CB Connect: restrict Google user logins to the GSuites domain?

Hi, I've been trying out CB Connect to allow our employees to use their GSuites logins to access our Joomla site. The authentication works great, but I'm trying to figure out how to restrict use of the Google login to ONLY those who log in using a mail address with our GSuites domain (similar to the "Always Use Suffix" function in the deprecated Joomla GMail authentication plugin).

*Only* the Gsuite users from our corporate domain should be able to log in using their Google email addresses; all other users should be forced to register for a username directly with our site and be authenticated by CB/Joomla.

I tried turning off the Registration in CB Connect->Google settings, and creating the GSuites users by hand, but it seems you can't log in with a Google user if registration is turned off.

Is this possible to do with CB Connect?

There's no functionality in Googles single sign on API to limit the email address domain. There's no guarantee it will even return an email address as it's subject to privacy settings of their account. However CB Connect does fire the normal onBeforeUserRegistration trigger, which you could use to check their email address in CB Auto Actions to redirect away with a Redirect action or throw an error using a Code action to interrupt the registration process.

Thanks for the reply krileon, appreciate it. Another question then -- is there any way to create the Joomla users first, and use CB Connect WITHOUT the Google registration feature activated?

Thanks for the reply krileon, appreciate it. Another question then -- is there any way to create the Joomla users first, and use CB Connect WITHOUT the Google registration feature activated?

Yes, they'll have to login normally then use the Link button in your login module to link their social media account. Beyond that, no.