限制访问我的App Engine PHP应用程序以获取一组Google帐户？

Question

Is there a way I can restrict access to my App Engine PHP app for only a certain set of Google account holders (who are logged in at the time of course)? The additional requirement is the PHP scripts on my site will be called via AJAX. It's fine for the users not to see a Google login prompt as they are internal users and will know that they are supposed to be already logged in.

Looking at the PHP app.yaml https://cloud.google.com/appengine/docs/php/config/appref#handlers_login and User auth info https://cloud.google.com/appengine/docs/php/users/#choosing_an_authentication_option I wasn't clear how this could be achieved (apart for Admin roles which are too permissive for these users)

Thanks, Alex

Answer 1

A very crude/simple solution would be implemented like this:

In app.yaml, add something like this

- url: .*
  script: main.php
  login: required

Then in main.php, something like this

$user = \google\appengine\api\users\UserService::getCurrentUser();
if($user) {
    if(in_array($user->getEmail(), ['[e-mail]', '[e-mail]'])) {
        // OK, user is allowed
    } else {
        // Logged in, but UNKNOWN user
    }
} else {
    // User not logged in
}