Q:

How to restrict Gerrit access to only a few Google email addresses?

I would like only a few persons all having Google email addresses to be able to do source code review on our Gerrit server. All other access to the Gerrit server should be blocked.
These Google email addresses are published on the public web site of our work office so the email addresses themselves can't be kept secret.
I would like to avoid LDAP for the Gerrit configuration, as it adds too much of complexity (in my opinion).
I started out by creating an Amazon EC2 instance running Ubuntu 14.04. I then configured the  Amazon EC2 firewall to block all access to the instance other than from the IP address of my local desktop computer. Of course this needs to be changed later when the Gerrit server has been properly configured. The allowed users should be able to access the Gerrit server from anywhere in the world so later there will be no IP address restriction.
The Gerrit configuration looks like this right now:
$ grep -A1 auth ~/gerrit/etc/gerrit.config
[auth]
    type = OPENID

It seems Google has deprecated its OpenID 2.0 service so I couldn't log in to the Gerrit web interface with my Google email address directly. But instead I could log in by first signing up on the Verisingslabs OpenID provider website.
What are the configuration steps necessary to give only a few Google email addresses read-write access but blocking all other kinds of access to the Gerrit server?

A:

If you want to allow only certain people, start with creating an user group (e.g. developers). Give access to your projects only for that group and forbid anonymous access. Make people register with their OpenId provider (as you mentioned, it is no longer possible with Google directly). Then add them to user group you have created so you can manage per-projects permission directly from the web interface without altering any backend configuration.
You might end up here but if you want to strenghten user verifications (i.e. to avoid adding some account to privileged group accidentally), take a look at auth.trustedOpenId option and investigate your users' OpenId identities in the account_external_ids table in Gerrit's database.
mysql> SELECT email_address,external_id FROM account_external_ids;
+---------------------------+----------------------------------------------------------------------------------+
| email_address             | external_id                                                                      |
+---------------------------+----------------------------------------------------------------------------------+
| user1@gmail.com           | https://www.google.com/accounts/o8/id?id=AItOawlLlop2Tsff-minfwxCQDD6iUznIr7XX6A |
| user2@gmail.com           | https://www.google.com/accounts/o8/id?id=AItOawlSyAHBwdEojjUUdsmVx7UElthSGRby4ho |
| user3@gmail.com           | https://www.google.com/accounts/o8/id?id=AItOawmiLGmvJIvx6jiPrNQ8NgovAqsA0NNq985 |
+---------------------------+----------------------------------------------------------------------------------+
3 rows in set (0.00 sec)

Then add to your ~/gerrit/etc/gerrit.config file only ids that you desire:
[auth]
    type = OPENID
    trustedOpenId = https://www.google.com/accounts/o8/id?id=AItOawlLlop2Tsff-minfwxCQDD6iUznIr7XX6A ; user1@gmail.com
    trustedOpenId = https://www.google.com/accounts/o8/id?id=AItOawmiLGmvJIvx6jiPrNQ8NgovAqsA0NNq985 ; user3@gmail.com

In above configuration, only user1@gmail.com and user3@gmail.com will be allowed to have permissions beyond those granted to the Anonymous Users and Registered Users groups. 
Notice, that after you create first non-default trustedOpenId entry, other users that register in your Gerrit instance will be treated as Untrusted - you may verify it by going to Settings -> Identities and investigating the Status column for particular e-mail address. Therefore, such user will not be able to see any projects with non-public access rights. It will happen when you authenticate with user2@gmail.com in the presented example.

Also note that is is a good idea to enter e-mail addresses after the trustedOpenId entries in a comment (; sign is a comment) so the list is maintainable.
Last thing to remember is to restart your Gerrit instance after any change in gerrit configuration file.

