Skip to content

Commit 91eaddc

Browse files
author
Kuntal Loya
committed
Restrict groups with external access to domain
1 parent 02f828c commit 91eaddc

File tree

1 file changed

+132
-0
lines changed

1 file changed

+132
-0
lines changed
Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
# Copyright 2018 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
"""
16+
Updates the access settings of a Group to domain internal.
17+
18+
Access settings include
19+
whoCanViewGroup
20+
whoCanJoin
21+
allowExternalMembers
22+
whoCanPostMessage
23+
whoCanViewMembership
24+
25+
Only the setting which is domain external will be updated. Rest will stay as is.
26+
"""
27+
from __future__ import print_function
28+
import httplib2
29+
30+
from apiclient import discovery, errors
31+
from oauth2client import client, tools
32+
from oauth2client.file import Storage
33+
34+
# If modifying these scopes, delete your previously saved credentials
35+
# at credentials.json
36+
SCOPES = 'https://www.googleapis.com/auth/apps.groups.settings'
37+
38+
# External access for view group
39+
ANYONE_CAN_VIEW_GROUP = 'ANYONE_CAN_VIEW'
40+
41+
# External access for who can join
42+
ANYONE_CAN_JOIN_GROUP = 'ANYONE_CAN_JOIN'
43+
44+
# Group can have external members
45+
EXTERNAL_MEMBERS_CAN_JOIN = 'true'
46+
47+
# External access for who can post messages
48+
ANYONE_CAN_POST_MESSAGE = 'ANYONE_CAN_POST'
49+
50+
# External access for who can view members
51+
ANYONE_CAN_VIEW_MEMBERSHIP = 'ANYONE_CAN_VIEW'
52+
53+
# Domain access for view group
54+
DOMAIN_CAN_VIEW_GROUP = 'ALL_IN_DOMAIN_CAN_VIEW'
55+
56+
# Domain access for who can join
57+
DOMAIN_CAN_JOIN_GROUP = 'ALL_IN_DOMAIN_CAN_JOIN'
58+
59+
# Group cannot have external members
60+
EXTERNAL_MEMBERS_CANNOT_JOIN = 'false'
61+
62+
# Domain access for who can post messages
63+
DOMAIN_CAN_POST_MESSAGE = 'ALL_IN_DOMAIN_CAN_POST'
64+
65+
# Domain access for who can view members
66+
DOMAIN_CAN_VIEW_MEMBERSHIP = 'ALL_IN_DOMAIN_CAN_VIEW'
67+
68+
def get_credentials():
69+
"""
70+
Gets valid user credentials from storage.
71+
72+
If nothing has been stored, or if the stored credentials are invalid,
73+
the OAuth2 flow is completed to obtain the new credentials.
74+
75+
Returns:
76+
Credentials, the obtained credential.
77+
"""
78+
store = Storage('credentials.json')
79+
creds = store.get()
80+
if not creds or creds.invalid:
81+
flow = client.flow_from_clientsecrets('client_secret.json', SCOPES)
82+
creds = tools.run_flow(flow, store)
83+
return creds
84+
85+
def update_group_to_domain(group_settings_service, group_email):
86+
"""
87+
Gets the settings for the given group, and updates the access settings
88+
if any of them were external.
89+
"""
90+
try:
91+
settings = group_settings_service.groups().get(
92+
groupUniqueId=group_email).execute()
93+
who_can_view_group = settings['whoCanViewGroup']
94+
who_can_join = settings['whoCanJoin']
95+
allow_external_members = settings['allowExternalMembers']
96+
who_can_post_message = settings['whoCanPostMessage']
97+
who_can_view_membership = settings['whoCanViewMembership']
98+
updated_settings = {}
99+
if who_can_view_group == ANYONE_CAN_VIEW_GROUP:
100+
updated_settings['whoCanViewGroup'] = DOMAIN_CAN_VIEW_GROUP
101+
if who_can_join == ANYONE_CAN_JOIN_GROUP:
102+
updated_settings['whoCanJoin'] = DOMAIN_CAN_JOIN_GROUP
103+
if allow_external_members == EXTERNAL_MEMBERS_CAN_JOIN:
104+
updated_settings['allowExternalMembers'] = EXTERNAL_MEMBERS_CANNOT_JOIN
105+
if who_can_post_message == ANYONE_CAN_POST_MESSAGE:
106+
updated_settings['whoCanPostMessage'] = DOMAIN_CAN_POST_MESSAGE
107+
if who_can_view_membership == ANYONE_CAN_VIEW_MEMBERSHIP:
108+
updated_settings['whoCanViewMembership'] = DOMAIN_CAN_VIEW_MEMBERSHIP
109+
110+
if bool(updated_settings):
111+
try:
112+
group_settings_service.groups().update(
113+
groupUniqueId=group_email, body=updated_settings).execute()
114+
print('Updated settings of {0} to {1}'.format(
115+
group_email, updated_settings))
116+
except errors.HttpError:
117+
print('Could not update settings')
118+
else:
119+
print('Nothing to update')
120+
except errors.HttpError:
121+
print('Unable to read group: {0}'.format(group_email))
122+
123+
def main():
124+
credentials = get_credentials()
125+
http = credentials.authorize(httplib2.Http())
126+
group_settings_service = discovery.build('groupssettings', 'v1', http=http)
127+
group_email = raw_input('Enter the email address of the Group in your'
128+
'domain, that you want to update: ')
129+
update_group_to_domain(group_settings_service, group_email)
130+
131+
if __name__ == '__main__':
132+
main()

0 commit comments

Comments
 (0)