Allow google group members on different domains

Widen / cloudfront-auth

An AWS CloudFront Lambda@Edge function to authenticate requests using Google Apps, Microsoft, Auth0, OKTA, and GitHub login

ISC License

623 stars 148 forks source link

Open dankelleher opened 3 years ago

dankelleher commented 3 years ago

This resolves https://github.com/Widen/cloudfront-auth/issues/52 by making the following two changes:

use the Get Members Google Directory API call instead of hasMembers, which has this bug.
remove the constraint, that the user in the group must be a member of the HOST_DOMAIN. The assumpion is, when using a group for authorization, non-members of the host domain are permitted.