This repository was archived by the owner on Sep 17, 2021. It is now read-only.
Google SSO fixes + limiting to hosted domain #412
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
When trying to make SSO work for Google Apps For Work, I faced the following error message: Error: invalid_request Invalid response_type: authorization_code Learn more That’s all we know. The only way I made it work was to change a few parameters: responseType, scope. I also hade to modify the url_for() call as my securitymonkey install is behind a SSL proxy. There are certainly better ways to make it work but I'm not a Flask expert and could not find a way to have it create the proper urls.
In order to limit Google SSO to specific Hosted Domains, we introduce a new configuration setting (optional): GOOGLE_HOSTED_DOMAIN If GOOGLE_HOSTED_DOMAIN is not set, nothing happens. If GOOGLE_HOSTED_DOMAIN is set in the config file, its value is used as the parameter 'hd' in calls to Google SSO authentication request (to GOOGLE_AUTH_ENDPOINT), and the returned ID token will also be verified to conform to this Hosted Domain. That way you can limit login only to users of your organisation.
Contributor
|
Awesome. Thanks @llange. |
Merged
kyleberry
pushed a commit
to kyleberry/security_monkey
that referenced
this pull request
Sep 21, 2016
* Make SSO work for Google Apps For Work When trying to make SSO work for Google Apps For Work, I faced the following error message: Error: invalid_request Invalid response_type: authorization_code Learn more That’s all we know. The only way I made it work was to change a few parameters: responseType, scope. I also hade to modify the url_for() call as my securitymonkey install is behind a SSL proxy. There are certainly better ways to make it work but I'm not a Flask expert and could not find a way to have it create the proper urls. * Limit Google SSO to specific domain In order to limit Google SSO to specific Hosted Domains, we introduce a new configuration setting (optional): GOOGLE_HOSTED_DOMAIN If GOOGLE_HOSTED_DOMAIN is not set, nothing happens. If GOOGLE_HOSTED_DOMAIN is set in the config file, its value is used as the parameter 'hd' in calls to Google SSO authentication request (to GOOGLE_AUTH_ENDPOINT), and the returned ID token will also be verified to conform to this Hosted Domain. That way you can limit login only to users of your organisation. * Fixing a copy/paste typo
Contributor
|
Commenting here since this pertains to the Google SSO changes. When implementing Google SSO, I was receiving a 500 error after the successful authentication response was being posted to SecurityMonkey. After adding a debugging statement after the profile retrieval (sso/views.py:212) I saw an error message from the Google API stating that the Google+ API had not been enabled for the project. To get Google SSO working in SM, you need to enable the Google+ API for your project. See here: https://console.developers.google.com/apis/api/plus-json.googleapis.com/overview? |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I couldn't make Google SSO work (on Google Apps For Work) without a few modifications that were done according to the public documentation on Google's OpenId Connect : https://developers.google.com/identity/protocols/OpenIDConnect
Tests were made using
GOOGLE_AUTH_ENDPOINT = 'https://accounts.google.com/o/oauth2/v2/auth'
I did not test it against any other Google SSO.
In addition I added the ability to limit to specific hosted domain - which is useful if you're using Google Apps For Work on your domain and want to limit access to the only users of your domain.
There is a new configuration option for that:
GOOGLE_HOSTED_DOMAIN = 'mydomain.org'