Question

Problem:

My organisation, ExampleFooBar, uses Google Apps. On our website I want
to enable OpenID Single Sign-In (like StackOverflow), but only allow
@examplefoobar.com email addresses to sign in. What OpenID url should I
use for a Google Apps email address?

• As per comments on Include OpenId in drupal, the domain http://www.google.com/profiles/<username> can be used for normal Google accounts, but this doesn’t work for Google Apps accounts.

• Google also provides the url https://www.google.com/accounts/o8/id but using that would allow any google user who found our website’s login page to sign in, as the sign-in page accepts any google account name.

What Google URL can I use to ensure only @examplefoobar.com email addresses can sign in?

Google documentation for Google Apps OpenID is at http://code.google.com/googleapps/domain/sso/openid_reference_implementation.html, but is incredibly unhelpful.

Answer 1

By aaronsnoswell:

The OpenID url google.com/accounts/o8/site-xrds?hd=examplefoobar.com will restrict email entries to @examplefoobar.com. Additionally, I had to enable OpenID Single Sign in from the Google Apps administrator page. Hope this helps someone!

http://jeremiahlee.com/blog/2009/09/28/how-to-setup-openid-with-google-apps/

Google Apps (for business) OpenID login for ASP.NET intranet site