Authentication Bypass on Icinga monitoring server

Summary

An Icinga monitoring server, which was intended to be accessible only by Shopify employees, had Google OAuth misconfigured such that all Google accounts were accepted (regardless of whether they belonged to the shopify.com hosted domain or not). The server has been reconfigured to validate the hd (hosted domain) parameter, so that only shopify.com Google accounts are accepted.