Google App Engine Web应用：除谷歌身份平台外的认证选项及自定义登录页问询

Hey there! Let's tackle your Google App Engine authentication questions one by one:

1. Alternative Authentication Options for GAE Web Apps (Beyond Google Identity Platform) #

Here are robust, production-ready alternatives you can implement:

• Custom Authentication System: Build your own end-to-end flow using Python tools and GAE's storage options. Use bcrypt to hash passwords securely, store user data (emails, hashed passwords, verification status) in Cloud Datastore or Cloud SQL, and leverage frameworks like Flask-Login (for Flask apps) or Django's built-in auth system (for Django apps) to handle session management seamlessly.
• OAuth 2.0/OpenID Connect Providers (Non-Google): Services like Microsoft Azure AD, Okta, or Auth0 offer pre-built auth flows that support custom domain email logins. You can configure these platforms to restrict access to specific email domains, and they handle heavy lifting like token validation and user profile management.
• Firebase Authentication: While part of the Google Cloud ecosystem, it's a standalone service separate from Google Identity Platform. It supports email/password logins, custom domain emails, and integrates smoothly with GAE via its Python SDK—no need to use Google's identity platform directly.
• LDAP/Active Directory Integration: For enterprise apps, connect your GAE app to an LDAP server or Active Directory using libraries like python-ldap. This lets you authenticate users with their corporate custom-domain emails against your organization's existing directory. Note: This works best in GAE's Flexible Environment, as the Standard Environment has stricter network connection limits.

2. Creating a Login Page for Python GAE Apps (No Google Identity Platform, Supports Custom Domain Emails) #

Absolutely—you have two solid paths to make this happen:

Option 1: Build a Custom Email/Password System #

This gives you full control over every part of the login flow:

1. Registration Form: Create a form to collect user emails, then add validation to ensure the email domain is in your allowed list (e.g., @yourcompany.com, @customdomain.io).
2. Email Verification: Use GAE's built-in mail API (or a third-party service like SendGrid) to send a verification link to the user's email. Once they click it, mark their account as verified in your datastore.
3. Secure Password Storage: Always hash passwords with bcrypt (never store plain text) before saving them to Cloud Datastore or Cloud SQL.
4. Login Flow: Build a login page that accepts email and password. Verify the password hash against your stored data, then use a framework like Flask-Login to set up authenticated user sessions.

Option 2: Integrate a Third-Party Auth Service (e.g., Auth0) #

If you want to avoid building everything from scratch:

1. Configure the Provider: Set up an account with a service like Auth0, then whitelist your target custom email domains in their settings (most providers let you restrict logins to specific domains).
2. Add Login to Your GAE App: Use the provider's Python SDK (like Auth0's auth0-python library) to add a login button to your page. Users will be redirected to the provider's login page (which supports your custom domain emails), and after successful auth, they'll be sent back to your app with a valid token.
3. Validate Tokens: In your GAE app, validate the incoming token from the provider to authenticate the user and set up sessions for them.

Both approaches work seamlessly with Python-based GAE apps, whether you're using Flask, Django, or a custom WSGI setup.

内容的提问来源于stack exchange，提问作者Kyzyl Monteiro