G-Suite Groups with users outside domain unable to be authorized about oauth2-proxy HOT 6 CLOSED

I believe this is a limitation on the Google API.

The way this works is by using a Google service account within your GSuite. You give this service account two permissions, one to read the group's within your organisation and one to read the users within your org.

The problem here is that the service account doesn't have permission to read users outside of your org and throws this error.

If I remember correctly the reason we have to look up users is to find their ID as when you retrieve a Group, it doesn't contain user emails but rather the user IDs as members.

If I'm wrong on that (or things have changed) then we may be able to rewrite the group checking mechanism in providers/google.go and fix this issue.

Will need some digging into the Google Admin API documentation!

from oauth2-proxy.

Hi Joel,

I tried out the the idea of the API being the limiting factor, so I checked the group membership using GAM with the print group-members. It did return all users in the group, even those with an @gmail.com address.

My knowledge with using the API is rather limited, but I think we just need oauth2_proxy to use a different request with a different API scope.

from oauth2-proxy.

Ok that sounds like good news to me, we may be able to fix this!

Do you happen to have an example of the API request you made and a maybe even a sample response? Might help us to find the right implementation from the SDK

from oauth2-proxy.

I can't find exactly which API call GAM uses when doing the "gam print group-members" command, but I think it might be using this one.

It looks like they also have this one, that returns a true/false if the user is a member of the group. This may be an easier one to implement.

from oauth2-proxy.

@KSchmeeds hasMember seems not working for outside of the domain but get is working. See:

https://developers.google.com/admin-sdk/directory/v1/reference/members/get?apix=true

from oauth2-proxy.

This issue has been inactive for 60 days. If the issue is still relevant please comment to re-activate the issue. If no action is taken within 7 days, the issue will be marked closed.

from oauth2-proxy.