Google Workspace

This page covers the Google side. Saving, testing and activating the connection are in Single Sign-On (OIDC).

Create the OAuth client

In the Google Cloud console, choose or create a project in your Workspace organization.
Under Google Auth Platform (APIs & Services → OAuth consent screen in older consoles), configure the app with the audience (user type) Internal, so that only users in your Workspace organization can sign in.
Under Clients (Credentials), select Create client (Create credentials → OAuth client ID) and choose the application type Web application.
Under Authorized redirect URIs, add the connection’s redirect URI: https://<console host>/oauth/sso/callback. Create.
Copy the Client ID and Client secret.

Google’s ID tokens carry neither amr nor acr, so an MFA policy refuses every Google Workspace sign-in it applies to. Keep the MFA policy at none and enforce 2-Step Verification in the Google Admin console instead.

Issuer

https://accounts.google.com

Scopes and claims

The default scopes, openid email profile, are enough. Google sends email, email_verified and name in the ID token, so the default claim mapping works as is. It also sends hd, the user’s Workspace domain. Google does not send groups in ID tokens, so a Google Workspace connection carries no groups.

Example

{
  "issuer": "https://accounts.google.com",
  "client_id": "123456789012-abc123def456ghi789jkl012mno345pq.apps.googleusercontent.com",
  "client_secret": "<client secret>"
}

Then run a test login and activate the connection; see Single Sign-On (OIDC).

​Google Workspace

​Create the OAuth client

​Issuer

​Scopes and claims

​Example

Google Workspace

Create the OAuth client

Issuer

Scopes and claims

Example