Restrict Login Email with Google OAuth2.0 to Specific Domain Name

So I’ve got an answer for you. In the OAuth request you can add hd=example.com and it will restrict authentication to users from that domain (I don’t know if you can do multiple domains). You can find hd parameter documented here

I’m using the Google API libraries from here: http://code.google.com/p/google-api-php-client/wiki/OAuth2 so I had to manually edit the /auth/apiOAuth2.php file to this:

public function createAuthUrl($scope) {
    $params = array(
        'response_type=code',
        'redirect_uri=' . urlencode($this->redirectUri),
        'client_id=' . urlencode($this->clientId),
        'scope=" . urlencode($scope),
        "access_type=" . urlencode($this->accessType),
        "approval_prompt=" . urlencode($this->approvalPrompt),
        "hd=example.com'
    );

    if (isset($this->state)) {
        $params[] = 'state=" . urlencode($this->state);
    }
    $params = implode("&', $params);
    return self::OAUTH2_AUTH_URL . "?$params";
}

I’m still working on this app and found this, which may be the more correct answer to this question. https://developers.google.com/google-apps/profiles/

Leave a Comment