Restrict Google account logins to a specified Apps domain

Question

How can I let users log in to my web app with their Google account, and verify that they logged in from a certain Google Apps domain?

Does the hd parameter to the Google Authorization service ensure that only the selected domain can be used to login?

Or can I get the logged in user's email and verify that it ends with "@domain.com"? This doesn't seem like such a good idea.

After login I also need to access the users' Google Contacts, which according to the documentation requires AuthSub proxy authentication.

Answer 1

It seems I can use the OpenID+OAuth Hybrid protocol to both identify the user and get an access token to the data APIs, as described in this blog post.

See this question for info about how to get the user's email using OpenID. I guess I can then verify that it ends with the correct domain name.