Google Workspace OIDC

Audience: Google Workspace administrators wiring OpenID Connect for TokenTimer Enterprise.

Multi-provider SSO: Configure Google under System Settings → Manage SSO providers (or bootstrap via sso-providers.json / Helm ssoProviders[]). Sign-in and callback URLs are slug-scoped. See the OIDC quickstart first.

Google sign-in uses the Google OAuth 2.0 / OpenID Connect platform. TokenTimer does not use SAML against Google directly; use OIDC or a SAML bridge IdP.

See the SSO identity provider guides for prerequisites and callback URLs.

URLs to register

Replace <slug> with your provider slug (e.g. google).

Purpose	Value
Authorized redirect URI	https://tokentimer.example.com/auth/oidc/<slug>/callback

---

1. Google Cloud project and OAuth client

1. Google Cloud Console: select or create a project.
2. APIs & Services, OAuth consent screen:
   • User type: Internal (Workspace only) or External (test/production).
   • Configure app name, support email, and scopes as required by your org.
3. APIs & Services, Credentials, Create credentials, OAuth client ID.
4. Application type: Web application (OpenID Connect guide).

Field	Value
Authorized JavaScript origins (optional)	https://tokentimer.example.com (APP_URL origin)
Authorized redirect URIs	https://tokentimer.example.com/auth/oidc/<slug>/callback

5. Note Client ID and Client secret for SSO Providers (or bootstrap manifest).

Workspace admins can restrict which client IDs are trusted under Admin console, Security, Access and data control, API controls (organization policy varies).

2. Issuer and discovery

Google's OIDC issuer (from the discovery document):

https://accounts.google.com

Discovery URL:

https://accounts.google.com/.well-known/openid-configuration

Set Issuer in SSO Providers to https://accounts.google.com (match the issuer claim in ID tokens: https://accounts.google.com or accounts.google.com per Google docs).

TokenTimer fetches authorization, token, userinfo, and JWKS from discovery unless overridden.

3. Scopes

TokenTimer default:

openid profile email

Google returns email, email_verified, name, picture, and sub in the ID token / userinfo (OpenID Connect).

Recommended claim paths in SSO Providers under Claim mapping:

Field	Paths
Email	email
Display name	name
Subject	sub

4. Groups (important limitation)

Google does not include Workspace group membership in standard OIDC tokens.

Options:

1. Admin role only: add a System Settings → Single Sign-On row for a group name you document out-of-band (Google does not emit groups).
2. Custom claim: Use Google Cloud Identity / Secure LDAP / third-party provisioning to add a custom claim (not covered here; requires Google-side transformation).
3. Different IdP: Use Entra, Okta, or Keycloak if group-based role mapping is required without custom infrastructure.

Do not set a groups claim path expecting it to work without a custom mapper; leave group mappings empty and use workspace roles manually, or choose another IdP.

5. Restrict sign-in to your domain (optional)

To limit login to @yourcompany.com:

• Set Internal user type on the consent screen (Workspace only), or
• After login, TokenTimer still validates email; you can enforce allowed domains in process (not a built-in env var). Google supports hd (hosted domain) on the authorize request; TokenTimer does not set hd by default. Configure Workspace to block consumer accounts if needed.

6. TokenTimer configuration

In SSO Providers (slug e.g. google):

Field	Value
Issuer	https://accounts.google.com
Client ID	<google-client-id>.apps.googleusercontent.com
Scopes	openid profile email

SSO_GOOGLE_OIDC_CLIENT_SECRET=<google-client-secret>
API_URL=https://tokentimer.example.com
APP_URL=https://tokentimer.example.com

7. Verify

1. GET /api/auth/features returns your slug in providers.oidc[] with signInReady: true.
2. Sign in with a Workspace user; confirm email and sub in audit metadata.
3. For admin bootstrap: add a row under System Settings → Single Sign-On only when you have a verifiable group claim source.

Troubleshooting

Symptom	Likely cause	Fix
redirect_uri_mismatch	URI not in client	Add exact /auth/oidc/<slug>/callback
access_denied	User not allowed on consent screen	Set Internal or add test users
Invalid issuer	Wrong issuer string	Use https://accounts.google.com
No roles after login	No groups in token	Expected; use mappings only if you add custom claims

Official references

• OpenID Connect
• OAuth 2.0 for Web server apps
• Discovery document