Force 'Sign in with Google' for specific domain

Feedback and Requests
1

As a Metabase Pro subscriber, I'd like to force Google Sign-in or LDAP, for people using my company's domain.

We have external users with restricted permissions so we can't take the SAML + disable pw auth route.

2

Hi @asselinpaul
If the users was auto-created during first sign-in, then the user is only able to login via their Google Auth.
Otherwise you need to edit the application database table core_user.google_auth=true

3

Thanks @flamber
Do you know if its possible to access the application db when using Metabase Pro Cloud?

4

@asselinpaul It is not possible to access the application database on Metabase Cloud. It would require involvement of support to write the queries, which would then be executed on your encrypted database.

5

Got it, would require running once a month to set for team members from a particular domain.
Happy to sit on this for a bit, would love if you could get this into your feature requests if you deem it appropriate.

Alternatively, would be happy with forced SSO for users from a particular domain.

6

Appreciate your help!

7

@asselinpaul When a user is initially created via Google Sign-in, then you cannot use password logins, so no need to run anything monthly.
For reference: https://github.com/metabase/metabase/issues/11322

We have been looking at adding which auth options a user should be able to use - so it is controllable per-user. It is more complex than it sounds and requires a larger refactoring of our code, but it would also allow something like this:
https://github.com/metabase/metabase/issues/18554