Google Workspace OIDC

Audience: Google Workspace administrators wiring OpenID Connect for TokenTimer Enterprise.

Multi-provider SSO: Configure Google under System Settings → Manage SSO providers (or bootstrap via sso-providers.json / Helm ssoProviders[]). Sign-in and callback URLs are slug-scoped. See the OIDC quickstart first.

Google sign-in uses the Google OAuth 2.0 / OpenID Connect platform. This guide covers OIDC. Google Workspace also offers custom SAML applications; configure those using the SAML quickstart and verify their attribute and group mappings separately.

See the SSO identity provider guides for prerequisites and callback URLs.

URLs to register

Replace <slug> with your provider slug (e.g. google).

Purpose	Value
Authorized redirect URI	https://tokentimer.example.com/auth/oidc/<slug>/callback

---

1. Google Cloud project and OAuth client

1. Google Cloud Console: select or create a project.
2. APIs & Services, OAuth consent screen:
   • User type: Internal (Workspace only) or External (test/production).
   • Configure app name, support email, and scopes as required by your org.
3. APIs & Services, Credentials, Create credentials, OAuth client ID.
4. Application type: Web application (OpenID Connect guide).

Field	Value
Authorized JavaScript origins (optional)	https://tokentimer.example.com (APP_URL origin)
Authorized redirect URIs	https://tokentimer.example.com/auth/oidc/<slug>/callback

5. Note Client ID and Client secret for SSO Providers (or bootstrap manifest).

Workspace admins can restrict which client IDs are trusted under Admin console, Security, Access and data control, API controls (organization policy varies).

2. Issuer and discovery

Google's OIDC issuer (from the discovery document):

https://accounts.google.com

Discovery URL:

https://accounts.google.com/.well-known/openid-configuration

Set Issuer in SSO Providers to https://accounts.google.com (match the issuer claim in ID tokens: https://accounts.google.com or accounts.google.com per Google docs).

TokenTimer fetches authorization, token, userinfo, and JWKS from discovery unless overridden.

3. Scopes

TokenTimer default:

openid profile email

Google returns email, email_verified, name, picture, and sub in the ID token / userinfo (OpenID Connect).

Recommended claim paths in SSO Providers under Claim mapping:

Field	Paths
Email	email
Display name	name
Subject	sub

4. Groups (important limitation)

Google does not include Workspace group membership in standard OIDC tokens.

Keep a verified local system administrator when using standard Google OIDC. A group mapping cannot grant access from a group the provider never emits, so this provider alone cannot bootstrap an SSO-only administrator.

Use existing administrator access to assign workspace roles manually. If group-based grants or SSO-only bootstrap are required, use an identity broker or another provider that emits verified group claims. TokenTimer does not fetch Google directory groups or turn LDAP membership into OIDC claims.

5. Restrict sign-in to your domain (optional)

To limit login to @yourcompany.com:

• Set Internal user type on the consent screen (Workspace only), or
• After login, TokenTimer still validates email; you can enforce allowed domains in process (not a built-in env var). Google supports hd (hosted domain) on the authorize request; TokenTimer does not set hd by default. Configure Workspace to block consumer accounts if needed.

6. TokenTimer configuration

In SSO Providers (slug e.g. google):

Field	Value
Issuer	https://accounts.google.com
Client ID	<google-client-id>.apps.googleusercontent.com
Scopes	openid profile email

SSO_GOOGLE_OIDC_CLIENT_SECRET="<google-client-secret>"
API_URL=https://tokentimer.example.com
APP_URL=https://tokentimer.example.com

7. Verify

1. GET /api/auth/features returns your slug in providers.oidc[] with signInReady: true.
2. Sign in with a Workspace user; confirm email and sub in audit metadata.
3. For admin bootstrap: add a row under System Settings → Single Sign-On only when you have a verifiable group claim source.

Troubleshooting

Symptom	Likely cause	Fix
redirect_uri_mismatch	URI not in client	Add exact /auth/oidc/<slug>/callback
access_denied	User not allowed on consent screen	Set Internal or add test users
Invalid issuer	Wrong issuer string	Use https://accounts.google.com
No roles after login	No groups in token	Use an existing administrator to grant workspace membership, or use a provider that emits groups

Official references

• OpenID Connect
• OAuth 2.0 for Web server apps
• Discovery document