Require to be in a group Google SSO

[tkd4444]

Dear community,

How can I specify in httpd config that only a user which is in a specific group can login ? I tried: Require claim "group:<group_name>" but that doesn't seem to work. Does google supports this kind of claim ?

Thanks a lot for you advise and help !

[zandbelt]

if you refer to "Google Groups" information, that would not be available to mod_auth_openidc because it is not returned from the user info endpoint; someone came up with https://github.com/RTBHOUSE/google_groups_auth to get around this with a rewrite map and a fancy script

[tkd4444]

Hey @zandbelt thanks for sharing this.
I also found this, do you think this would work as a feasable approach ? https://github.com/OpenIDC/mod_auth_openidc/wiki/Authorization#2-mod_authnz_ldap Thanks !

[zandbelt]

sure, but it expects your groups to be in local ldap rather than Google.

[tkd4444]

hmm.. I encountered one problem, basically it's trying to compare:

[authnz_ldap:debug] [pid 123:tid 123] mod_authnz_ldap.c(960): [client 111.111.111.111:0] AH01719: auth_ldap authorize: require group "cn=group1,ou=Groups,dc=example,dc=com": didn't match with attr member [Comparison complete][2 - Protocol error]

As it seems google doesn't support the "Compare" action as per they documentation:

https://apps.google.com/supportwidget/articlehome?hl=en&article_url=https%3A%2F%2Fsupport.google.com%2Fa%2Fanswer%2F9167101%3Fhl%3Den&assistant_id=generic-unu&product_context=9167101&product_name=UnuFlow&trigger_context=a

Any ideas ?