Google OpenId: Accept only users of a particular company - asp.net-mvc-3

Question

I am trying to use open id in my application and I have done it successfully with DotNetOpenId.
Now, Google provides service for email and others under the domain of the companies. (Like example#acompany.com). Is there a way to narrow down the authentication to users of a company only?
I know I can do it simply by checking the email address from the response. But I do not think this is a good idea. Its better if the user is NOT authenticated by Google accounts other than that of acompany.com.
Please note that I DONOT know the inside logic of Open Authentication or DotNetOpenId.
Edit
By default Google's openId request prompts https://accounts.google.com/ServiceLogin?...
I can manually change it (in the browser) to https://accounts.google.com/a/iit.du.ac.bd/ServiceLogin?... and it works (iit.du.ac.bd is my school's domain)
I have tried to create request with
Identifier id1 = Identifier.Parse("https://www.google.com/a/iit.du.ac.bd");
Identifier id2= Identifier.Parse("https://www.google.com/a/iit.du.ac.bd/accounts/o8/id");
var openid = new OpenIdRelyingParty();
IAuthenticationRequest request1 = openid.CreateRequest(id1);
IAuthenticationRequest request2 = openid.CreateRequest(id2);
Google's identifier is https://www.google.com/accounts/o8/id"
Edit2
Just found google-apps-openid-url

Answer 1

Your hesitation on using email addresses as your filter is absolutely correct. Follow you instinct. :)
You should filter on OP Endpoint. This will not only assure you that Google is the Provider, but Google has a dedicated OP Endpoint for each individual domain, so you can check that.
IAuthenticationResponse response = relyingParty.GetResponse();
if (response != null) {
if (response.Provider.Uri.AbsoluteUri == "http://google.com/o8/....?domain=yourcompany.com") {
// Allow it
} else {
// Disallow it
}
}
Something like that. You'll have to test to see what the actual URI is for the case you're expecting.

Answer 2

To verify the users email address you would have to ask for it as some point. Either ask before authentication or in the DotNetOpenId request. If you're just going to allow #abcInc.com address and not anyone else I really don't see the justification for using openId at all. You're better of with the default .net membership provider.
Edit: adding the openId code behind
[AllowAnonymous]
[HttpPost]
public ActionResult openIdLogin(FormCollection collection)
{
var openid = new OpenIdRelyingParty();
IAuthenticationRequest aRequest = openid.CreateRequest(Identifier.Parse(collection["openid_identifier"]));
string ReturnUrl = Request.Form["ReturnUrl"];
if (!String.IsNullOrEmpty(ReturnUrl)) {
aRequest.AddCallbackArguments("ReturnUrl", ReturnUrl);
}
var fetch = new FetchRequest();
fetch.Attributes.AddRequired(WellKnownAttributes.Contact.Email);
aRequest.AddExtension(fetch);
return aRequest.RedirectingResponse.AsActionResult();
}
[AllowAnonymous]
public ActionResult openIdLogin(string ReturnUrl)
{
if (ReturnUrl == null) ReturnUrl = "";
var openid = new OpenIdRelyingParty();
IAuthenticationResponse response = openid.GetResponse();
if (response != null)
{
switch (response.Status)
{
case AuthenticationStatus.Authenticated:
ClaimsResponse sreg = response.GetExtension<ClaimsResponse>();
if (sreg != null)
{
sreg.Email; //do something with the email address
}
//codez
break;
case AuthenticationStatus.Canceled:
ModelState.AddModelError("loginIdentifier", "Login was cancelled at the provider");
break;
case AuthenticationStatus.Failed:
ModelState.AddModelError("loginIdentifier", "Login failed using the provided OpenID identifier");
break;
}
}
return View();
}