Problem:
My organisation, ExampleFooBar, uses Google Apps. On our website I want to enable OpenID Single Sign-In (like StackOverflow), but only allow @examplefoobar.com email addresses to sign in. What OpenID url should I use for a Google Apps email address?
As per comments on Include OpenId in drupal, the domain http://www.google.com/profiles/<username> can be used for normal Google accounts, but this doesn't work for Google Apps accounts.
Google also provides the url https://www.google.com/accounts/o8/id but using that would allow any google user who found our website's login page to sign in, as the sign-in page accepts any google account name.
What Google URL can I use to ensure only @examplefoobar.com email addresses can sign in?
Google documentation for Google Apps OpenID is at http://code.google.com/googleapps/domain/sso/openid_reference_implementation.html, but is incredibly unhelpful.
By aaronsnoswell:
The OpenID url google.com/accounts/o8/site-xrds?hd=examplefoobar.com will restrict email entries to @examplefoobar.com. Additionally, I had to enable OpenID Single Sign in from the Google Apps administrator page. Hope this helps someone!
http://jeremiahlee.com/blog/2009/09/28/how-to-setup-openid-with-google-apps/
Google Apps (for business) OpenID login for ASP.NET intranet site