Google enrolment and login

[mhzawadi]

Hi there,

Thanks for this amazing project, it looks like it will replace my authlia install. But only once I can connect it to Google.

I have it setup and logging me in with a username and password, but I would like to enrol a user from Google and then login with that new user. How do I setup flows and stages for this please?

[BeryJu]

You can follow the docs here to setup google login https://goauthentik.io/docs/integrations/sources/google/index

Make sure to also check https://goauthentik.io/docs/integrations/sources/index to get the button to appear

[Selmaks]

Just replying so other people are aware. I set up google OAuth and set my app to external and added a few email address access for testing. What I found was other gmail users could logon regardless of them being in the allowed list or not.

I found this which describes what I am experiencing https://issuetracker.google.com/issues/211370835?pli=1

[kienzlenator]

Any chance you could detail how you were able to achieve this? I have created the policy and bound it to my defauly-authentication-prompt following the guide for the google integration, but it refuses to work.

Appreciate it.

[antoniozh]

Sure, under Customization -> Policies look up "default-source-enrollment-if-sso" and then I edited the code to look like this:

# This policy ensures that this flow can only be used when the user
# is in a SSO Flow (meaning they come from an external IdP)
# return ak_is_sso_flow
return False

Test it out with an unenrolled Google account, HTH

[LukePWilkins]

Can confirm this works. Thank you @antoniozh.
Nice and clean.

[gravity182]

Thanks a lot @kancelott. I was able to allow only certain Google-authenticated users to log in to my homeserver.

[bzly]

I ended up using a policy and checking the user's email against a whitelist, similar to the example in the docs given for checking for membership in GitHub orgs:

# Ensure flow is only run during oauth logins via Google
if context["source"].provider_type != "google":
    return True

# Whitelisted users
accepted_users = ["[email protected]", "[email protected]"]

# Get the logged in user's Google email
google_username = context["oauth_userinfo"]["email"]

# Match username
user_matched = any(user in google_username for user in accepted_users)
if not user_matched:
    ak_message("You are not allowed to log in. This attempt has been logged.")
return user_matched

Is the value of context["oauth_userinfo"]["email"] always an array? I don't know how to check (can't find it in the docs), but if it is ever a string then this matching logic is dangerous as when e.g. [email protected] is whitelisted, user in [email protected] or [email protected] will both return true, which are pretty easy attacks to pull off.

If it's always a string we can use user_matched = google_username in accepted_users instead.

Tagging @blinky-z as you've probably implemented this solution :)