G Suite OpenId connection for personnal web application - php

Question

I want to implement OpenId of G Suite api to connect the user of my own php application and use the G Suite manage of user.
So I have write the example below :
in index.php I have load autoload.php (with google-api-php-client library)
$client = new \Google_Client();
$client->setClientId(CLIENT_ID);
$client->setClientSecret(SECRET);
$client->setAuthConfig(ROOT_PATH.CLIENT_SECRET_JSON_FILE);
$client->setAccessType("offline");
$client->setIncludeGrantedScopes(true);
$client->setHostedDomain('mydomain.com');
$client->addScope(\Google_Service_Oauth2::USERINFO_PROFILE);
$redirect = $_SERVER['HTTP_HOST'];
$redirect = 'myapplication.mydomain.com';
$client->setRedirectUri('https://' . $redirect . '/oauth2callback.php');
$auth_url = $client->createAuthUrl();
header('Location: ' . filter_var($auth_url, FILTER_SANITIZE_URL));
oauth2callback.php
$client = new \Google_Client();
$client->setClientId(CLIENT_ID);
$client->setClientSecret(SECRET);
$client->setAuthConfig(ROOT_PATH.CLIENT_SECRET_JSON_FILE);
$client->setRedirectUri('https://myapplication.mydomain.com/oauth2callback.php');
$client->setAccessType("offline");
$client->setIncludeGrantedScopes(true);
$client->setHostedDomain('mydomain.com');
if (!isset($_GET['code'])) {
$auth_url = $client->createAuthUrl();
header('Location: ' . filter_var($auth_url, FILTER_SANITIZE_URL));
}
else {
$client->fetchAccessTokenWithAuthCode($_GET['code']);
$_SESSION['access_token'] = $client->getAccessToken();
$oauth = new \Google_Service_Oauth2($client);
var_dump($oauth->userinfo->get());
}
exit();
All is ok with this example, but, I can connect on my application with another account of my G Suite domain :-(
I don't understand where I must configure it to authorize only the user of my G Suite domain to access at my application.
Can you help me ?
Thanks

Answer 1

I have a start of answer, it's impossible.
But, with the return of api, it's possible to check the value hd (hosted domain) to compare it with my. https://developers.google.com/identity/sign-in/web/backend-auth
In my case, I haven't return value of hd :-( and I don't why

Answer 2

I have found the solution :-)
It's simple. The scope must be "email". If there is this value, Gsuite return automatically value in hd to check it.
After the return, I juste test the value to compare with my Gsuite domain :-)