Answers.Body: <p>Sounds like a <a href="http://craftcms.com/docs/plugins" rel="nofollow">custom plugin</a> is in order.</p>
  
  <p>Your plugin could add a custom <code>{% validateUser %}</code> Twig tag. That tag would check to see if their logged in OR check <a href="https://craftcms.com/classreference/services/HttpRequestService#getIpAddress-detail" rel="nofollow"><code>craft.request.getIpAddress()</code></a> and validate against your internal IP whitelist for your company. You should read the notes on that link, though, since this isn't guaranteed to be secure. It's trivial to spoof these in many circumstances.</p>
  
  <p>If it passes the check, send them on their merry way to the homepage, otherwise, redirect to your social login page, have them login and send to the homepage.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-04-19T20:25:38.090Z
Answers.LastActivityDate: 2016-04-19T20:25:38.090Z
Answers.UserDisplayName: Brad Bell
Answers.Body: <p>Is the physical web server inside your network as well? As mcclaskiem mentioned,  check to see if the IP address is within the subnet of your network and then allow access that way.</p>
  
  <p>You may want to have the web server listen on another hostname that's not accessible outside the network and allow access to that vhost unconditionally (but do that at the firewall level). The would be the securest way to allow access within your network without logging in. <a href="https://security.stackexchange.com/questions/4533/in-what-scenarios-is-relying-on-source-ip-address-as-a-security-control-acceptab">IP addresses can be spoofed</a> with varying threat so I'd be wary of allowing anyone to authenticate via just an IP Address if your webserver is located off-premise.</p>
  
  <p>Dealing with google auth on the "other side" would obviously require a plugin for people attempting to connect outside the network.  </p>
  
  <p>Here's <a href="https://craftcms.stackexchange.com/questions/5042/does-craft-support-a-custom-authentication-backend-for-admin">another thread</a> for further reading.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-04-19T20:26:30.650Z
Answers.Text: lol - answered within 20 seconds of each other.
Answers.UserDisplayName: Brad Bell
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-04-19T20:27:24.073Z
Answers.Text: Yours is better!
Answers.UserDisplayName: RitterKnight
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-04-19T20:32:04.420Z
Answers.Text: That's definitely debatable.
Answers.UserDisplayName: Brad Bell
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-04-19T20:25:14.077Z
Answers.LastActivityDate: 2016-04-19T20:32:59.730Z
Answers.LastEditDate: 2017-04-13T12:51:00.160Z
Answers.UserDisplayName: RitterKnight
Body: <p>As per the flow diagram below I want to restrict access for users outside my network. However rather then completely stopping external access I want them to be redirected to a login page where they will be required to login via google, there email address will have to be within the organisation to be granted access.</p>
  
  <p>Any help/advice much appreciated.</p>
  
  <p><img src="https://dl.dropboxusercontent.com/u/74074387/2016-04-19.png" alt="flow diagram"></p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-04-19T13:40:24.600Z
Comments.Text: Try adding a `{% requireLogin %}` tag on pages you want protected, https://craftcms.com/docs/templating/requirelogin
Comments.UserDisplayName: mcclaskiem
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-04-19T13:43:11.930Z
Comments.Text: I am aware of the { requireLogin } but is there a way to do this at more of a config level? don't really want to have to add that to all the pages. Also I want to bypass the login when I am on my network (particular IP address).
Comments.UserDisplayName: luke mclean
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-04-19T13:44:20.400Z
Comments.Text: You could try something at your `_layout` level:     `{% if not currentUser %}`. Then also add some logic to look at their IP address as well and direct them accordingly. You may be better off writing this as a service and then binding it to a variable in the plug-in so you can access it in templates easier.
Comments.UserDisplayName: mcclaskiem
Tags: <login><authentication><plugin-social-login>
Title: Restricted front-end access
ThreadText: # Restricted front-end access
  
  (Asked by: username_0 on 2016-04-19)
  
  As per the flow diagram below I want to restrict access for users outside my network. However rather then completely stopping external access I want them to be redirected to a login page where they will be required to login via google, there email address will have to be within the organisation to be granted access.
  
  Any help/advice much appreciated.
  
  ![flow diagram](https://dl.dropboxusercontent.com/u/74074387/2016-04-19.png)
  
  **Tags:** login, authentication, plugin-social-login
  
  > **Comments:**
  > **username_1**: Try adding a `{% requireLogin %}` tag on pages you want protected, https://craftcms.com/docs/templating/requirelogin  
  > **username_0**: I am aware of the { requireLogin } but is there a way to do this at more of a config level? don't really want to have to add that to all the pages. Also I want to bypass the login when I am on my network (particular IP address).  
  > **username_1**: You could try something at your `_layout` level:     `{% if not currentUser %}`. Then also add some logic to look at their IP address as well and direct them accordingly. You may be better off writing this as a service and then binding it to a variable in the plug-in so you can access it in templates easier.  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_2 on 2016-04-19. Score: 3
  
  Sounds like a [custom plugin](http://craftcms.com/docs/plugins) is in order.
  
  Your plugin could add a custom `{% validateUser %}` Twig tag. That tag would check to see if their logged in OR check [`craft.request.getIpAddress()`](https://craftcms.com/classreference/services/HttpRequestService#getIpAddress-detail) and validate against your internal IP whitelist for your company. You should read the notes on that link, though, since this isn't guaranteed to be secure. It's trivial to spoof these in many circumstances.
  
  If it passes the check, send them on their merry way to the homepage, otherwise, redirect to your social login page, have them login and send to the homepage.
  
  
  ---
  
  ### Answer by username_3 on 2016-04-19. Score: 3
  
  Is the physical web server inside your network as well? As username_1 mentioned, check to see if the IP address is within the subnet of your network and then allow access that way.
  
  You may want to have the web server listen on another hostname that's not accessible outside the network and allow access to that vhost unconditionally (but do that at the firewall level). The would be the securest way to allow access within your network without logging in. [IP addresses can be spoofed](https://security.stackexchange.com/questions/4533/in-what-scenarios-is-relying-on-source-ip-address-as-a-security-control-acceptab) with varying threat so I'd be wary of allowing anyone to authenticate via just an IP Address if your webserver is located off-premise.
  
  Dealing with google auth on the "other side" would obviously require a plugin for people attempting to connect outside the network.
  
  Here's [another thread](https://craftcms.stackexchange.com/questions/5042/does-craft-support-a-custom-authentication-backend-for-admin) for further reading.
  
  > **Comments:**
  > **username_2**: lol - answered within 20 seconds of each other.  
  > **username_3**: Yours is better!  
  > **username_2**: That's definitely debatable.  
  
  ---
  
  