@dan said in Claims to check when using google as an idp for google workspace:
You should start by checking the relevant google documentation.
As of writing, this is what their doc says:
Using the email, email_verified and hd fields, you can determine if Google hosts and is authoritative for an email address. In the cases where Google is authoritative, the user is known to be the legitimate account owner, and you may skip password or other challenge methods.
Cases where Google is authoritative:
email has a @gmail.com suffix, this is a Gmail account.
email_verified is true and hd is set, this is a Google Workspace account.
Users may register for Google Accounts without using Gmail or Google Workspace. When email does not contain a @gmail.com suffix and hd is absent, Google is not authoritative and password or other challenge methods are recommended to verify the user. email_verified can also be true as Google initially verified the user when the Google account was created, however ownership of the third party email account may have since changed.
So in this case, you want to check that hd is set as well as that email_verified is true.
With FusionAuth, you can check this using a reconcile lambda and looking at the id_token:
https://fusionauth.io/docs/extend/code/lambdas/google-reconcile
https://fusionauth.io/docs/extend/code/lambdas/openid-connect-response-reconcile
Thank you from bringing this to light.
