@@ -22,6 +22,7 @@ const (

 	githubTokenURL     = "https://github.com/login/oauth/access_token"

 	githubUserApiURL   = "https://api.github.com/user"

 	githubUserOrgURL   = "https://api.github.com/user/orgs"

+	githubUserTeamURL  = "https://api.github.com/user/teams"

 	githubOAuthScope   = "user:email"

 	githubOrgScope     = "read:org"

@@ -35,6 +36,7 @@ type provider struct {

 	clientID             string

 	clientSecret         string

 	allowedOrganizations sets.String

+	allowedTeams         sets.String

 }

 // https://developer.github.com/v3/users/#response

@@ -51,7 +53,14 @@ type githubOrg struct {

 	Login string

 }

-func NewProvider(providerName, clientID, clientSecret string, organizations []string) external.Provider {

+// https://developer.github.com/v3/orgs/teams/#response-12

+type githubTeam struct {

+	ID           uint64

+	Slug         string

+	Organization githubOrg

+}

+

+func NewProvider(providerName, clientID, clientSecret string, organizations, teams []string) external.Provider {

 	allowedOrganizations := sets.NewString()

 	for _, org := range organizations {

 		if len(org) > 0 {

@@ -59,11 +68,19 @@ func NewProvider(providerName, clientID, clientSecret string, organizations []st

 		}

 	}

+	allowedTeams := sets.NewString()

+	for _, team := range teams {

+		if len(team) > 0 {

+			allowedTeams.Insert(strings.ToLower(team))

+		}

+	}

+

 	return &provider{

 		providerName:         providerName,

 		clientID:             clientID,

 		clientSecret:         clientSecret,

 		allowedOrganizations: allowedOrganizations,

+		allowedTeams:         allowedTeams,

 	}

 }

@@ -74,8 +91,8 @@ func (p *provider) GetTransport() (http.RoundTripper, error) {

 // NewConfig implements external/interfaces/Provider.NewConfig

 func (p *provider) NewConfig() (*osincli.ClientConfig, error) {

 	scopes := []string{githubOAuthScope}

-	// if we're limiting to specific organizations, we also need to read their org membership

-	if len(p.allowedOrganizations) > 0 {

+	// if we're limiting to specific organizations or teams, we also need to read their org membership

+	if len(p.allowedOrganizations) > 0 || len(p.allowedTeams) > 0 {

 		scopes = append(scopes, githubOrgScope)

 	}

@@ -114,6 +131,18 @@ func (p *provider) GetUserIdentity(data *osincli.AccessData) (authapi.UserIdenti

 		if !userOrgs.HasAny(p.allowedOrganizations.List()...) {

 			return nil, false, fmt.Errorf("User %s is not a member of any allowed organizations %v (user is a member of %v)", userdata.Login, p.allowedOrganizations.List(), userOrgs.List())

 		}

+		glog.V(4).Infof("User %s is a member of organizations %v)", userdata.Login, userOrgs.List())

+	}

+	if len(p.allowedTeams) > 0 {

+		userTeams, err := getUserTeams(data.AccessToken)

+		if err != nil {

+			return nil, false, err

+		}

+

+		if !userTeams.HasAny(p.allowedTeams.List()...) {

+			return nil, false, fmt.Errorf("User %s is not a member of any allowed teams %v (user is a member of %v)", userdata.Login, p.allowedTeams.List(), userTeams.List())

+		}

+		glog.V(4).Infof("User %s is a member of teams %v)", userdata.Login, userTeams.List())

 	}

 	identity := authapi.NewDefaultUserIdentityInfo(p.providerName, fmt.Sprintf("%d", userdata.ID))

@@ -133,41 +162,73 @@ func (p *provider) GetUserIdentity(data *osincli.AccessData) (authapi.UserIdenti

 // getUserOrgs retrieves the organization membership for the user with the given access token.

 func getUserOrgs(token string) (sets.String, error) {

-	// start with the empty set, and the initial org url

 	userOrgs := sets.NewString()

-	orgURL := githubUserOrgURL

+	err := page(githubUserOrgURL, token,

+		func() interface{} {

+			return &[]githubOrg{}

+		},

+		func(obj interface{}) error {

+			for _, org := range *(obj.(*[]githubOrg)) {

+				if len(org.Login) > 0 {

+					userOrgs.Insert(strings.ToLower(org.Login))

+				}

+			}

+			return nil

+		},

+	)

+	return userOrgs, err

+}

+

+// getUserTeams retrieves the team memberships for the user with the given access token.

+func getUserTeams(token string) (sets.String, error) {

+	userTeams := sets.NewString()

+	err := page(githubUserTeamURL, token,

+		func() interface{} {

+			return &[]githubTeam{}

+		},

+		func(obj interface{}) error {

+			for _, team := range *(obj.(*[]githubTeam)) {

+				if len(team.Slug) > 0 && len(team.Organization.Login) > 0 {

+					userTeams.Insert(strings.ToLower(team.Organization.Login + "/" + team.Slug))

+				}

+			}

+			return nil

+		},

+	)

+	return userTeams, err

+}

+

+// page fetches the intialURL, and follows "next" links

+func page(initialURL, token string, newObj func() interface{}, processObj func(interface{}) error) error {

 	// track urls we've fetched to avoid cycles

-	fetchedURLs := sets.NewString(orgURL)

+	url := initialURL

+	fetchedURLs := sets.NewString(url)

 	for {

-		// fetch organizations

-		organizations := []githubOrg{}

-		links, err := getJSON(orgURL, token, &organizations)

+		// fetch and process

+		obj := newObj()

+		links, err := getJSON(url, token, obj)

 		if err != nil {

-			return nil, err

+			return err

 		}

-		for _, org := range organizations {

-			if len(org.Login) > 0 {

-				userOrgs.Insert(strings.ToLower(org.Login))

-			}

+		if err := processObj(obj); err != nil {

+			return err

 		}

 		// see if we need to page

 		// https://developer.github.com/v3/#link-header

-		nextURL := links["next"]

-		if len(nextURL) == 0 {

+		url = links["next"]

+		if len(url) == 0 {

 			// no next URL, we're done paging

 			break

 		}

-		if fetchedURLs.Has(nextURL) {

+		if fetchedURLs.Has(url) {

 			// break to avoid a loop

 			break

 		}

 		// remember to avoid a loop

-		fetchedURLs.Insert(nextURL)

-		orgURL = nextURL

+		fetchedURLs.Insert(url)

 	}

-

-	return userOrgs, nil

+	return nil

 }

 // getJSON fetches and deserializes JSON into the given object.

@@ -7,5 +7,5 @@ import (

 )

 func TestGitHub(t *testing.T) {

-	_ = external.Provider(NewProvider("github", "clientid", "clientsecret", nil))

+	_ = external.Provider(NewProvider("github", "clientid", "clientsecret", nil, nil))

 }

@@ -864,6 +864,8 @@ type GitHubIdentityProvider struct {

 	ClientSecret StringSource

 	// Organizations optionally restricts which organizations are allowed to log in

 	Organizations []string

+	// Teams optionally restricts which teams are allowed to log in. Format is <org>/<team>.

+	Teams []string

 }

 type GitLabIdentityProvider struct {

@@ -135,7 +135,7 @@ func TestStringSourceMarshaling(t *testing.T) {

 		}

 		// Wrap in a dummy JSON from the surrounding object

-		input := fmt.Sprintf(`{"kind":"GitHubIdentityProvider","apiVersion":"v1","clientID":"","clientSecret":%s,"organizations":null}`, tc.ExpectedJSON)

+		input := fmt.Sprintf(`{"kind":"GitHubIdentityProvider","apiVersion":"v1","clientID":"","clientSecret":%s,"organizations":null,"teams":null}`, tc.ExpectedJSON)

 		if strings.TrimSpace(string(json)) != input {

 			t.Log(len(input), len(json))

 			t.Errorf("%s: expected\n%s\ngot\n%s", k, input, string(json))

@@ -217,6 +217,7 @@ var map_GitHubIdentityProvider = map[string]string{

 	"clientID":      "ClientID is the oauth client ID",

 	"clientSecret":  "ClientSecret is the oauth client secret",

 	"organizations": "Organizations optionally restricts which organizations are allowed to log in",

+	"teams":         "Teams optionally restricts which teams are allowed to log in. Format is <org>/<team>.",

 }

 func (GitHubIdentityProvider) SwaggerDoc() map[string]string {

@@ -842,6 +842,8 @@ type GitHubIdentityProvider struct {

 	ClientSecret StringSource `json:"clientSecret"`

 	// Organizations optionally restricts which organizations are allowed to log in

 	Organizations []string `json:"organizations"`

+	// Teams optionally restricts which teams are allowed to log in. Format is <org>/<team>.

+	Teams []string `json:"teams"`

 }

 // GitLabIdentityProvider provides identities for users authenticating using GitLab credentials

@@ -323,6 +323,7 @@ oauthConfig:

       clientSecret: ""

       kind: GitHubIdentityProvider

       organizations: null

+      teams: null

   - challenge: false

     login: false

     mappingMethod: ""

@@ -337,6 +338,7 @@ oauthConfig:

         value: ""

       kind: GitHubIdentityProvider

       organizations: null

+      teams: null

   - challenge: false

     login: false

     mappingMethod: ""

@@ -183,13 +183,13 @@ func ValidateIdentityProvider(identityProvider api.IdentityProvider, fldPath *fi

 			validationResults.Append(ValidateKeystoneIdentityProvider(provider, identityProvider, providerPath))

 		case (*api.GitHubIdentityProvider):

-			validationResults.AddErrors(ValidateGitHubIdentityProvider(provider, identityProvider.UseAsChallenger, fldPath)...)

+			validationResults.Append(ValidateGitHubIdentityProvider(provider, identityProvider.UseAsChallenger, identityProvider.MappingMethod, fldPath))

 		case (*api.GitLabIdentityProvider):

 			validationResults.AddErrors(ValidateGitLabIdentityProvider(provider, fldPath)...)

 		case (*api.GoogleIdentityProvider):

-			validationResults.AddErrors(ValidateGoogleIdentityProvider(provider, identityProvider.UseAsChallenger, fldPath)...)

+			validationResults.Append(ValidateGoogleIdentityProvider(provider, identityProvider.UseAsChallenger, identityProvider.MappingMethod, fldPath))

 		case (*api.OpenIDIdentityProvider):

 			validationResults.AddErrors(ValidateOpenIDIdentityProvider(provider, identityProvider, fldPath)...)

@@ -309,28 +309,45 @@ func ValidateOAuthIdentityProvider(clientID string, clientSecret api.StringSourc

 	return allErrs

 }

-func ValidateGitHubIdentityProvider(provider *api.GitHubIdentityProvider, challenge bool, fieldPath *field.Path) field.ErrorList {

-	allErrs := field.ErrorList{}

+func ValidateGitHubIdentityProvider(provider *api.GitHubIdentityProvider, challenge bool, mappingMethod string, fieldPath *field.Path) ValidationResults {

+	validationResults := ValidationResults{}

-	allErrs = append(allErrs, ValidateOAuthIdentityProvider(provider.ClientID, provider.ClientSecret, fieldPath)...)

+	validationResults.AddErrors(ValidateOAuthIdentityProvider(provider.ClientID, provider.ClientSecret, fieldPath)...)

 	if challenge {

-		allErrs = append(allErrs, field.Invalid(fieldPath.Child("challenge"), challenge, "A GitHub identity provider cannot be used for challenges"))

+		validationResults.AddErrors(field.Invalid(fieldPath.Child("challenge"), challenge, "A GitHub identity provider cannot be used for challenges"))

 	}

-	return allErrs

+	if len(provider.Teams) > 0 && len(provider.Organizations) > 0 {

+		validationResults.AddErrors(field.Invalid(fieldPath.Child("organizations"), provider.Organizations, "specify organizations or teams, not both"))

+		validationResults.AddErrors(field.Invalid(fieldPath.Child("teams"), provider.Teams, "specify organizations or teams, not both"))

+	}

+	if len(provider.Teams) == 0 && len(provider.Organizations) == 0 && mappingMethod != string(identitymapper.MappingMethodLookup) {

+		validationResults.AddWarnings(field.Invalid(fieldPath, nil, "no organizations or teams specified, any GitHub user will be allowed to authenticate"))

+	}

+	for i, team := range provider.Teams {

+		if len(strings.Split(team, "/")) != 2 {

+			validationResults.AddErrors(field.Invalid(fieldPath.Child("teams").Index(i), team, "must be in the format <org>/<team>"))

+		}

+	}

+

+	return validationResults

 }

-func ValidateGoogleIdentityProvider(provider *api.GoogleIdentityProvider, challenge bool, fieldPath *field.Path) field.ErrorList {

-	allErrs := field.ErrorList{}

+func ValidateGoogleIdentityProvider(provider *api.GoogleIdentityProvider, challenge bool, mappingMethod string, fieldPath *field.Path) ValidationResults {

+	validationResults := ValidationResults{}

-	allErrs = append(allErrs, ValidateOAuthIdentityProvider(provider.ClientID, provider.ClientSecret, fieldPath)...)

+	validationResults.AddErrors(ValidateOAuthIdentityProvider(provider.ClientID, provider.ClientSecret, fieldPath)...)

 	if challenge {

-		allErrs = append(allErrs, field.Invalid(fieldPath.Child("challenge"), challenge, "A Google identity provider cannot be used for challenges"))

+		validationResults.AddErrors(field.Invalid(fieldPath.Child("challenge"), challenge, "A Google identity provider cannot be used for challenges"))

 	}

-	return allErrs

+	if len(provider.HostedDomain) == 0 && mappingMethod != string(identitymapper.MappingMethodLookup) {

+		validationResults.AddWarnings(field.Invalid(fieldPath, nil, "no hostedDomain specified, any Google user will be allowed to authenticate"))

+	}

+

+	return validationResults

 }

 func ValidateGitLabIdentityProvider(provider *api.GitLabIdentityProvider, fieldPath *field.Path) field.ErrorList {

@@ -534,7 +534,7 @@ func (c *AuthConfig) getOAuthProvider(identityProvider configapi.IdentityProvide

 		if err != nil {

 			return nil, err

 		}

-		return github.NewProvider(identityProvider.Name, provider.ClientID, clientSecret, provider.Organizations), nil

+		return github.NewProvider(identityProvider.Name, provider.ClientID, clientSecret, provider.Organizations, provider.Teams), nil

 	case (*configapi.GitLabIdentityProvider):

 		transport, err := cmdutil.TransportFor(provider.CA, "", "")