin,

I'm not aware of a way to specify multiple domains, but some quick Google searching did find some other people working around this particular issue. Might not work for your use case, but worth the shot.

Cheers,

Jacob

To unsubscribe from this group and stop receiving emails from it, send an email to firebase-talk+unsubscribe@googlegroups.com.

To post to this group, send email to fireba...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/firebase-talk/b58c8547-f44d-416b-8c65-69f7451f9a5a%40googlegroups.com.

[Quentin Veyret]

Hi Jacob,

Thank you for your help, multiple login possibilities could be a solution indeed, I will try it.

Anyway, checking the domain on the serverside is still a good solution (is the application is not serverless as Kai asked).

Best,

Quentin

[Nikos Kermanidis]

Hi Jacob,

Can I do the same with the Android SDK? I couldn't find the setCustomParameters() method.

To unsubscribe from this group and stop receiving emails from it, send an email to firebase-tal...@googlegroups.com.

[Steve McNiven-Scott]

I would also be curious about iOS custom parameters, I don't see anything documented...?

[Bassam]

Hey folks, there is no signInWithPopup/Redirect in Android/iOS. You would usually use the native Google sign in SDK to get the OAuth credential before calling signInWithCredential. You would need to pass the custom OAuth parameter for hd or login_hint from there if possible.

Bassam

[Steve McNiven-Scott]

@Bassam

Any chance of pointing at the docs?  I've gone though them and I just can't find any reference to set the params?

Steve

[Steve McNiven-Scott]

OH HO!  I see I think... I poked into the code for the firebase plugin I'm using and yeah it's using core google libs.

So I think this is what we need

 setHostedDomain builder method on Android, and the hostedDomain property on iOS.

Steve