autoreg-skills-max: initial public release (restored, redacted, hardened)
This commit is contained in:
baradok60915d52e8425
147
skills/google-cloud-identity-farm/SKILL.md
Normal file
147
skills/google-cloud-identity-farm/SKILL.md
Normal file
@@ -0,0 +1,147 @@
|
||||
---
|
||||
name: google-cloud-identity-farm
|
||||
description: Mass Google Cloud Identity Free account creation — domain management, user provisioning, anti-abuse limits, recovery phone setup.
|
||||
category: automation
|
||||
tags: [google, workspace, cloud-identity, accounts, domain, mass-creation]
|
||||
triggers:
|
||||
- google workspace
|
||||
- cloud identity
|
||||
- google аккаунты
|
||||
- google accounts
|
||||
- domain google
|
||||
- гугл акки
|
||||
- workspace signup
|
||||
- gsuite
|
||||
---
|
||||
|
||||
# Google Cloud Identity Free — Mass Account Farm
|
||||
|
||||
Create Google Cloud Identity Free accounts (50 users, no Gmail, OAuth-enabled) on custom domains.
|
||||
|
||||
## Architecture
|
||||
|
||||
- **Cloud Identity Free** = 50 users, no Gmail, no cost
|
||||
- **Google Workspace** = paid, includes Gmail
|
||||
- **SA Key** = Service Account JSON for Directory API
|
||||
- **Domain-Wide Delegation** = SA key impersonates admin
|
||||
|
||||
## Setup
|
||||
|
||||
### 1. Get a domain
|
||||
- Real domain (.xyz $1, .com $10) — Google accepts for new signups
|
||||
- Free subdomain (.loc.cc, .rr.kg) — Google BLOCKS for new Workspace signups, but can be added as secondary domains to existing Workspace
|
||||
|
||||
### 2. Create Cloud Identity account
|
||||
Go to `https://workspace.google.com/business/signup` → Business Starter trial → cancel after 14 days → converts to Cloud Identity Free.
|
||||
|
||||
### 3. SA Key + Domain-Wide Delegation
|
||||
1. Google Cloud Console → Service Account → JSON key
|
||||
2. Admin Console → Security → API Controls → Domain-Wide Delegation
|
||||
3. Add SA client ID with scopes:
|
||||
- `https://www.googleapis.com/auth/admin.directory.user`
|
||||
- `https://www.googleapis.com/auth/admin.directory.domain`
|
||||
- `https://www.googleapis.com/auth/admin.directory.domain.readonly`
|
||||
|
||||
## API Operations
|
||||
|
||||
### Add domains to Workspace
|
||||
```python
|
||||
from google.oauth2 import service_account
|
||||
from googleapiclient.discovery import build
|
||||
|
||||
creds = service_account.Credentials.from_service_account_file(
|
||||
'sa_key.json',
|
||||
scopes=['https://www.googleapis.com/auth/admin.directory.domain'],
|
||||
subject='admin@domain.com'
|
||||
)
|
||||
admin = build('admin', 'directory_v1', credentials=creds)
|
||||
admin.domains().insert(customer='my_customer', body={'domainName': 'new.loc.cc'}).execute()
|
||||
```
|
||||
|
||||
### Create users
|
||||
```python
|
||||
creds = service_account.Credentials.from_service_account_file(
|
||||
'sa_key.json',
|
||||
scopes=['https://www.googleapis.com/auth/admin.directory.user'],
|
||||
subject='admin@domain.com'
|
||||
)
|
||||
admin = build('admin', 'directory_v1', credentials=creds)
|
||||
admin.users().insert(body={
|
||||
'primaryEmail': 'user@domain.com',
|
||||
'password': 'Password123!',
|
||||
'name': {'givenName': 'User', 'familyName': 'Name'},
|
||||
'changePasswordAtNextLogin': False,
|
||||
'recoveryPhone': '+380XXXXXXXXX', # Optional — helps skip SMS
|
||||
}).execute()
|
||||
```
|
||||
|
||||
### List users by domain
|
||||
```python
|
||||
result = admin.users().list(customer='my_customer', domain='domain.com', maxResults=500).execute()
|
||||
```
|
||||
|
||||
### Delete users
|
||||
```python
|
||||
admin.users().delete(userKey='user@domain.com').execute()
|
||||
```
|
||||
|
||||
## Domain Verification
|
||||
|
||||
New domains require TXT record verification. Google provides: `google-site-verification=XXXXX`
|
||||
|
||||
1. Get code from Admin Console → Domains → Verify
|
||||
2. Add TXT record to DNS: name=`@`, type=TXT, value=`google-site-verification=XXXXX`
|
||||
3. Click Verify in Admin Console
|
||||
|
||||
The verification code CANNOT be retrieved via Directory API — only through Admin Console UI.
|
||||
|
||||
## Limits & Anti-Abuse
|
||||
|
||||
| Limit | Value |
|
||||
|-------|-------|
|
||||
| Cloud Identity Free users | 50 (can drop to 35+) |
|
||||
| Users per creation batch | 1-3 (rate limited) |
|
||||
| Delay between creations | 0.5-2 seconds |
|
||||
|
||||
### 412 Error: "potentially abusive behavior"
|
||||
**Triggered by:** mass creation (>5 in quick succession), mass deletion, rapid create-delete cycles.
|
||||
**Symptoms:** All user creation blocked, error: `conditionNotMet`
|
||||
**Recovery:** Wait 24-48 hours. No workaround. Contact Google Support if urgent.
|
||||
|
||||
### Prevention
|
||||
- Create users slowly (1 per 2-3 seconds)
|
||||
- Don't delete and recreate in bulk
|
||||
- Spread creations across multiple days
|
||||
- Max 5-10 users per session
|
||||
|
||||
## Recovery Phone
|
||||
|
||||
Adding `recoveryPhone` to users helps skip SMS verification on first login:
|
||||
```python
|
||||
'recoveryPhone': '+380XXXXXXXXX',
|
||||
'recoveryEmail': 'backup@gmail.com'
|
||||
```
|
||||
|
||||
## Using accounts as OAuth identities for third-party SaaS (verified 2026-09-10)
|
||||
|
||||
Cloud Identity users (non-gmail, e.g. `*@reforrm.me`) **pass Google OAuth on third-party apps** — verified end-to-end on indent.com (WorkOS AuthKit): email → password → Google consent → landed in app as signed-in user. Apps requiring only `userinfo.email`/`userinfo.profile` scopes accept Workspace-domain accounts; no gmail needed.
|
||||
|
||||
**CDP flow pattern (Chrome `--remote-debugging-port=9222 --remote-allow-origins=*`):**
|
||||
1. Open app signup, click "Continue with Google" → redirects to `accounts.google.com/v3/signin/identifier`.
|
||||
2. Fill `#identifierId` via native-setter + `input` event, click Next → password page (`input[name=Passwd]`).
|
||||
3. After password, the **consent screen opens in a NEW TAB** (`/signin/oauth/id`) — re-enumerate `http://127.0.0.1:9222/json` and connect a websocket to that tab, then click "Продолжить"/"Continue" there. Managed accounts also spawn a `chrome://managed-user-profile-notice/` tab — ignore it.
|
||||
4. App tab lands on onboarding.
|
||||
|
||||
**Known blocker class:** apps with PostHog/anti-bot fingerprinting may accept the OAuth login but flag the *first in-app action* (e.g. indent.com workspace creation → "flagged as potential bot activity"). CDP automation is detected at that step. If the goal is only account creation (not in-app org setup), the OAuth flow itself works. For flagged apps: fresh residential IP, humanized delays, or non-CDP browser (pyautogui, see windows-browser-automation skill).
|
||||
|
||||
**Value check before farming:** verify the target actually exposes an API/benefit (docs, JS bundle grep for `/v1/`, `api key`, model names). Some promo posts ("GPT-6 Astra, $100 credits") point to products with no external API at all — recon first, farm second.
|
||||
|
||||
## Pitfalls
|
||||
|
||||
1. **Domain scope dies**: 403 after ~100 domain additions. Re-auth in Admin Console.
|
||||
2. **412 anti-abuse**: Mass create/delete triggers permanent-ish block. Slow down.
|
||||
3. **Unverified domains**: Users can only be created on VERIFIED domains (404 otherwise).
|
||||
4. **Browser required**: Domain verification needs Admin Console UI (no API).
|
||||
5. **Headless detection**: Google blocks headless browsers for signup. Use real browser.
|
||||
6. **.loc.cc blocked**: Google rejects .loc.cc for new Workspace signups at final step.
|
||||
7. **Secondary domain limit**: Cloud Identity allows unlimited secondary domains, but user limit is TOTAL across all.
|
||||
Reference in New Issue
Block a user