使用G-Suite帐户登录自定义Web应用

Question

90% of my Google Apps Script/HTMLService web app is available to anonymous users, however user must be signed in with G-Suite account in order to access the remaining 10%.

Desired behavior is that if user is already logged in to G-Suite (eg read Gmail from that browser), the web app recognizes the user without prompting to log in again – as if you went to Google Calendar just after reading Gmail. If user isn't logged in yet – he needs to be prompted to log in using @my_g-suite.com account when accessing the restricted features.

My first try was two app approach: one published as “available to anyone including anonymous” and another “available to members of the my_g-suite.com”. The problem with this approach is that 2nd app only shows log in screen if browser has no google identity. If user is logged in to regular, non-g-suite gmail, strange google Driver error is shown instead of login prompt. I posted question about this a while ago, no solution.

So instead I implemented a sign-in button using this guide . Behavior I'm seeing is not what I expected:

1. If user is already signed in with UserOne@my_g-suite.com prior to accessing the app (eg looked at G-Suite email account), Session.getActiveUser() on server side returns correct user ID, however googleUser.getBasicProfile().getEmail() on client has nothing.
2. If user has not signed in with G-Suite ID using prior to accessing the app and then signs in using the Sign In button on web app, googleUser.getBasicProfile().getEmail() returns correct user ID, however ), Session.getActiveUser() on server side returns nothing.
3. If user has signs in using the button as UserTwo@my_g-suite.com , no other G-Suite app recognizes it. So if user then signs in to UserOne@my_g-suite.com and comes back to the app, Session.getActiveUser() says it's UserOne@my_g-suite.com and googleUser.getBasicProfile().getEmail() says it's UserTwo@my_g-suite.com . Two conflicting identities simultaneously.

How do I make sign-in into my app be 1) seamless with other G-Suite services rather than having completely separate, app-only 2nd identity and 2) restricted to @my_g-suite.com ?

---

Following @TheMaster advice I tried this:

1. Created a Google Sites site "login.my_g-suite.com" which is only available to g-suite users and has a single page which says "you are logged in to g-suite"

2. In my web app which runs as "me" and is "available to everyone, even anonymous", I implemented a check if Session.getActiveUser() is g-suite user. If not, I do window.open("https://login.my_g-suite.com") which opens log-in screen in the new tab as expected.

3. After user logs in, I reload web app. And here's the sad part:

   • If browser hasn't been used for non-G-Suite account (like regular Gmail) - all works great. Session.getActiveUser() shows newly logged in user ID
   • BUT if that browser has been logged in to non-G-Suite account, Session.getActiveUser() has no idea about the fact that I just logged in G-Suite in another tab (even after reloading web app). Which is back to square one.

Comparing this to Google's own apps, this behavior is not much different: eg if you read regular non-g-suite gmail, then go and log in to Google drive using G-Suite account, and then reload gmail - it doesn't take you to G-Suite Gmail automatically just because you logged in to G-Suite account on that browser. You need to explicitly tell Gmail that you want to use G-Suite account by invoking active-account-selection menu (round avatar icon on the right upper corner).

Looks like no matter what approach I take, I hit the same wall: the need to tell stand-alone Google App Script which Google identity is current. And I don't see any way of doing that.

---

What I stated above is no longer true due to recent change by Google. (2) now results in Error 404 instead of login screen.

Sign-in issues which a few days ago were only affecting stand-alone Google App Script apps now are plaguing entire G-Suite. Our volunteer first-responder organization got G-Suite mainly for the secure intranet site (members.my_g-suite.com) where we share internal protocols and documentation. It's built on new Google Sites and Google Team Drive. Before Wednesday attempt to access members.my_g-suite.com used to take to G-Suite login screen. Now it takes them to "404. That's an error. The requested URL / was not found on this server. That's all we know." . The only workaround is to force users to log out of personal Gmail each time before accessing G-Suite, which is not a reasonable request for a volunteer using personal device. We feel like Google pulled the rug from under our feet. The only hope is that this is a temporary change and they'll revert it to how it was in the beginning of the week. We also confirmed that this change is not limited to our G-Suite.

Answer 1

This is because your web-app runs inside a iframe. You can force login by denying access to the web-app manually.

• onload , Check Session.getActiveUser().getEmail() server side and see if it matches your domain,

  • If it does, proceed to load your actual web-app
  • If not, just provide the information that the user needs to login to your gsuite to access.

You can also

• Proceed to open https://admin.google.com (or any url specific to your domain) in a another tab
• See whether it's open and use setInterval to check the other window.close property. When closed, reload your web-app.