Configure OpenID Connect Google login

Owned by Juha Koponen
Last updated: 2021-02-04
4 min read

You will use this article when you need to configure Google login as an authentication method (using OpenID Connect).

Step-by-step guide

  1. Log in to https://console.developers.google.com/ with a Google account.

  2. Create a new project
  3. Once created, select your project and choose "Credentials"



  4. Click the button "Create credentials" and choose "OAuth client ID"


  5. Choose web application
  6. In the "OAuth consent screen" fill in at least the Application name field and also
    add your domain (e.g. smartplan.com) to "Authorized Domains." Press Enter and then press Save.





  7. Select "web application" and give it a name. Click "Create"


  8. You will see your client ID and your client secret in a screen like this:



  9. The next step is to create and configure OpenID Connect authentication method using SSO management API. You can find example REST calls in attached postman collection: Register OpenID Connect Google method.postman_collection.json Review also the product documentation for "OpenID Connect authentication method" for the IDS version you are using.

  10. Copy the redirect URI from registration request and paste it to the list of authorized redirect URIs in Google API console (First, go to "Credentials" and select the web client):



  11. From now on, you must configure an application to use the newly created method.
  12. In this how-to article, we will connect to Sample SAML application.
  13. New authentication methods must be expressly enabled before use on a site by site basis. You must enable the authentication method on the site where it will be used. Choose the site where the target application is configured from the Site Navigator and open the Site Methods tab. Choose Add Method... and select the Google method you created with SSO management API.

  14. Then in tab "Applications" add the application (sample, in this case).


  15. For access control, we will create a dynamic group called "googleuser" where membership is based on the authentication method used to login. In the site view, choose Groups, New Group..., enter the name "googleuser", and select the Google authentication method from the Allowed Methods tab.

  16. Now it's time to configure your application. On the site navigator, select the site where your application is located (e.g. Applications site), go to tab "Application" and click on your application (e.g. sample).


  17. In "Allowed methods" tab, enable Google authentication method and press "Update."


  18. In "Allowed To" tab, add the group of users that are allowed to access the application (e.g. googleuser).


  19. Now the configuration is done and a Google user should be able to log in to sample application (or any application you wish to).

  20. Open the application in a new browser tab. Depending how you installed your sample application, the URL should be similar to: http://localhost:8090/sample/


  21. When you press login, a Ubisecure login page will prompt:

    Observe that if you hover the additional button under "Sign in With," this corresponds to Google authentication.

  22. Click on the button and you will be redirected to Google login page:


  23. Log in with your Google credentials and you will see a screen like this:
  24. Use an authorization policy to map the attributes names sent by Google to the attribute names expected by your application. Filter any unused attributes.
  25. (Optional) Directory user mapping can be used to look up an existing database user with matching attributes (see Directory User Mapping)
  26. (Optional) User Driven Federation can be used to allow a user to link their google account to an existing database user when there are no matching attributes (see User Driven Federation)
  27. To customize the logo used, see method-image.index settings.

  28. To customize the text shown when hovering on the button, edit the "Title" field in the authentication method: 

 

General parameters for selected OAuth 2.0 Identity Providers - SSO




Ubisecure Privacy Policy & Cookie Statement