11 ms·
Google Credential Provider for Windows
- Techasura 7y agoFascinating to see where Google is headed. Now, there is no need to push for ChromeOS.
- Paraesthetic 7y agoThey can track you right from your OS
- lrpublic 7y agoYes, not unlike Apple and Microsoft but for business users of Google suite, this makes the need to sign up to any Microsoft cloud services less of a necessity. It seems the direction Google, Apple and Microsoft are all heading in is to own authentication and control access to our computers both at work and home. Third party authentication technology has been around on Windows in one form or another for decades, but this is interesting because it's cloud based authentication that doesn't rely on corporate infrastructure. It would be really nice if Google releasing this is a catalyst for an Open Source project doing something similar. Chromebooks, Windows S (and RT before it), notarization of apps on MacOs could be helpful in an Enterprise environment to prevent malware, this is at the expense of freedom of choice. I worry that the PC era is ending and we're drifting towards a future market more like consoles and mainframes where you never really own the platform that you paid for.
- tsimionescu 7y ago> Chromebooks, Windows S (and RT before it), notarization of apps on MacOs could be helpful in an Enterprise environment to prevent malware, this is at the expense of freedom of choice. I think the opposite is true: these are useful in a home environment, for the vast majority of non IT expert users. In the enterprise, there have always been other mechanisms for preventing malware, mainly in the forum of not giving users full admin rights on company laptops, PCs etc. Even as a software engineer, I don't always feel fully knowledgeable on how to run a secure system. I can absolutely assure you that my grandma is not qualified to act as a sysadmin on her own PC. So while I dislike the idea of not having the option of taking full control of your system, I nevertheless think that the vast majority of users are better off not using that option. And when I say vast majority, I don't think it's like 80%,but much closer to 99.9%, including most programmers and enterprise users.
- lrpublic 7y agoI disagree, we don’t have opposing views. I totally agree with you that the secure by default / sandboxes for application approach is useful for consumers and developers too. My point is that when this is wrapped up with a closed software distribution platform (Windows Store / App Store) or with a Surveillance Capitalism business model that relies on monetisation of user data there is a problem for the consumer. The PC accidentally contributed to breaking the control IBM had over the market. Antitrust investigations into IBM and later Microsoft are also key to the freedom we’ve had. The worry is that we’ve forgotten how bad it was and we’re potentially headed for a cartel like control of our computers.
- saagarjha 7y agoThis looks like a small tech demo, which Chrome OS has been adding features to make it suitable for general purpose development use by Google engineers for years now.
- homerhomer 7y agoIs that you Novell?
- heybrendan 7y agoThis is a low quality comment. Can you please explain the comparison to Novell further?
- EGreg 7y agoNice try Novell. Now knock it off
- raesene9 7y agoI'm not OP but I can likely explain. In the late 90's Novell Netware 4 and above had a client package which replaced the Windows login with their own GINA, so users could log in to Windows client machines using their Netware credentials.
- hunta2097 7y agoLet's hope Microsoft can refrain from the same dirty tactics they used back in the nineties. I was a junior sysadmin/desktop support back then. Every single software update for the Microsoft Netware Client (which I think sucked on purpose) always caused problems for the Novell one! It was a real cat and mouse release cycle.
- lrpublic 7y agoIt’s well documented that Microsoft did not behave well in the 90’s https://en.m.wikipedia.org/wiki/Halloween_documents https://en.m.wikipedia.org/wiki/Halloween_documents However in the case of the Windows NT NetWare client I don’t think this happened. I think one of the variations on Hanlons razor is a more likely explanation. “You have attributed conditions to villainy that simply result from stupidity” The really worrying thing is that all the major players seem to have the same strategy at the moment. That is to own and control the platform.
- bravoetch 7y agoFrom their install guide... To help ensure unauthorized access to the device, you need to configure a registry key to restrict device sign-ins to accounts in specific domains.
- DCoder 7y agoThe guide also says you need to close Event Viewer before installing. I'm not sure I want to know why.
- tapland 7y ago"You don't want to look at this, trust me"
- londons_explore 7y agoThe login provider can emit event log entries which say who logged in and when, and reasons for login failure etc. Those entries aren't plain text - they are protobufs decoded by a google-provided dll file. If event viewer is open, it won't load that dll, and it will fail to render any event log entries for logins until it is restarted.
- DCoder 7y agoOh, that makes sense, thanks.
- statictype 7y agoI didn’t even know you could write custom decoders for event viewer. Is that a thing people do?
- deleted 7y ago[deleted]
- WorldMaker 7y agoA previous debugging hole I fell into once accidentally and barely managed to escape left me with the impression that every event has a "custom" decoder associated; there's no "built-in" event types from the Event Viewer's perspective. There are a handful of very common "custom decoders" that when they break it is an interesting world of madness. In the case of my debugging, one of the decoders installed by the .NET Framework (and used by almost all apps that use the main .NET Event Log libraries) broke and needed repair. It seems like there is a bunch of power in building custom decoders, but I never want to try debugging one again.
- galkk 7y agoGod, this screenshot look ugly Almost like in "looks photoshopped" meme
- sahaskatta 7y agoI just tried configuring this on a new Windows 10 laptop (Dell XPS 13). I'm by no means an IT expert, but it seems painful to get working. I had to first setup a local Windows account. Then install Google's GCPW software. After that, I had to make changes in the Registery Editor -- a place I haven't had to visit in many years. I then had to logout of the local account and then select "Add work account" from the Windows 10 lock screen to login with a Google Account. I setup Windows Hello fingerprint login, however it doesn't seem to allow signing in with this method meaning I need to use a password everytime! The whole setup process is just too outdated. Does anyone know how to automate all of this? Meanwhile on Chrome OS, I can just hand a device to someone and they can login with their G Suite account in 30 seconds. No configuration needed.
- dasloop 7y agoUse a MDM solution to enroll the device with all the settings on it.
- izacus 7y ago> The whole setup process is just too outdated. Does anyone know how to automate all of this? The usual way is to use the Windows unattended installation tools to create an image which has everything included - I'm assuming this is how this is supposed to be used. IT in your organization just puts a prepared image on your computer. That imshr will automatically have everything you need installed including this plugin and its registry changes. I've scrolled down the install guide and there seems to be also a PS script that sets up the registry keys for you so you can probably do remote unattended install as well.
- Already__Taken 7y agoYeh that's for IT to roll out for you with MDT, group policy, Azure or a myriad of other MDM solutions. It's not an end user product. Missing windows hello, so I presume other smart logins like cards is going to make this a non-starter for a lot of orgs.
- deleted 7y ago[deleted]
- deleted 7y ago
- voz_ 7y agoComment was not clear, edited: This site was failing to render correctly for me on Chrome for OSX.
- Paraesthetic 7y ago'Photoshopped badly by Google'
- Edward9 7y agoThis feels like it's in pre-alpha. It's a pain to configure it
- snazz 7y agoIt’s meant to be configured once and then shipped as a disk image that gets installed on client devices.
- cm2187 7y agoAnd what happens if Google arbitrarily suspends your account?
- wtallis 7y agoIs that a problem with G Suite? I think all such cases I've heard of have been with the free personal accounts offered to the general public, not the corporate product. And if random account suspension is something that happens to G Suite accounts, I think the answer is that your IT department's G Suite admins can click the button to un-suspend your account.
- pjc50 7y agoThere was an incident reported on HN where the entire gsuite account got suspended without warning..
- izacus 7y agoHuh, can you link to the post?
- SenpaiSilver 7y agoWas it ever proven to be true/fake? This is the one I think: https://news.ycombinator.com/item?id=17115643 https://news.ycombinator.com/item?id=17115643
- londons_explore 7y agoIf the gmail address linked as the recovery address for the first gsuite admin on a domain is suspended for a T&C violation, then the whole gsuite domain will be suspended too automatically. Its a good reason to never link a gmail address as a recovery address for gsuite - always use another free mail provider.
- SenpaiSilver 7y agoWould normal users personnal accounts be suspended if set as recovery for their normal work GSuite account if the GSuite admin is suspended? I personally never link or login with my personnal accounts on work devices, nor do I use work accounts on personal devices.
- malkia 7y agogaia was the name of the internal google services for accounts...
- londons_explore 7y agoThe lack of effort here seems like such a strategic mistake for Google... For this to work, it has to be single click, it has to be slick, it has to 'just work', it has to integrate with otp's, security keys, SMS 2 factor, etc. It should be for both work accounts and home accounts, and Google should have come up with a strategic set of default options. Those options should have included "just log me in with a low privilege account which can browse the web like chromeOS, but still syncs everything like chromeOS". I put the failure of realising this vision mostly due to lack of inter-department communication within Google. This is a direct (yet years late) response to active directory logins for GSuite, when it should additionally have been shipped for home users and marketed as a "do anything from anywhere any time" thing.
- pjc50 7y agoHow much of that is actually possible within the windows third-party authentication framework?
- londons_explore 7y agoThe authentication provider runs as a highly trusted account, it can do anything it likes. The only tricky bit would be not opening massive security holes. After all, a regular windows box you can't do anything at all with without a password. With my proposed solution, you'd be able to log in and browse the web with just any old random gmail password. Thats a massive increase in attack surface - now any buggy printer driver or router web interface is suddenly open to attack by anyone with access to the screen and keyboard.
- monocasa 7y agoAuthentication providers are a huge pain for modern software security unfortunately since updates mandate that the system has to be restarted (they're only loaded at boot).
- buro9 7y agoKinda agree. But then they failed to make the "One account all of Google" true of Gmail and Gsuite accounts (there's a long list of things you can do with one account that you cannot do with the other, and this is with Google products and features). So it doesn't feel suprising that Google lacked the organisational-wide impetus to get this working fully for Windows and Microsoft products and features. These kinds of projects need to be driven with very strong vision from above. It makes me think of the Yegge rant about platforms at Google, and the mentioning of the Bezos mandate on APIs https://gist.github.com/chitchcock/1281611 https://gist.github.com/chitchcock/1281611 His Big Mandate went something along these lines: 1. All teams will henceforth expose their data and functionality through service interfaces. 2. Teams must communicate with each other through these interfaces. 3. There will be no other form of interprocess communication allowed: no direct linking, no direct reads of another team's data store, no shared-memory model, no back-doors whatsoever. The only communication allowed is via service interface calls over the network. 4. It doesn't matter what technology they use. HTTP, Corba, Pubsub, custom protocols -- doesn't matter. Bezos doesn't care. 5. All service interfaces, without exception, must be designed from the ground up to be externalizable. That is to say, the team must plan and design to be able to expose the interface to developers in the outside world. No exceptions. 6. Anyone who doesn't do this will be fired. 7. Thank you; have a nice day! When it comes to making the experience right for Google accounts (of any type, anywhere)... this is what it takes. But this is precisely Yegge's rant, Google lack this.
- mister_hn 7y agoWhy do you need an entire Chrome Browser and run as SYSTEM account?
- yrro 7y agoI wish I had one of these for FreeIPA...
- tssva 7y agoAuthentication on Windows using FreeIPA is already possible although not recommended by the FreeIPA project. There are several guides for doing so a Google search away. The FreeIPA project recommended solution is to deploy Active Directory either via a Windows server or Samba4 and then create a cross realm trust between AD and FreeIPA.
- yrro 7y agoYeah, I've pointed Windows directly at an MIT KRB5 KDC several times in the past, but it's not reliable enough for real use. And I don't want to have to pay for Windows Server just to authenticate on a couple of Windows machines. Plus is it even safe to put AD DS on the Internet?
- monocasa 7y agoI'll throw out there that I work for JumpCloud, an Identity Management Provider, and we have a credential provider as well for seamless Windows login. We also have a Mac login window so your users have a seamless experience regardless of the OS (our Linux solution doesn't really need one). We've also got LDAP, RADIUS, gsuite, and O365 backends (plus more I'm forgetting I'm sure) and a ton of other niceties. Check us out if you're into that. We also go beyond this and support MFA on Windows, Mac, Linux login. Orgs with less than 10 users are free. https://jumpcloud.com/ https://jumpcloud.com/
- ceejayoz 7y agoY'all should make a guide for setting up a small environment for a home network. With the homeschooling situation, our kids are suddenly using our various computers a lot, and it'd be really nice to have a simplified situation with one login across all computers. I don't want to run a server locally for it, but my Jumpcloud trial was a bit bewildering for this use case.
- monocasa 7y agoWould you mind speaking a little about what you had issues with? It's so hard to get feedback for the users who try us out where we didn't 'just click' for them, and I'd love to hear where some of our pain points are.
- ceejayoz 7y agoThere's a pretty overwhelming amount of options to go through. A wizard or simplified console for home networks would be great. I don't need Radius, GPOs, groups. I just want everyone in the family to be able to use their GSuite account to log in on any of the computers in the house... and it's hard to figure out exactly what I need to turn on/off to do that.
- monocasa 7y agoThanks! I'll make sure that feedback gets some time in front of the relevant product folk.
- bluGill 7y agoCan I use this self hosted? I don't want Google to have control over my personal logins. I have a bunch of computers at home for the family to use and a NAS system for data. All I lack to make it work well is central login. Openldap looks like my best bet, but I haven't figured out the obtuse configuration syntax.
- judge2020 7y agoUnless this is old, here's the code for Google's credential provider. It's not plug and play by any means. https://github.com/chromium/chromium/tree/master/chrome/credential_provider https://github.com/chromium/chromium/tree/master/chrome/cred...
- amaccuish 7y agoUse Samba4. It's an easy to use LDAP/Kerberos/DNS system that looks after itself. Or if you're more Unix inclined, there's FreeIPA.
- adamfeldman 7y agoGoogle acquired Bitium in September 2017. This was one of their capabilities. https://en.wikipedia.org/wiki/Bitium https://en.wikipedia.org/wiki/Bitium
- solatic 7y ago> After GCPW installation, the device appears in the Admin console Windows device list after the user signs in with their Google Account for the first time. We use G Suite at work (legacy decision) and it really kills me just how poorly the G Suite product team seems to understand enrollment and authorization workflows. No, I don't want to allow every device to register itself into the device list. If I'm managing installations of organization-owned devices, then I want to pre-register the device into a device whitelist that I maintain before I allow that device unfettered access to protected resources. This is right up there with other dumb moves like requiring AWS roles to be added per-user for SAML login and functionally being unable to setup G Suite as an OIDC IdP for Kubernetes because G Suite refuses to expose group membership (or even more importantly, transitive group membership) to service providers. If Google uses G Suite internally then I have zero idea how they manage to actually get anything done, unless they have a lot of in-house automation that they haven't open-sourced. It doesn't make sense unless they're not eating their own dogfood.
- jayd16 7y agoI don't understand your complaint. This is done as an audit log of devices used to sign in. How would this function if not automatically?
- nailer 7y agoThe parent poster states: > I want to pre-register the device into a device whitelist that I maintain before I allow that device unfettered access to protected resources.
- smallnamespace 7y agoYou can use GSuite groups for GKE RBAC now: https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control https://cloud.google.com/kubernetes-engine/docs/how-to/role-...
- jkaplowitz 7y agoBut possibly not for other Kubernetes deployments. I wonder if this is a business decisions or the consequence of nonpublic technical details. (Disclosure: I used to work at Google including on GCP, but I have no inside info related to this discussion and haven't worked there in just over 5 years.)
- darkhorn 7y agoI have lost access to one of emails because I've bulk deleted my old emails from my Gmail UI. Now I cannot recover my Gmail account. It asks me few questions and then says that I'm not the owner of my account.
- WhyNotHugo 7y agoI don't quite get the point of this. It allows logging into the device using your Google Account... and? How does that affect usage in any way? What changes?
- IMcD23 7y agoSeems like this would be useful to organizations who use G suite for their accounts &authentication. That way each user can sign into their work machine using their Google account, instead of having a separate username/password.
- geek_at 7y agoThis has been possible for many years using Google sync (syncs local ad accounts and passwords to Google apps)
- WhyNotHugo 7y agoOh, I always thought that was somehow done by using LDAP for user authentication and some syncing magic. This seems to make it much simpler for IT to handle.
- 1cvmask 7y agoI work for SAASPASS which is an Identity & Access Manager (IAM) which has a credential provider with 2FA for Windows computers, including MacOS and Linux computers. There is also an RDP for computers with multi-factor authentication. You can even Remote Lock or Remote Unlock with 2FA your computers. This is all configurable by the admin. SAASPASS is also an Identity Provider with a passwordless architecture built on a zero-trust framework and can be used to manage all your users, employees and devices. There are over 100 thousand pre-built integrations. There are more pre-built SAML integrations (over 1700+) for the Single Sign-on. SAASPASS can be integrated with Active Directory or be used as a Directory Service as well. www.saaspass.com
- deleted 7y ago[deleted]