Single Sign-On with Google Apps + App Engine

Question

Is it possible to achieve SSO with the built-in OpenId on App Engine? I've been trying to integrate a Marketplace app and get the user logged in when coming from Google Apps (the admin panel or universal navigation). I failed miserably, then now I found this:

"The one exception to this is applications which do hybrid OpenID/OAuth — whitelisting does not currently work with this approach." (from here)

I assume that I have to implement OpenId using a library instead of using the built-in one to achieve SSO with Google Apps in my app? Or if it is possible with built-in OpenId, is there an example anywhere that shows how to do this?

Answer 1

Later Google posted an article about how to do it in Python:

http://code.google.com/googleapps/marketplace/tutorial_python_gae.html

The summary is:

• You must whitelist your "OpenID realm" (the app domain) in the Marketplace manifest XML.
• The entry point used for the Google's universal navigation must contain the current Google Apps domain.
• The entry point in your app redirects the user passing the Google Apps domain as federated_identity.

For example:

from google.appengine.api import users

# [...]

login_url = users.create_login_url(dest_url='http://my-app.appspot.com/',
                                   _auth_domain=None,
                                   federated_identity=google_apps_domain_name)
self.redirect(login_url)