OAuth: Specify allowed email address domains for google or and github oauth logins, Closes #1660

pkg/social/social.go

@@ -2,6 +2,7 @@ package social
 
 import (
 	"encoding/json"
+	"fmt"
 	"strconv"
 	"strings"
 
@@ -23,6 +24,7 @@ type BasicUserInfo struct {
 type SocialConnector interface {
 	Type() int
 	UserInfo(token *oauth2.Token) (*BasicUserInfo, error)
+	IsEmailAllowed(email string) bool
 
 	AuthCodeURL(state string, opts ...oauth2.AuthCodeOption) string
 	Exchange(ctx context.Context, code string) (*oauth2.Token, error)
@@ -42,12 +44,13 @@ func NewOAuthService() {
 	for _, name := range allOauthes {
 		sec := setting.Cfg.Section("auth." + name)
 		info := &setting.OAuthInfo{
-			ClientId:     sec.Key("client_id").String(),
-			ClientSecret: sec.Key("client_secret").String(),
-			Scopes:       sec.Key("scopes").Strings(" "),
-			AuthUrl:      sec.Key("auth_url").String(),
-			TokenUrl:     sec.Key("token_url").String(),
-			Enabled:      sec.Key("enabled").MustBool(),
+			ClientId:       sec.Key("client_id").String(),
+			ClientSecret:   sec.Key("client_secret").String(),
+			Scopes:         sec.Key("scopes").Strings(" "),
+			AuthUrl:        sec.Key("auth_url").String(),
+			TokenUrl:       sec.Key("token_url").String(),
+			Enabled:        sec.Key("enabled").MustBool(),
+			AllowedDomains: sec.Key("allowed_domains").Strings(" "),
 		}
 
 		if !info.Enabled {
@@ -69,25 +72,44 @@ func NewOAuthService() {
 		// GitHub.
 		if name == "github" {
 			setting.OAuthService.GitHub = true
-			SocialMap["github"] = &SocialGithub{Config: &config}
+			SocialMap["github"] = &SocialGithub{Config: &config, allowedDomains: info.AllowedDomains}
 		}
 
 		// Google.
 		if name == "google" {
 			setting.OAuthService.Google = true
-			SocialMap["google"] = &SocialGoogle{Config: &config}
+			SocialMap["google"] = &SocialGoogle{Config: &config, allowedDomains: info.AllowedDomains}
 		}
 	}
 }
 
+func isEmailAllowed(email string, allowedDomains []string) bool {
+	if len(allowedDomains) == 0 {
+		return true
+	}
+
+	valid := false
+	for _, domain := range allowedDomains {
+		emailSuffix := fmt.Sprintf("@%s", domain)
+		valid = valid || strings.HasSuffix(email, emailSuffix)
+	}
+
+	return valid
+}
+
 type SocialGithub struct {
 	*oauth2.Config
+	allowedDomains []string
 }
 
 func (s *SocialGithub) Type() int {
 	return int(models.GITHUB)
 }
 
+func (s *SocialGithub) IsEmailAllowed(email string) bool {
+	return isEmailAllowed(email, s.allowedDomains)
+}
+
 func (s *SocialGithub) UserInfo(token *oauth2.Token) (*BasicUserInfo, error) {
 	var data struct {
 		Id    int    `json:"id"`
@@ -124,12 +146,17 @@ func (s *SocialGithub) UserInfo(token *oauth2.Token) (*BasicUserInfo, error) {
 
 type SocialGoogle struct {
 	*oauth2.Config
+	allowedDomains []string
 }
 
 func (s *SocialGoogle) Type() int {
 	return int(models.GOOGLE)
 }
 
+func (s *SocialGoogle) IsEmailAllowed(email string) bool {
+	return isEmailAllowed(email, s.allowedDomains)
+}
+
 func (s *SocialGoogle) UserInfo(token *oauth2.Token) (*BasicUserInfo, error) {
 	var data struct {
 		Id    string `json:"id"`