{"action":"created","issue":{"url":"https://api.github.com/repos/davido/gerrit-oauth-provider/issues/22","labels_url":"https://api.github.com/repos/davido/gerrit-oauth-provider/issues/22/labels{/name}","comments_url":"https://api.github.com/repos/davido/gerrit-oauth-provider/issues/22/comments","events_url":"https://api.github.com/repos/davido/gerrit-oauth-provider/issues/22/events","html_url":"https://github.com/davido/gerrit-oauth-provider/issues/22","id":68643987,"number":22,"title":"Add restricting sign-in to specific google apps hosted domains","user":{"login":"bartekwojcicki","id":5853558,"avatar_url":"https://avatars.githubusercontent.com/u/5853558?v=3","gravatar_id":"","url":"https://api.github.com/users/bartekwojcicki","html_url":"https://github.com/bartekwojcicki","followers_url":"https://api.github.com/users/bartekwojcicki/followers","following_url":"https://api.github.com/users/bartekwojcicki/following{/other_user}","gists_url":"https://api.github.com/users/bartekwojcicki/gists{/gist_id}","starred_url":"https://api.github.com/users/bartekwojcicki/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bartekwojcicki/subscriptions","organizations_url":"https://api.github.com/users/bartekwojcicki/orgs","repos_url":"https://api.github.com/users/bartekwojcicki/repos","events_url":"https://api.github.com/users/bartekwojcicki/events{/privacy}","received_events_url":"https://api.github.com/users/bartekwojcicki/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/davido/gerrit-oauth-provider/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":12,"created_at":"2015-04-15T10:42:47Z","updated_at":"2015-05-06T06:58:15Z","closed_at":null,"body":"It would be nice if one could specify google apps domain in gerrit.config to restict sign in.\r\n```\r\n[plugin \"gerrit-oauth-provider-google-oauth\"]\r\n\tclient-id = foo\r\n\tdomain = example.com\r\n```\r\nIt would require adding hd param to authentication request and validating domain in token.\r\nhttps://developers.google.com/identity/protocols/OpenIDConnect#hd-param"},"comment":{"url":"https://api.github.com/repos/davido/gerrit-oauth-provider/issues/comments/99346455","html_url":"https://github.com/davido/gerrit-oauth-provider/issues/22#issuecomment-99346455","issue_url":"https://api.github.com/repos/davido/gerrit-oauth-provider/issues/22","id":99346455,"user":{"login":"davido","id":347173,"avatar_url":"https://avatars.githubusercontent.com/u/347173?v=3","gravatar_id":"","url":"https://api.github.com/users/davido","html_url":"https://github.com/davido","followers_url":"https://api.github.com/users/davido/followers","following_url":"https://api.github.com/users/davido/following{/other_user}","gists_url":"https://api.github.com/users/davido/gists{/gist_id}","starred_url":"https://api.github.com/users/davido/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davido/subscriptions","organizations_url":"https://api.github.com/users/davido/orgs","repos_url":"https://api.github.com/users/davido/repos","events_url":"https://api.github.com/users/davido/events{/privacy}","received_events_url":"https://api.github.com/users/davido/received_events","type":"User","site_admin":false},"created_at":"2015-05-06T06:58:15Z","updated_at":"2015-05-06T06:58:15Z","body":"So I re-read the spec again and realized, that ID token must be checked to prevent client side manipulation, https://developers.google.com/identity/protocols/OpenIDConnect#authuser:\r\n\r\n```\r\nThe hd (hosted domain) parameter streamlines the login process\r\nfor Google Apps hosted accounts. By including the domain of the\r\nuser (for example, mycollege.edu), you restrict sign-in to accounts\r\nat that domain. For Google Apps customers that have SAML set up\r\nwith their own authentication infrastructure, the hd parameter\r\nautomatically redirects to that user's SAML resource to log in.\r\n\r\nTo protect against client-side request modification, be sure to validate\r\nthat the returned ID token has a matching hd claim (which is proof the\r\naccount does belong to the hosted domain).\r\n```\r\n\r\nSo my previous diff was wrong. Here is the correct implementation: [1].\r\nCan someone give it a try? I cannot really test it.\r\n\r\n[1] http://ostrovsky.org/gerrit/0001-Add-support-for-hosted-domain-to-Google-OAuth-provid.patch"}}