Metabase: Restrict access to Google Group when using Google Auth

[kristian-elder]

The Google login is extremely useful, but sadly we cannot currently use it as we need to restrict access to metabase (containing sensitive information) to a subset of the company employees. It would be great to be able to specify a Google group, and only allow access to those users in that group, or alternatively, to disable new account sign-ups via Google login but still allow existing users to sign in this way.

[camsaul]

Hi @kristian-elder, you can already configure Metabase to only allow sign-in via Google for existing accounts:

If you don't want people without existing accounts to be able to sign up, just don't pick a domain for automatic sign-up (i.e., don't fill out this box):

[kristian-elder]

I didn't realize that this would still allow logins, this is actually very useful. However, restricting access to Google groups would be even better. With this model, I can let people in by temporarily enabling the domain, ask them to log in, and then lock it back down - but with a group I could leave the metabase configuration as is and simply grant them access through the Google admin console.

[purduemike]

Another option here would be to restrict access by Organizational Unit (OU). Gsuite lets you do this for SAML auth.