Teleport: Can't sign into Teleport using G Suite via OIDC unless you're a G Suite admin

[webvictim]

What happened: Regular (non-admin) G Suite users cannot sign into Teleport using their accounts when G Suite is configured via OIDC.

What you expected to happen: All users for a given G Suite domain should be able to sign in.

How to reproduce it (as minimally and precisely as possible): Configure G Suite as per instructions in docs.

Teleport OIDC connector:

kind: oidc
metadata:
  name: Google
spec:
  claims_to_roles:
  - claim: groups
    roles:
    - admin
    value: [email protected]
  - claim: groups
    roles:
    - developer
    value: [email protected]
  client_id: 2725xxxx.apps.googleusercontent.com
  client_secret: xxx
  issuer_url: https://accounts.google.com
  redirect_url: https://teleport.example.com:3080/v1/webapi/oidc/callback
  scope:
  - https://www.googleapis.com/auth/admin.directory.group.readonly
  - openid
  - email
version: v2

Error when trying to sign in as a regular user:

{"code":"T1001W","error":"OAuth2 error code=unsupported_response_type, message=bad status code: 403 {\n \"error\": {\n  \"errors\": [\n   {\n    \"domain\": \"global\",\n    \"reason\": \"forbidden\",\n    \"message\": \"Not Authorized to access this resource/api\"\n   }\n  ],\n  \"code\": 403,\n  \"message\": \"Not Authorized to access this resource/api\"\n }\n}\n","event":"user.login","method":"oidc","success":false,"time":"2019-09-27T08:57:09Z","uid":"60b1720a-8d6a-4994-a908-0844346d23d5"}

Environment:

• Teleport version (use teleport version): 4.0.9
• Tsh version (use tsh version): 4.0.9
• OS (e.g. from /etc/os-release): irrelevant

[artkrz]

Whoever works on this, please ping me if you want someone to provide more information this as I reported the issue to @webvictim. It only worked for me when user was super admin.

[alex-kovoy]

Looks like G suite configuration problem. Have you tried googling for this specific error? Not Authorized to access this resource/api

[benarent]

I looked into this today. It look like we need to create a service account as per https://developers.google.com/admin-sdk/reports/v1/guides/delegation

Once you setup account delegation you receive a JSON key, it looks like we'll need to update the OIDC to support this.

[artkrz]

@alex-kovoy Of course I did. As @benarent wrote, you need to switch to service accounts. There is no way to grant additional scopes to OAuth 2.0 client IDs.

[adityachandra-zt]

I Can confirm this issue as well. We can only login as superadmin in gsuite, for regular users we are getting 403 in logs. have tried SAML integration as well, and same outcome

[harshvardhanS]

I faced the same issue, followed all the steps in document to configure OIDC connector to teleport.
But that G-suit authentication is working for group admins only. For regular users we are getting 403 in logs. Its unable to fetch group details for other members of the same group, and throws error: Not Authorized to access this resource/api.

• Refer logs:

{"code":"T1001W","error":"OAuth2 error code=unsupported_response_type, message=bad status code: 403 {\n \"error\": {\n  \"errors\": [\n   {\n    \"domain\": \"global\",\n    \"reason\": \"forbidden\",\n    \"message\": \"Not Authorized to access this resource/api\"\n   }\n  ],\n  \"code\": 403,\n  \"message\": \"Not Authorized to access this resource/api\"\n }\n}\n","event":"user.login","method":"oidc","success":false,"time":"2019-10-17T11:45:31Z","uid":"ff4f422e-f74c-414e-83b6-b05c6e55cd98"}

[benarent]

I've started a spec for this, it's here. Spec: Teleport G Suites Group Support. [Public]

[artkrz]

Hi. Any progress on this?

[webvictim]

3122 has a fix for this - it's currently being reviewed.

[artkrz]

Thanks Gus! Subscribed.

[webvictim]

@artkrz @harshvardhanS @adityachandra-zt https://github.com/gravitational/teleport/pull/3122 has been merged - Teleport v4.1.4 contains the updated G Suite connector implementation.

We're going to update our guide with more specific setup instructions and probably a video too, as the process for domain-wide delegation in G Suite is somewhat convoluted and can be tricky to get right. There are some more specific details in the PR linked above (#3122) about exactly which permissions are needed.

[artkrz]

Thanks. I'll give it a go.