Verify email domain if HostedDomain (hd) is set

[bodhi]

oidc2aws has a configuration parameter HostedDomain that will configure the hd value when opening the browser.

If this is set, oidc2aws should verify that the returned email address matches the value set in the configuration.

This is not a high-priority internally as the app we use for this is "Internal":

Only users with a Google Account in your organisation can grant access to the scopes requested by this app.

so Google takes care of this.

[bodhi]

Recommended here:

https://developers.google.com/identity/work/it-apps

When you get an OpenID Connect assertion from Google, double check that the Google authentication service has confirmed it is an account controlled by the administrators of that domain name. This check is done server side by evaluating the hd field in the token to verify the domain is what you expected.