Deploying uBlock via Google workspace: trustedSiteDirectives?

[alex-daud]

Hi all,

Early in 2020, I deployed uBlock at my organization using Google Workspace. I was interested in deploying a whitelist for our users, but opted out of doing so, because the docs stated that the admin-deployed whitelist overrode the user-set whitelist.

I just noticed today that some new features were added this year to allow admin to append to (rather than replace) user-set whitelists. It looks like the issue for that feature request via Google Workspace deployment was closed shortly before.

Is this feature compatible with Google Workspace deployments? It seems like no, but thought I'd check here. If not, consider this a wishful plug for that feature!

Thanks

[gorhill]

Sorry I can't help, I don't know what is Google Workspace, probably best to ask on a Google Workspace support forum.

[alex-daud]

If it helps, this is how we set uBlock extension policies via Google Workspace. Here is a working policy:

:

I'm basically wondering if I could do something like this to make use of that trustedSiteDirectives feature. (This does not work.)

{ 
"adminSettings":
  { 
  "Value" :
      "{\"toAdd\": {\"trustedSiteDirectives\":[\"google.com\"]}"
    }
}

[u-RraaLL]

It looks like the issue for that feature request via Google Workspace deployment was closed shortly before.

If you look again, that issue has been closed 6 yrs ago: gorhill/uBlock@892913d

[gorhill]

it wants Value as a string

If it didn't error, then this mean it's the right value type. adminSettings does require a string because that's how the schema is declared in managed_storage.json. toAdd is declared as an object. If it didn't work, try restarting Chrome, as pointed out, it might take a restart, it seems sometimes Chrome is not aware that a policy changed and does not relay the change to the extension API.

[alex-daud]

Ah, I see. I've applied the policy and restarted Chrome a few times, but it doesn't modify the uBlock trusted sites. For a sanity check, here is where I'm looking after restarting Chrome; when using that adminSettings policy, it shows the right domains after restarting Chrome.

[gorhill]

Can you share the exact text you tried when you try to use toAdd as an object?

[gorhill]

Actually, your screenshot tells me your toAdd entry worked, because example.org is rendered as a default trusted directive, while it would be rendered in black as a user-defined directive if it came from adminSettings.

[alex-daud]

Oh snap! You're right! It is working. Thank you so much for your help!

[alex-daud]

Note that Chromium has a quirk that I needed to launch the browser twice for the change to show up. Beyond that, I can't help with whatever OS/browser tools used to manage Chrome policies.

Heh, good to know. I'll make sure to relaunch a couple times during testing.

[jaakpardi]

Hey @alex-daud. Can you show the JSON you ended up using to get toadd+trustedsitedirectives to work? I'm not having any success with Google Workspace at the moment. Even with quitting and relaunching Chrome repeatedly.

{ "adminSettings": { "Value" : "{\"toAdd\": {\"trustedSiteDirectives\":[\"exampleexample.com\"]}" } }

[gorhill]

Try:

Policy name	Policy value
toAdd	{ "trustedSiteDirectives": [ "example.com" ] }

[jaakpardi]

I seem to have missed half of your conversation. Thank you for the help. This works perfectly for adding to trustedSiteDirectives:

{ "toAdd": { "Value" : { "trustedSiteDirectives": [ "example.org" ] } } }

[alex-daud]

Wanted to come back to this thread because I thought the deployment of trustedSiteDirectives was broken when I noticed my chrome://policy profile looking like this today:

However, it does seem to be pulling down new trusted sites entries as normal. Putting this out there in case it helps anyone else.

[alex-daud]

Hey @gorhill - on second thought, it seems like many of our users are not getting updated policies, even after reloading policy and restarting Chrome. Do you know if there was a change recently that would have affected this functionality?

Thanks

[gorhill]

No changes I can think of around the managed storage feature.

[alex-daud]

Thanks for the reply, maybe it's on the Google end then.

[itsbradwhite]

@alex-daud Did you ever get anywhere with this? I'm in the same situation, trying to use Google Workspace to deploy configured uBlock Origin. We had syntax what was seemed like it was working at some point, as we would see the sites we wanted in the pink/purple color in uBlock settings. But ever since then, making changes to the extensions json in Google Admin just doesn't get updated in the browser.

I've never been able to get adminSettings to work. I've been messing with it all day today and using:

{ "toAdd": { "Value" : { "trustedSiteDirectives": [ "examplesite1.com", "examplesite2.com" ] } } }

The browser does show the above as valid syntax and updates when I chrome://policy > reload policy. However it's not marking the sites as allowed. I just haven't been able to get this to work reliably in Google Workspace.

Edit: So the above does work, but no matter how many times you reload policies and close out of chrome and relaunch, the trusted sites don't appear to go into effect unless you click 'Reset to default settings...' in uBlock Origin.

[cfvna271]

Hey Brad! This has been working for me for a while now, when I get back into the office tomorrow I'll talk with you and help ya out!

…

On Mon, Jun 5, 2023, 8:19 PM 'Brad White' via IT Department ***@***.***> wrote: @alex-daud <https://github.com/alex-daud> Did you ever get anywhere with this? I'm in the same situation, trying to use Google Workspace to deploy configured uBlock Origin. We had syntax what was seemed like it was working at some point, as we would see the sites we wanted in the pink/purple color in uBlock settings. But ever since then, making changes to the extensions json in Google Admin just doesn't get updated in the browser. I've never been able to get adminSettings to work. I've been messing with it all day today and using: { "toAdd": { "Value" : { "trustedSiteDirectives": [ "examplesite1.com", " examplesite2.com" ] } } } The browser does show the above as valid syntax and updates when I chrome://policy > reload policy. However it's not marking the sites as allowed. I just haven't been able to get this to work reliably in Google Workspace. — Reply to this email directly, view it on GitHub <#1834 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AXUY6MH5KRZJQBRHR4E6RMDXJZZSPANCNFSM5ISC7GUA> . You are receiving this because you commented.Message ID: ***@***.*** com>

-- Confidentiality Statement:  The information accompanying this email transmission is intended for the use of the individual to whom it is addressed & may contain information which is privileged, confidential & exempt from disclosure under applicable law.  If you are not the intended recipient, employee or agent responsible for delivering the message to the intended recipient you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited.  If you have received this email in error please notify us immediately by telephone at 814-297-8400.

[itsbradwhite]

Hi there! I finally did get the changes to go into effect and the desired sites to show as trusted, but reloading policies + quitting/relaunching Chrome multiple times did not change anything. Looking at chrome://policy everything seems fine, the new sites show up there, no errors with that policy, etc. It's only after I go uBlock Settings > 'Reset to default settings...' and have uBlock reload that way do my desired sites actually show up in the purple color + trusted. I'm going to do more testing. This is the same behavior that @alex-daud was reporting in November of last year.

[cfvna271]

Yeah I think I recall that happening to me, it didn't really consistently work a certain way it would just end up applying EVENTUALLY after 30minutes sometime.

…

On Mon, Jun 5, 2023, 8:29 PM 'Brad White' via IT Department ***@***.***> wrote: Hi there! I finally did get the changes to go into effect and the desired sites to show as trusted, but reloading policies + quitting/relaunching Chrome multiple times did not change anything. Looking at chrome://policy everything seems fine, the new sites show up there, no errors with that policy, etc. It's only after I go uBlock Settings > 'Reset to default settings...' and have uBlock reload that way do my desired sites actually show up in the purple color + trusted. I'm going to do more testing. This is the same behavior that @alex-daud <https://github.com/alex-daud> was reporting in November of last year. — Reply to this email directly, view it on GitHub <#1834 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AXUY6MF4242HPIBDA5XBMGLXJZ2W5ANCNFSM5ISC7GUA> . You are receiving this because you commented.Message ID: ***@***.*** com>

-- Confidentiality Statement:  The information accompanying this email transmission is intended for the use of the individual to whom it is addressed & may contain information which is privileged, confidential & exempt from disclosure under applicable law.  If you are not the intended recipient, employee or agent responsible for delivering the message to the intended recipient you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited.  If you have received this email in error please notify us immediately by telephone at 814-297-8400.

[itsbradwhite]

Thanks for the sanity check. You're totally correct, I just wasn't waiting long enough. Everything appears fine after all.

When I make a change in Google Admin to uBlock json, it appears in chrome://policy right away.

But for it to actually go into effect and show up in uBlock, you just have to wait longer. It's all showing up as expected now! I just needed to be more patient.

Cheers.

[cfvna271]

Yep, seems like some wait on uBlock's part to pull it through. Glad to help! 👍

…

On Mon, Jun 5, 2023 at 8:46 PM 'Brad White' via IT Department ***@***.***> wrote: Thanks for the sanity check. You're totally correct, I just wasn't waiting long enough. Everything appears fine after all. When I make a change in Google Admin to uBlock json, it appears in chrome://policy right away. But for it to actually go into effect and show up in uBlock, you just have to wait longer. It's all showing up as expected now! I just needed to be more patient. Cheers. — Reply to this email directly, view it on GitHub <#1834 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AXUY6ME5F4B5UNDENS5OVS3XJZ4X3ANCNFSM5ISC7GUA> . You are receiving this because you commented.Message ID: ***@***.*** com>

-- Seth Weber Network & Systems Administrator 271 Perkins Road Clarion, PA 16214 Phone: 814-297-8400 Fax: 814-297-8801 https://cfvna.org/ [image: Clarion Forest VNA] [image: Like] <https://www.facebook.com/ClarionForestVNA> *Clarion Forest VNA is proudly ranked among the Top 500 Providers Nationwide!*

-- Confidentiality Statement:  The information accompanying this email transmission is intended for the use of the individual to whom it is addressed & may contain information which is privileged, confidential & exempt from disclosure under applicable law.  If you are not the intended recipient, employee or agent responsible for delivering the message to the intended recipient you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited.  If you have received this email in error please notify us immediately by telephone at 814-297-8400.

[gorhill]

It might be because uBO needs to be restarted twice after a change in policies. Related: uBlockOrigin/uAssets#16939 (comment)

[itsbradwhite]

Hi! Thank you for all your work.

I rebooted Chrome many, many times during testing. I can see in chrome://policy that the new uBlock policy settings are being reflected there. But it seems to just takes time (in addition to restarting Chrome at least once) before the Trusted Sites I've added to the Google Admin .json actually show up in uBlock settings.

I'm pretty sure it's just a Google Workspace thing and nothing with your extension, it is what it is. Just happy my settings are getting applied in the end.