{"action":"created","issue":{"url":"https://api.github.com/repos/squid808/gShell/issues/27","repository_url":"https://api.github.com/repos/squid808/gShell","labels_url":"https://api.github.com/repos/squid808/gShell/issues/27/labels{/name}","comments_url":"https://api.github.com/repos/squid808/gShell/issues/27/comments","events_url":"https://api.github.com/repos/squid808/gShell/issues/27/events","html_url":"https://github.com/squid808/gShell/issues/27","id":182424982,"number":27,"title":"Domain parameter not working as expected","user":{"login":"squid808","id":7298254,"avatar_url":"https://avatars.githubusercontent.com/u/7298254?v=3","gravatar_id":"","url":"https://api.github.com/users/squid808","html_url":"https://github.com/squid808","followers_url":"https://api.github.com/users/squid808/followers","following_url":"https://api.github.com/users/squid808/following{/other_user}","gists_url":"https://api.github.com/users/squid808/gists{/gist_id}","starred_url":"https://api.github.com/users/squid808/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/squid808/subscriptions","organizations_url":"https://api.github.com/users/squid808/orgs","repos_url":"https://api.github.com/users/squid808/repos","events_url":"https://api.github.com/users/squid808/events{/privacy}","received_events_url":"https://api.github.com/users/squid808/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/squid808/gShell/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":{"login":"squid808","id":7298254,"avatar_url":"https://avatars.githubusercontent.com/u/7298254?v=3","gravatar_id":"","url":"https://api.github.com/users/squid808","html_url":"https://github.com/squid808","followers_url":"https://api.github.com/users/squid808/followers","following_url":"https://api.github.com/users/squid808/following{/other_user}","gists_url":"https://api.github.com/users/squid808/gists{/gist_id}","starred_url":"https://api.github.com/users/squid808/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/squid808/subscriptions","organizations_url":"https://api.github.com/users/squid808/orgs","repos_url":"https://api.github.com/users/squid808/repos","events_url":"https://api.github.com/users/squid808/events{/privacy}","received_events_url":"https://api.github.com/users/squid808/received_events","type":"User","site_admin":false},"assignees":[{"login":"squid808","id":7298254,"avatar_url":"https://avatars.githubusercontent.com/u/7298254?v=3","gravatar_id":"","url":"https://api.github.com/users/squid808","html_url":"https://github.com/squid808","followers_url":"https://api.github.com/users/squid808/followers","following_url":"https://api.github.com/users/squid808/following{/other_user}","gists_url":"https://api.github.com/users/squid808/gists{/gist_id}","starred_url":"https://api.github.com/users/squid808/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/squid808/subscriptions","organizations_url":"https://api.github.com/users/squid808/orgs","repos_url":"https://api.github.com/users/squid808/repos","events_url":"https://api.github.com/users/squid808/events{/privacy}","received_events_url":"https://api.github.com/users/squid808/received_events","type":"User","site_admin":false}],"milestone":null,"comments":5,"created_at":"2016-10-12T03:13:07Z","updated_at":"2016-10-13T15:21:14Z","closed_at":null,"body":"Quoted from [here](https://github.com/squid808/gShell/issues/22#issuecomment-252976617) and split out to keep topics separate:\r\n> Here is a list of things that do and don't work. \r\n> user.name1 primary email is domain1.com(primary) user.name2 primary email is domain2.com(secondary) \r\n> user.name3 primary email is domain2.com(secondary) with an alias for domain1.com(primary)\r\n> Just for fun I made a user.name4 example, with primary email as domain3.com(tertiary), and alias of domain2.com\r\n> using admin.user@domain1.com for authentication. domain1.com is set as default in oauth.\r\n> \r\n> `Get-GAUser user.name1` - Works\r\n> `Get-GAUser user.name1@domain1.com` - Works\r\n> `Get-GAUser user.name1 domain1.com` - Works\r\n> `Get-GAUser user.name1 -Domain domain1.com` - Works\r\n> \r\n> `Get-GAUser user.name2` - 404 not found\r\n> `Get-GAUser user.name2 domain2.com` - 404 not found (I expected this to request permission, but it didn't.)\r\n> `Get-GAUser user.name2@domain2.com` - Works completely normally.\r\n> `Get-GAUser user.name2 -Domain domain2.com` - Requests permission, Permission is given, 404 not found AND oauth not updated with new domain. I'm wondering if since I am trying to authenticate with the same account gshell doesn't create a new domain oauth for it. I then have to run authentication every single time I use one of the -domain options. \r\n> \r\n> `Get-GAUser user.name3` - Works\r\n> `Get-GAUser user.name3@domain1.com` - Works\r\n> `Get-GAUser user.name3@domain2.com` - Works\r\n> `Get-GAUser user.name3 domain2.com` - Works\r\n> `Get-GAUser user.name3 domain1.com` - Works\r\n> `Get-GAUser user.name3 -Domain domain1.com` - Works\r\n> `Get-GAUser user.name3 -Domain domain2.com` - Requests permission, Permission is given, works but oauth not updated.\r\n> \r\n> `Get-GAUser user.name4` - 404 not found, everything is the same for this user as user.name2 except that user.name4@domain2.com and user.name@domain3.com both work. \r\n> \r\n> ____________________________________________________________________\r\n> \r\n> I don't really understand why this is happening. From all that testing I assumed the second parameter used as `mydomain.com` in your code example is only used to concatenate with the user provided in the first parameter(vs using it as the -domain switch as I thought before). I find this super weird, because it means that if you wanted to go into another primary GApps domain, it would look like: `Get-GAUser domain2.com -domain domain2.com`, which doesn't actually save any writing compared to using @domain2.com. BUT, if all it did was concatenate then why does `user.name2@domain2.com` work and `user.name2 domain2` doesn't? :confused:"},"comment":{"url":"https://api.github.com/repos/squid808/gShell/issues/comments/253545668","html_url":"https://github.com/squid808/gShell/issues/27#issuecomment-253545668","issue_url":"https://api.github.com/repos/squid808/gShell/issues/27","id":253545668,"user":{"login":"Allieway","id":20910163,"avatar_url":"https://avatars.githubusercontent.com/u/20910163?v=3","gravatar_id":"","url":"https://api.github.com/users/Allieway","html_url":"https://github.com/Allieway","followers_url":"https://api.github.com/users/Allieway/followers","following_url":"https://api.github.com/users/Allieway/following{/other_user}","gists_url":"https://api.github.com/users/Allieway/gists{/gist_id}","starred_url":"https://api.github.com/users/Allieway/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Allieway/subscriptions","organizations_url":"https://api.github.com/users/Allieway/orgs","repos_url":"https://api.github.com/users/Allieway/repos","events_url":"https://api.github.com/users/Allieway/events{/privacy}","received_events_url":"https://api.github.com/users/Allieway/received_events","type":"User","site_admin":false},"created_at":"2016-10-13T15:21:13Z","updated_at":"2016-10-13T15:21:13Z","body":"In response to your first section:\r\n\r\n1) Same exact thing that happens now. They would authenticate for the first time, gshell would fill out domain as normal in oauth, then fetch the user.  Yes it gives secondary domain, yep gshell works fine after that. Since you stated before that the oauth domain organization is just what gShell uses, and the secondary domain user is an admin of the primary domain. There is only one domain, 1 thing to authenticate to. As I said previously google does not differentiate between them AT ALL. The use case for having a secondary domain built into gshell would be if a super administrator is part of that secondary and not primary, or if you have multiple users under different secondary domains, and would like to authenticate with different ones depending on which domain is called. It's fundamentally the same as the current setup, just handles service accounts better, and would work well with my proposed scenario of authentication in the second section.\r\n\r\n2) Everything is under the umbrella of the primary, and every secondary user has access to everything a primary user has(see 4 for the only exception I know of), and every change made in the interface is made to the only domain that exists, primary. Basically: One service account for one domain.\r\n\r\n3) This was mainly for keeping in mind 3 things. 1. Service accounts do not need to be authenticated differently for secondary domains, so I wanted to lump secondary domains in with the primary domain, as a way to keep the service account linked. 2. Since you wanted to keep the option for gShell to choose authentication based on domain and not just per user, I wanted to have the option to set a default user per secondary domain, in the off chance someone would prefer to use a different account when the secondary domain is called. 3. If we were to do automatic authentication based on the full user email provided, this would be the best way to automatically always choose the correct authentication. It would automatically choose the correct service account, or user, and allow the gShell user to set precise per domain users. \r\n\r\n4) As I said previously, just trying to get every use case possible and handle it automatically for ease of scripting. \r\nDuring my thoughts I had this idea:\r\n\r\nYou can restrict permissions by organization, which is different than Domain. This could technically be used to separate permissions by domain, giving a user admin permission to only the organizations that happen to have certain domains for example. So I could have 1 primary domain in gshell, with 3 different users each having 3 organizations of permissions, and setting them as default users for the respective domains. \r\n\r\nAnother would be a gshell user simply wanting to use a different account for different users called. Maybe they aren't using a service account, but have accounts with delegation over others. When a specific secondary domain is called, they would want the default user that has delegation over those users to be used. \r\n\r\nIf I end up writing 2,000 lines of a gshell script, and end up having a change in the way administration works, I would need to rewrite alot of my code. With all the setup being done in the authentication with default users, Someone should be able to make simple adjustments in the config and not have to modify scripts at all. This obviously was based off of tying into the second section with full email authentication tied in. \r\n\r\n___\r\n\r\nGotcha. That makes a lot of sense.\r\n\r\nRechecking authentication at the same time as `GetFullEmailAddress` would cause issues with gShell checking scopes, asking the user to update scopes, then changing who the cmdlet is authenticating with and possibly running into the same issue again.  Then as you said you have to add on situations like groupname and member. Hmm, alright. Seems rather reasonable to not go through the hassle then. \r\n\r\n___\r\n\r\n> If you can find an elegant way out of that which wouldn't involve me touching and customizing all of the affected Cmdlets, I'm open to suggestions!\r\n\r\nI think this is the basis behind all of the recommendations that are affected by `BeginProcessing`. I didn't realize that is the way it worked, thus increasing the amount of work it would be to incorporate. \r\n\r\nI still vote for changing of the `Domain` to include authenticating by email address/user name. I believe that would solve almost all issues I wanted to anyway. The only leftover thing would be service accounts, and if they are tied to a user or a domain, and how they are called in a multi user environment. "}}
{"actor":{"display_login":"Allieway"}}