The following steps will integrate Google SSO using OpenID Connect (OIDC).

​
Prerequisites

Before you can start, you’ll need to create or edit a Project in Google Developers Console.

​
Setting up your Project

Create a new Project, or use an existing Project you’ve already created in the Google Developers Console. Setting the organization isn’t required, unless you intend to use SSO for more than 100 users externally (not via Google Workspace). Once created, or you’ve opened an existing Project, you may be on the project dashboard, where you will need to open the sidebar. If you are on the welcome page, continue by selecting OAuth consent screen in APIs and services. You should see that Google Auth Platform is not configured. Press Get started and fill in the relevant information, such as your App name and User support email. These will be visible when the user is authenticating. After continuing, you can select an Audience. If you are using Pangolin for friends and family, use the External Audience. You can only have 100 users authenticated with a “Testing” status.
Depending on your use case, you may want to use the Internal Audience if you are utilising Google Workspace SSO and paying for access to the Professional Edition.
Once completed, you will then need to open the Branding tab. Locate Authorized domains, then press “Add domain” to add an authorized domain. You’ll need to authorize the top private (root) domain here, such as example.com. Your SSO may function without an authorized domain, though setting this field should guarantee functionality.

​
Creating an OAuth client ID in your Project

Go to the Clients tab, and click “Create client” below the top bar.
1

Select Application Type

For Application type, select Web application.
2

Set Name

Any Name can be set.
3

Leave Redirect URIs Empty

Leave Authorised JavaScript origins and Authorised redirect URIs empty.
We will revisit the Authorised redirect URIs field later, as we do not have Pangolin set up for Google yet.
After hitting “Create”, you will be able to see the Client ID and Client secret, you may want to copy these somewhere as these will be needed momentarily, though they will still be accessible in the future.

​
Configuring Identity Providers in Pangolin

In Pangolin, go to the Server Admin section. Select “Identity Providers” before proceeding with the “Add Identity Provider” button. Name should be set to something memorable. The Provider Type should be set to the default OAuth2/OIDC.

​
OAuth2/OIDC Configuration (Provider Credentials and Endpoints)

In the OAuth2/OIDC Configuration, you’ll need the following fields:
​
Client ID
string
required
The Client ID from your Web application client.
​
Client Secret
string
required
The Client secret from your Web application client.
​
Authorization URL
string
required
Set to https://accounts.google.com/o/oauth2/v2/auth.
​
Token URL
string
required
Set to https://oauth2.googleapis.com/token.

​
Token Configuration

You should leave all of the paths default. In the Scopes field, add openid profile email.
Currently, the only way to obtain your sub identifier attribute via Google is through direct API access. For now, set the Identifier Path to email and in the Username field, and use the associated account’s email. We highly recommend increasing the resilience of your Google SSO by setting the optional Name field to match the account’s (full name attached to their Google account).
When you’re done, click “Create Identity Provider”! Then, copy the Redirect URL in the “General” tab as you will now need this for your Web application client.

​
Returning to Google Developers Console

Lastly, you’ll need to return to your Web application client in order to add the redirect URI created by Pangolin. Add the URI to Authorized redirect URIs, then hit “Save”! Your configuration should now be complete. You’ll now need to add an external user to Pangolin, or if you have “Auto Provision Users” enabled, you can now log in using Google SSO.