Google Workspace
Sign in with Google for your Workspace domain. Google has no roles for an app, so roles are given in the desk: people you invite sign in with Google from then on, and someone new can be created at their first sign-in with a role you choose.
1. Make an OAuth client
In the Google Cloud console, in a project of your organization:
- Google Auth Platform → Branding: the app's name and support email. Under Audience, choose Internal, so only accounts of your Workspace can sign in.
- Clients → Create client: type Web application, and under Authorized redirect URIs the address shown on
the desk's Identity providers page (
https://<your desk>/api/v1/auth/sso/callback). - Copy the Client ID and Client secret.
2. Set it up in the desk
Platform → Identity providers → Google Workspace → Set up:
| Field | What to enter |
|---|---|
| Client ID, Client secret | From step 1. |
| Email domains | Your Workspace domains. Accounts from any other domain are refused, also personal Gmail accounts. |
| Create people at their first sign-in | Off: only people already in the desk sign in; invite people under Users as before. On: someone new in your domain is created, placed in the unit and given the role you choose. |
| Google Workspace asks for a second factor | On when 2-Step Verification is enforced in your Workspace: the desk doesn't ask again. |
People already in the desk keep their roles, units and teams; Google only proves who they are.