Google external IDP
The Google social connection lets users log in to your application using their Google profile.
Request credentials at Google
Google also describes their registration process.
Prerequisites
This process requires:
Create a project at Google
- Log in to your Google Developer account.
- Create a new project, which requires that you enter a name or select an existing project.
Obtain OAuth credentials
-
If the APIs & services page isn't already open, open the console left-side menu and select APIs & services.
-
On the left, click the Credentials page.
-
Click New Credentials and then select OAuth client ID.
-
For the application type, select Web Application.
-
Add your Authorized JavaScript origins:
https://<tenant-domain> -
Add your Authorized redirect URIs, which looks like:
https://<tenant-domain>/broker/authentication/callback. -
Click Create.
Copy the credentials
-
On the next page, copy the Client ID.
-
Copy the Client secret.
Customize the consent screen (Optional)
The Google documentation explains how set up the consent screen.
Configure Google as an external IDP in the Identity Broker
- Click Add identity provider and select OpenID Connect.
Typically, you fill in the following connection details:
- Display name: Google (just an example)
- Active: Select the check box
- Client ID: The Client ID that you copied
- Authentication method: Client secret post
- Client secret: The Client secret that you copied
- Well-known configuration endpoint: Enter
https://accounts.google.com/.well-known/openid-configurationand click Load.- This prefills the Authorization endpoint, Token endpoint, Issuer, User information endpoint, and JWKs URI.
- Signature type:
Asymmetric - Encrypted JWT: Do not select the check box
- Single logout: Do not select the check box
Google IDP variant
You always need at least one variant. For Google, you only need to configure a variant name, such as Authentication.
For scopes, Thales recommends openid, email, and profile, but you can add more scopes.
