How to know if a google account is under a google

问题:

I am working on an app that allows user to share their Drive files to friends. But there is a problem of Google App Account, like [e-mail], of which files cannot be shared with people who are not under that domain. Although the share policy can be changed by admin of somedomain.com, but I prefer not allowing people use my app with Google Apps Account.

I also check this post: How to determine if the account is a Google apps account?. But I don't agree with the idea of checking domain to detect account type. Because people can register Google Account with any email address. I just registered one with my Hotmail, [e-mail], which has no domain restriction when sharing a file.

Can anyone help with this? Thanks!

回答1:

Assuming you included:

https://www.googleapis.com/auth/userinfo.email

in your OAuth scopes, you can make a request to:

https://www.googleapis.com/oauth2/v2/userinfo

If it's a Google Apps account, an "hd" parameter (Hosted Domain?) will be returned by the call with the Google Apps domain as it's value. If it's a consumer account, whether it's @gmail.com or even a potential "conflicting account", the hd parameter will not be returned. See my example below. [e-mail] is a Google Apps Account while [e-mail] is a consumer account. If I created a consumer user in the Google Apps domain it wouuld become a conflicting account and the consumer account would be pushed out of the @jay.powerposters.org namespace but that hasn't happened yet.

For [e-mail]:

GET https://www.googleapis.com/oauth2/v2/userinfo

HTTP/1.1 200 OK
Content-length: 99
X-xss-protection: 1; mode=block
...

{
 "email": "[e-mail]",
 "verified_email": true,
 "hd": "jay.powerposters.org"
}

For [e-mail]:

GET https://www.googleapis.com/oauth2/v2/userinfo

HTTP/1.1 200 OK
Content-length: 71
X-xss-protection: 1; mode=block

{
 "email": "[e-mail]",
 "verified_email": true
}

回答2:

I don't think there is a good way to check if an account is a Google Apps account. The only way I'm thinking of is to check the Domain's DNS MX records and see if some service of the domain are served by Google Apps servers (like email served from gmail etc...) but even there you might have to check more than one service because some Google Apps companies deactivate Gmail for instance (or some other service) to use a custom solution instead.

If I were you I would not disable the service to Google Apps accounts (how unfair!! :)) many people bought Google Apps account to have a nice looking email domain and their account behave just like any other Google Accounts...

I would simply try to set the ACL of the fils to public when you need to and if this does not work display them with a nice error message warning them about their Admin having disabled public sharing... It's not going to be lots of users anyways and it would be too bad to have your app not available to others "normal" Google Apps accounts.

回答3:

Or check the domain using a service like BrowserSpy. If the MX records appear correct, then it's using Google Apps.