Login with Google

[Akuyper0]

At some point in the past, I turned the ability for my teachers to use SSO with ChatGPT off.  I have forgotten how to get to the place where I can change that.  Any help would be appreciated! I know how to change it for apps, but it is not the same place. 

Thanks! 

[NielsBrockmeier]

Are you talking about the 3rd party apps?

https://admin.google.com/ac/owl (Security > Access and Data control > API controls)

[Kim_Nilsson]

That's definitely the right place.

[Akuyper0]

It isn't for the apps.  It is just for third party websites.  

[NielsBrockmeier]

3rd party websites with SSO are also part of the API-Controls "apps". It's a bit of a confusing usage of the term "app" but this is how it is used.

If you want to turn off Chat-GPT for example you can restrict signing in by adding "OpenAI" (Web) as Blocked in your configured apps. That way you can't sign in as you have blocked access to the basic information access which is the bare minimum needed to sign in.

[Kim_Nilsson]

Well, since all Edu organisations should (since long) all have switched to Block Everything, most shouldn't have to do anything to stop users from using Login with Google to unsanctioned services.

But those who already have allowed OpenAI and now has changed their mind, you can remove it from your list of Trusted apps. Granted, blocking it, as a first step, is often faster.

The client_id for OpenAI is 799222349882-ne3i0s9jdm5s0p7ll2d7tlsi1vc1halt.apps.googleusercontent.com

Today, the name is actually OpenAI, but in the beginning they called it Universe. Completely useless description.

Removing an app from the Trusted list.

There is no easy click to remove button. Believe me, I have asked for it! 🙂

Instead what you can do is Download list of currently configured apps, adjust the list, and then Bulk update list.

What you do is change the value in column Status to UNCONFIGURED.

When you upload the list again, it'll remove the app from the list of Configured apps, logically. 🙂

You should probably not keep rows of the other apps in the list to upload, else it'll try to change those too.

[Akuyper0]

Thank you so much!  I so appreciate it! 

[Kim_Nilsson]

@Akuyper0 allow this client_id access to the Login with Google service.

OpenAI: 799222349882-ne3i0s9jdm5s0p7ll2d7tlsi1vc1halt.apps.googleusercontent.com

[Kim_Nilsson]

In my admin, the Login with Google service is the only one I haven't set to Restricted here.

This allows me to set a new app/service/extension as Limited (instead of Trusted), which means only Login with Google is allowed.

[DavidMiles]

I'm having a related issue - I have the OpenAI app blocked at the domain level, but Trusted for our teacher OU. However, we can't login or create accounts, and I'm getting this error
Error 400: admin_policy_enforced
Request details: response_type=code redirect_uri=https://auth0.openai.com/login/callback state=pR1qFhKDFKHx97Gn84RxyOGYtQ1nMKfK client_id=799222349882-ne3i0s9jdm5s0p7ll2d7tlsi1vc1halt.apps.googleusercontent.com access_type=online scope=https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile openid

Which should be meaning that I have it blocked. Except it isn't, and Google Help confirmed that.

I've asked for help from OpenAI. However - looking at the discussion above, could a solution be to remove it completely from the list via the download/bulk update method, wait 24 hours, then try requesting and re-authorising it?

[Kim_Nilsson]

"Rebooting" never hurts. 🙂

Also, are you 100% sure that the client_id is the exact same? Many actors create several client_ids for different purposes, and then rarely ever tell us users.

client_id: 799222349882-ne3i0s9jdm5s0p7ll2d7tlsi1vc1halt.apps.googleusercontent.com

In this case, it does seem like OpenAI only uses one service account (client_id).

Also, nobody should need "requesting" anything.

You as the admin just remove the client_id. Everyone will be kicked out (who isn't already). Wait the magic 24 hours. then you as the admin go inte Configured apps and Add app again.

For some extra magic, you could reset all user's sessions, so they will have to go through the entire process again when attempting to connect.