Pull Request Template

⚠️ Documentation Updates Notice:

Kindly note that documentation updates are managed in this repository: librechat.ai https://github.com/LibreChat-AI/librechat.ai/pull/159

Summary

https://github.com/danny-avila/LibreChat/discussions/1746 When google login is configured for a workspace account the feature permits to restricts logins to members of a group.

Change Type

Please delete any irrelevant options.

[x] New feature (non-breaking change which adds functionality)
[x] This change requires a documentation update

Testing

If the GOOGLE_WORKSPACE_GROUP is not defined in the .env,or if it's empty, nothing changes: all members of the workspace account can login and no extra scopes are required in the oauth2 consent screen.
When GOOGLE_WORKSPACE_GROUP is set:
- all oauth2 consent screen require the extra 'https://www.googleapis.com/auth/cloud-identity.groups.readonly' scope permission aka: "See any Cloud Identity Groups that you can access, including group members and their emails"
- at login, if the user:
- is allowed to list the members of the configured group
- is member of the configured group
  - access is granted normally
- else
  - access is refused and user is redirected to the login page at the end of oauth process

Test Configuration:

The feature works with google workspaces accounts. A group must be created in the workspace account and member of the group must be allowed to see the members of the group. The email address of the group has to be configured in the .env as GOOGLE_WORKSPACE_GROUP= Note that the group can contain other groups and all member of the included groups will also be allowed.

Checklist