{"action":"created","issue":{"url":"https://api.github.com/repos/recampbell/google-login/issues/10","labels_url":"https://api.github.com/repos/recampbell/google-login/issues/10/labels{/name}","comments_url":"https://api.github.com/repos/recampbell/google-login/issues/10/comments","events_url":"https://api.github.com/repos/recampbell/google-login/issues/10/events","html_url":"https://github.com/recampbell/google-login/issues/10","id":67543477,"number":10,"title":"This plugin doesn't verify authenticated user is within the Google Apps domain.","user":{"login":"nov","id":27299,"avatar_url":"https://avatars.githubusercontent.com/u/27299?v=3","gravatar_id":"","url":"https://api.github.com/users/nov","html_url":"https://github.com/nov","followers_url":"https://api.github.com/users/nov/followers","following_url":"https://api.github.com/users/nov/following{/other_user}","gists_url":"https://api.github.com/users/nov/gists{/gist_id}","starred_url":"https://api.github.com/users/nov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nov/subscriptions","organizations_url":"https://api.github.com/users/nov/orgs","repos_url":"https://api.github.com/users/nov/repos","events_url":"https://api.github.com/users/nov/events{/privacy}","received_events_url":"https://api.github.com/users/nov/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-04-10T08:44:52Z","updated_at":"2015-11-11T18:55:52Z","closed_at":"2015-11-11T18:55:52Z","body":"If I remove `hd` request parameter, this plugin allows non-Google Apps users to login.\r\nYou should verify given email address belongs to the Google Apps domain.\r\n\r\nSince I'm not familiar with Java, it's a bit hard for me to make a pull request, but what you should do is basically\r\n\r\n* add `openid` to the scope list (which triggers OpenID Connect feature described below)\r\n* get `id_token` from token endpoint along with `access_token`\r\n* parse the `id_token` using a JSON Web Token library (JWT signature verification in code flow is OPTIONAL, not REQUIRED)\r\n* verify `hd` included in the `id_token` matches what your plugin sent\r\n\r\nps.\r\nIf you support multiple Google Apps domains, you'll need to bind the sent `hd` param to the `state` param."},"comment":{"url":"https://api.github.com/repos/recampbell/google-login/issues/comments/155876455","html_url":"https://github.com/recampbell/google-login/issues/10#issuecomment-155876455","issue_url":"https://api.github.com/repos/recampbell/google-login/issues/10","id":155876455,"user":{"login":"nov","id":27299,"avatar_url":"https://avatars.githubusercontent.com/u/27299?v=3","gravatar_id":"","url":"https://api.github.com/users/nov","html_url":"https://github.com/nov","followers_url":"https://api.github.com/users/nov/followers","following_url":"https://api.github.com/users/nov/following{/other_user}","gists_url":"https://api.github.com/users/nov/gists{/gist_id}","starred_url":"https://api.github.com/users/nov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nov/subscriptions","organizations_url":"https://api.github.com/users/nov/orgs","repos_url":"https://api.github.com/users/nov/repos","events_url":"https://api.github.com/users/nov/events{/privacy}","received_events_url":"https://api.github.com/users/nov/received_events","type":"User","site_admin":false},"created_at":"2015-11-11T18:55:52Z","updated_at":"2015-11-11T18:55:52Z","body":"I've just noticed this issue had been fixed in the other repo with better java code.\r\nthanks!"}}