Question

Has anyone had any experience of using the Google Client API to authorise against their domain by restricting the domain a user can login with?

The titbit that is required appears to be a qs parameter: hd='[Domain name]'

but there’s nothing similar in the OAuth2Parameters parameters object

var oap = new OAuth2Parameters
{
        AccessToken = Current == null ? null : Current.AccessToken,
        RefreshToken = Current == null ? null : Current.RefreshToken,
        ClientId = GoogleClientId,
        ClientSecret = GoogleClientSecret,
        Scope = "https://spreadsheets.google.com/feeds https://docs.google.com/feeds https://www.googleapis.com/auth/userinfo.email",
        RedirectUri = HttpContext.Current.Request.Url.Scheme.Concatenate("://", HttpContext.Current.Request.Url.Authority,                                                                             "/Builder/Authentication/Receive"),
        AccessType = "offline" //ensures a refresh token (tho not currently working),
        *HD = //Hmm if only... :(((*

    };
var authorizationUrl = OAuthUtil.CreateOAuth2AuthorizationUrl(oap);

return Redirect(authorizationUrl);

Answer 1

so,in fact, all we need is to adjust the url thus:

var authorizationUrl = OAuthUtil.CreateOAuth2AuthorizationUrl(oap);
authorizationUrl += "&hd=" + "mydomain.com".UrlEncode();
return Redirect(authorizationUrl);

Hope that helps someone down the line.