[Multi authentication] restrict domains from which accounts can be created

[crazyserver]

 function email_auth_domain($email) {
        $auth_domain = get_config('auth/googleoauth2', 'auth_domain');
        if (!empty($auth_domain)) {
            $allowed = explode(' ', $auth_domain);
            foreach ($allowed as $allowedpattern) {
                $allowedpattern = trim($allowedpattern);
                if (!$allowedpattern) {
                    continue;
                }
                if (strpos($allowedpattern, '.') === 0) {
                    if (strpos(strrev($email), strrev($allowedpattern)) === 0) {
                        // Subdomains are in a form ".example.com" - matches "[email protected]".
                        return true;
                    }

                } else if (strpos(strrev($email), strrev('@'.$allowedpattern)) === 0) {
                    return true;
                }
            }
            return false;
        }
        return true;
    }

In loginpage_hook:262

if (empty($user)) {
                    //ADD THIS
                    if (!$this->email_auth_domain($useremail)) {
                        throw new moodle_exception('emailonlyallowed', '', '', get_config('auth/googleoauth2', 'auth_domain'));

Also you need to add a parameter auth_domain to the settings form

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

[mouneyrac]

Hi Pau,
thanks for this suggestion.

what is your use case? I understand that you may want to use the global allowemailaddresses for all other authentication and your settings for the oauth2 auth only, however I am interested to know what is your use case. As allowemailaddresses exists already on global level, your use case may be very specific.

My concern is to avoid to add too many features, so I would like to know if it is a potential use case that many people are going to face.

[crazyserver]

The use case is to allow loging in any user with the account already created but do not allow to create new accounts for these domains. This feature only have sense if user with manual accounts can login with Oauth as I suggest in #79.

[rabser]

Patch accepted in the next release