Set up single sign-on with Google Workspace

This guide covers the Google side of single sign-on: creating an OAuth client for Astrato in Google Cloud and collecting its credentials. It then hands back to the Astrato steps, which are the same for every provider.

A Google Workspace connection differs from the OpenID Connect providers in three ways. It asks for your Google Workspace domain instead of an issuer URL and a list of domains. It has no Scope field. And it does not offer Enable roles synchronization or Enable groups synchronization, so groups and roles cannot be synced from Google; see Sync groups and roles for the providers that can.

Before you start

• You meet the requirements in Set up single sign-on, and have read Do not lock yourself out.
• You can create OAuth clients in a Google Cloud project that belongs to your Google Workspace organisation.
• You know your Google Workspace domain, for example example.com. The connection takes one domain.

Values you will bring back to Astrato

Astrato Setup field	Where it comes from
Connection name	A name of your choice
Google Workspace domain	The domain your people sign in with, for example example.com
Client ID	The OAuth client’s Client ID in Google Cloud
Client secret	The OAuth client’s Client secret in Google Cloud

Copy the redirect URIs from Astrato

1. In Astrato, open Administration → Enterprise Connection and stay on Login connections.

2. Select Add connection and choose Google Workspace in Select a Login provider.

3. Leave the Configuration tab open. Under Sign in redirect URI it lists two addresses, then the Sign out redirect URL and the scopes openid profile email.

   

Create the OAuth client in Google Cloud

The Google Cloud screens change from time to time. The steps below name what to set; Google’s own guide, Setting up OAuth 2.0, shows where.

1. In the Google Cloud console, open or create the project that will hold the client.
2. Configure the OAuth consent screen for the project if it has none yet. Choosing the Internal audience limits sign-in to accounts in your Google Workspace organisation.
3. Create an OAuth client ID with the application type Web application.
4. Under Authorized redirect URIs, add both Sign in redirect URI addresses from Astrato’s Configuration tab, exactly as shown.
5. Make sure the scopes openid, email and profile are allowed for the project.
6. Save the client, then copy its Client ID and Client secret. Google may show the secret only once.

Finish in Astrato

1. Go back to the Add connection dialog and select Continue to Setup.

2. Fill in Connection name, Google Workspace domain, Client ID and Client secret.

3. Tick Allow users outside the identity provider domain to sign in without SSO while you set up. Owners and Administrators can always sign in without SSO.

4. Select Create. The connection appears in the list as Not enabled.

   

Then follow Verify the connection: select Verify connection on Setup and choose a Google account in your domain in the window that opens. When the status reads Enabled, continue with Test a normal sign-in.

If sign-in fails

What you see	Likely cause	What to do
Google reports a redirect URI mismatch	A Sign in redirect URI is missing from the client, or differs from Astrato’s	Add both addresses from Astrato’s Configuration tab to Authorized redirect URIs
Google refuses an account from outside your organisation	The consent screen audience is Internal	Sign in with an account in your Google Workspace domain
A user is not sent to Google	Their email domain differs from Google Workspace domain	Correct the domain on Setup and save

For errors on the Astrato side, see Common errors.

What next

• Test a normal sign-in before you clear Allow users outside the identity provider domain to sign in without SSO.
• Provision users and groups with SCIM, if your directory has a SCIM client.
• Invite users and manage groups.