Block access to consumer / Personal Gmail accounts
Block access to consumer / Personal Gmail accounts
Short answer:
To block access to some Google accounts and services while allowing access to your managed Google accounts (such as G Suite or Cloud Identity), you need a web proxy server that can perform SSL interception and insert HTTP headers.
As an administrator, you may want to prevent users from signing in to Google services using any accounts other than the accounts you provided them with. For example, you may not want them to use their personal Gmail accounts or a managed Google account from another domain.
A common means of blocking access to web services is using a web proxy server to filter traffic directed at particular URLs. This approach won’t work in this case, because legitimate traffic from a user’s managed Google account goes to the same URL as the traffic you want to block.
To only allow users to access Google services using specific Google accounts from your domain, you need the web proxy server to add a header to all traffic directed to google.com; the header identifies the domains whose users can access Google services. Since most traffic through your Google service is encrypted, your proxy server also needs to support SSL interception. (See below for a list of proxy servers known to support both SSL interception and HTTP header insertion.)
To prevent users from signing in to Google services using Google accounts other than those you explicitly specify:
<![if !supportLists]>1. <![endif]>Route all traffic outbound to google.com through your web proxy server(s).
<![if !supportLists]>2. <![endif]>Enable SSL interception on the proxy server.
Since you will be intercepting SSL requests, you will need to configure every client device to trust your SSL proxy by deploying the Internal Root Certificate Authority used by the proxy and marking it as trusted.
Since you will be intercepting SSL requests, you will need to configure every client device to trust your SSL proxy by deploying the Internal Root Certificate Authority used by the proxy and marking it as trusted.
<![if !supportLists]>3. <![endif]>For each google.com request:
a. Intercept the request.
b. Add the HTTP header X-GoogApps-Allowed-Domains, whose value is a comma-separated list with allowed domain name(s). Include the domain you registered with G Suite and any secondary domains you might have added.
For example, to allow users to sign in using accounts ending @altostrat.com and tenorstrat.com, create a header with the name X-GoogApps-Allowed-Domains and this value:
altostrat.com, tenorstrat.com
a. Intercept the request.
b. Add the HTTP header X-GoogApps-Allowed-Domains, whose value is a comma-separated list with allowed domain name(s). Include the domain you registered with G Suite and any secondary domains you might have added.
For example, to allow users to sign in using accounts ending @altostrat.com and tenorstrat.com, create a header with the name X-GoogApps-Allowed-Domains and this value:
altostrat.com, tenorstrat.com
You may also want to create a proxy policy to prevent users from inserting their own headers.
Users attempting to access Google services from an unauthorized account will see a web page describing the unavailable service, the unauthorized account they're using, the domains where the service is unavailable, and a suggestion that they contact a network administrator for more information and sign out of their unauthorized account and sign in with an authorized account.
Note: This approach blocks sign-in access to Google consumer services other than Google Search, but does not necessarily prohibit anonymous access.
Google does not maintain a list of blocked services. If a particular service requires login, access will be blocked. Services which do not require authentication, such as Google Search and YouTube will not be blocked.
Comments