Google enrolment and login

[mhzawadi]

Hi there,

Thanks for this amazing project, it looks like it will replace my authlia install. But only once I can connect it to Google.

I have it setup and logging me in with a username and password, but I would like to enrol a user from Google and then login with that new user. How do I setup flows and stages for this please?

[BeryJu]

You can follow the docs here to setup google login https://goauthentik.io/docs/integrations/sources/google/index

Make sure to also check https://goauthentik.io/docs/integrations/sources/index to get the button to appear

[Selmaks]

Just replying so other people are aware. I set up google OAuth and set my app to external and added a few email address access for testing. What I found was other gmail users could logon regardless of them being in the allowed list or not.

I found this which describes what I am experiencing https://issuetracker.google.com/issues/211370835?pli=1

[kancelott]

I ended up using a policy and checking the user's email against a whitelist, similar to the example in the docs given for checking for membership in GitHub orgs:

# Ensure flow is only run during oauth logins via Google
if context["source"].provider_type != "google":
    return True

# Whitelisted users
accepted_users = ["email1@gmail.com", "email2@gmail.com"]

# Get the logged in user's Google email
google_username = context["oauth_userinfo"]["email"]

# Match username
user_matched = any(user in google_username for user in accepted_users)
if not user_matched:
    ak_message("You are not allowed to log in. This attempt has been logged.")
return user_matched

[antoniozh]

You can also always change the policy "default-source-enrollment-if-sso" to always return False.
It gets called by the Flow "default-source-enrollment" and if disabled, the prompt for a new username will not come up.

I let my users connect their OAuth providers in the account settings, this way I can ensure that only existing users can register.

[kienzlenator]

Any chance you could detail how you were able to achieve this? I have created the policy and bound it to my defauly-authentication-prompt following the guide for the google integration, but it refuses to work.

Appreciate it.

[antoniozh]

Sure, under Customization -> Policies look up "default-source-enrollment-if-sso" and then I edited the code to look like this:

# This policy ensures that this flow can only be used when the user
# is in a SSO Flow (meaning they come from an external IdP)
# return ak_is_sso_flow
return False

Test it out with an unenrolled Google account, HTH

[LukePWilkins]

Can confirm this works. Thank you @antoniozh.
Nice and clean.