Smoothwall - G Suite allow sign-in to our domain only

[3s-gtech]

I have a difficult little conundrum here, and I'm not sure if it's possible to unpick it.

 

I want to be able to restrict sign-in to Google accounts to our own domain only (which actually signs in via Azure, but that shouldn't matter). For Smoothwall, that means apply a content modification - X-GoogApps-Allowed-Domains:domain.tld and applying to everyone, everywhere, everything. Easy enough.

 

To get our Chromebooks to work properly, I've whitelisted Connect for Chromebooks (do not inspect). However, when I temporarily disabled this policy the content mod still didn't work...

 

I'm guessing some filtering duality is stopping the content mod from working, as users can still sign in with personal Google accounts.

 

Anyone got any bright ideas?

 

accounts.google.com shows in these policies:

 

Connect for Chromebooks

Custom blocked content (obviously overriden)

Student Blocked URLs (overriden too)

[Primus]

Depending on the devices you're using you can use Group Policy and the Google Admin console (assuming the Chromebooks are managed).

 

I know this wouldn't work on BYOD etc but it might do what you want quicker and easier?

[3s-gtech]

It works okay on our Chromebooks. Not sure how I can use GP with it though, as we use Edge rather than Chrome and I don't think there is a GP setting for it (though could be a reg hack?) and I think it requires the user to be signed in

 

Yeah, BYOD doesn't go through our Smoothwall so not worried about that.

 

Edit: weird. I've put in a Decrypt and inspect policy for the various Google services as a test, and disabled the don not inspect, and it still gets through...it's as if the content mod doesn't work.

Edited September 30, 2021 by 3s-gtech