Google-OIDC Integration Guide

Operational Scenarios

Google Cloud's OIDC-based Single Sign-On (SSO) provides a secure authentication method that allows users to access multiple services with a single identity.

Google OIDC supports both internal and external user access control (if not a Google Workspace user, the application can only be provided to external users).

Prerequisites

• Have a Google account

Operation Steps

Configure OAuth2.0 Client Application

1. Log in to Google Cloud Console

2. Access security settings; navigate to APIs & Services > OAuth consent screen.

   

3. Choose to create a project or use an existing project

   

   

4. Create an application under the project，Fill in the branding and audience informatio

   

   

5. Create an OAuth2.0 client，Configure redirect address

   

6. After creation, download the OIDC related configuration for later HAP configuration of OIDC Single Sign-On

   

HAP Integration with OIDC Single Sign-On

For detailed steps, refer to the HAP private deployment documentation How to Integrate Single Sign-On - OIDC.

1. Configure sso.json, content as follows:

   

   {
     "mode": "common-oidc",
     "name": "oidc",
     "oidc": {
       "clientId": "x-x.apps.googleusxx",
       "clientSecret": "x-xxxyZwQgUtLSDL17Zpxxx",
       "oidcUrl": "https://accounts.google.com/.well-known/openid-configuration",
       "redirectUrl": "http://localhost:3000/oidc-redirect", 
       "responseTypes": "code",
       "scope": "openid email profile",
       "params": {
         "UserId": "sub",
         "Name": "name",
         "Email": "email"
       },
       "autoRegister": true,
       "projectId": ""
     }
   }

2. Mount the OIDC configuration file (as follows), then restart the service.

   - ./volume/sso/sso.json:/usr/local/MDPrivateDeployment/sso/OptionFile/sso.json 

3. Restart completed.

User SSO Login

1. Enter {HAP}/orgsso/oidc or {HAP}/orgsso/sso in the browser to log in.

2. Log in to the organizational account and authorize.

   

3. Switch to an external user.

   

4. Access is prohibited.