Connect Your App to Google Workspace
Using Google Social and Enterprise Connections
If you have an existing Google Social Connection for your application and you create a new Google Workspace connection for the same domain, users affiliated with the social connection with now be logged in with the new enterprise connection. This will occur regardless of whether you enable the Google Workspace enterprise connection.
Prerequisites
Before you begin:
Register your Application with Auth0.
Select an appropriate Application Type.
Add an Allowed Callback URL of
{https://yourApp/callback}
.Make sure your Application's Grant Types include the appropriate flows.
Steps
To connect your application to Google Workspace, you must:
Google Workspace account
Before proceeding, you will need a valid Google Workspace account and must have your own Google Workspace Organization for which you are an administrator.
Set up your app in Google
To allow users to log in using Google Workspace, you must register your application in the Google developer console.
Register a new application
To learn how to register a new application with Google, follow Google's Setting up OAuth 2.0 doc. During this process, Google will generate a Client ID and Client Secret for your application; make note of these.
While setting up your app, be sure to use these settings:
On the OAuth consent screen, under Authorized domains, add
auth0.com
.When asked to select an application type, choose Web application and set the following parameters:
Field Description Name The name of your application. Authorized JavaScript origins https://{yourDomain}
Authorized redirect URIs https://{yourDomain}/login/callback
Find your Auth0 domain name for redirects
If your Auth0 domain name is not shown above and you are not using our custom domains feature, your domain name is a concatenation of your tenant name, your regional subdomain, and
auth0.com
, separated by the dot (.
) symbol.For example, if your tenant name is
exampleco-enterprises
, and your tenant is in the US region, your Auth0 domain name would beexampleco-enterprises.us.auth0.com
and your Redirect URI would behttps://exampleco-enterprises.us.auth0.com/login/callback
.However, if your tenant is in the US region and was created before June 2020, then your Auth0 domain name would be
exampleco-enterprises.auth0.com
and your Redirect URI would behttps://exampleco-enterprises.auth0.com/login/callback
.If you are using custom domains, your Redirect URI would be
https://<YOUR CUSTOM DOMAIN>/login/callback
.
Enable the Admin SDK Service
If you plan to connect to Google Workspace enterprise domains, you need to enable the Admin SDK Service. To learn how, follow Google's Enable and disable APIs doc.
Create an enterprise connection in Auth0
Next, you will need to create and configure a Google Workspace Enterprise Connection in Auth0. Make sure you have the Client ID and Client Secret generated when you set up your app in the Google developer console.
Navigate to Auth0 Dashboard > Authentication > Enterprise, locate Google Workspace, and click its
+
.Enter details for your connection, and select Create:
Field Description Connection name Logical identifier for your connection; it must be unique for your tenant. Once set, this name can't be changed. Google Workspace Domain Google Workspace domain name for your organization. Client ID Unique identifier for your registered Google application. Enter the saved value of the Client ID for the app you just registered in the Google developer console. Client Secret String used to gain access to your registered Google application. Enter the saved value of the Client Secret for the app you just registered in the Google developer console. Attributes Basic attributes for the signed-in user that your app can access. Indicates how much information you want stored in the Auth0 User Profile. Options include: Basic Profile ( email
,email verified
flag) and Extended Profile (name, public profile URL, photo, gender, birthdate, country, language, and timezone).Extended Attributes Extended attributes for the signed-in user that your app can access. Options include: Groups (distribution list(s) to which the user belongs), Is Domain Administrator (indicates whether the user is a domain administrator), Is Account Suspended (indicates whether the user's account is suspended), and Agreed to Terms (indicates whether the user has agreed to the terms of service). Auth0 APIs When Enable Users API is selected, indicates that you require the ability to make calls to the Google Directory API. Sync user profile attributes at each login When enabled, Auth0 automatically syncs user profile data with each user login, thereby ensuring that changes made in the connection source are automatically updated in Auth0. If you have appropriate administrative permissions to configure your Google Workspace settings so you can use Google's Admin APIs, then click Continue. Otherwise, provide the given URL to your administrator so that they can adjust the required settings.
On the Login Experience tab, you can configure how users log in with this connection.
Field Description Identity Provider domains A comma-separated list of the domains that can be authenticated in the Identify Provider. This is only applicable when using Identifier First authentication in the Universal Login Experience. Add button (Optional) Display a button for this connection in the login page. Button display name (Optional) Text used to customize the login button for new Universal Login. When set the button reads: "Continue with {Button display name}". Button logo URL (Optional) URL of image used to customize the login button for new Universal Login. When set, the Universal Login login button displays the image as a 20px by 20px square.
Enable the enterprise connection for your Auth0 application
To use your new AD connection, you must first enable the connection for your Auth0 Applications.
Test the connection
Now you're ready to test your connection.
Requesting Refresh Tokens from Google
Google always returns an Access Token, which is stored in the user profile. If you add access_type=offline&approval_prompt=force
to the authorization request, Auth0 will forward these parameters to Google. Google will then return a Refresh Token, which will also be stored in the user profile.
Reauthorizing existing connections
If a Google Workspace admin is deleted, any Google Workspace Enterprise connections they have set up and authorized will need to be reauthorized by a new Google Workspace admin to avoid login failures. This can be done by having the new admin use the link in the Setup tab for the Google Workspace Enterprise connection.