Google Workspace

Before you start#

• You need Google Workspace admin access.
• Vectis support completes the configuration on the Vectis side, so be ready to send them the details below.

Step 1: Create OAuth 2.0 credentials#

1. Open Google Cloud Console

   Go to the Google Cloud Console and create a project or select an existing one.

2. Create an OAuth client ID

   Go to APIs & Services → Credentials, then select Create Credentials → OAuth client ID and set:

   • Application type: Web application
   • Name: Vectis SSO
   • Authorized redirect URIs: https://<your Vectis address>/sso/callback

3. Create

   Select Create, then note the Client ID and Client Secret.

Step 2: Configure the OAuth consent screen#

1. Go to APIs & Services → OAuth consent screen.
2. Select Internal (for Google Workspace accounts only).
3. Fill in the application details.
4. Add the scopes openid, email and profile.
5. Complete the wizard.

Step 3: Send the details to Vectis#

Send Vectis support:

• Client ID and Client Secret from step 1.
• Domain: your Google Workspace domain, such as company.com.

The issuer URL for Google is https://accounts.google.com, and Vectis fills it in automatically.

Step 4: Verify your domain#

Vectis gives you a verification token for your domain. Create a DNS TXT record with it, then let Vectis know so the domain can be verified.

Notes#

• Google Workspace doesn't include group claims in OIDC tokens by default.
• For automated user management, use SCIM provisioning through the Google Workspace Directory API. See SCIM provisioning.
• Google's OIDC discovery endpoint is https://accounts.google.com/.well-known/openid-configuration.