Skip to main content

Set up Google Workspace SSO

This guide walks a Google Workspace administrator through creating OAuth credentials for Oho so your team can sign in with their Google work accounts. It's the provider-specific companion to Set up SSO — read that first for how SSO configuration works in Oho and what changes for your team.

Who this is for

You'll need access to the Google Cloud Console for a project in your organisation, and rights to configure the OAuth consent screen. Oho connects to Google over OIDC.

  1. In the Google Cloud Console, pick (or create) a project for this.
  2. Go to APIs & Services → OAuth consent screen.
  3. Choose Internal as the user type so only people in your Workspace can use it, then click Create.
  4. Fill in the app name (for example Oho), a support email, and a developer contact email. Save.

Expected outcome: an Internal consent screen exists for your Oho app.

Step 2: Create the OAuth client ID​

  1. Go to APIs & Services → Credentials → Create Credentials → OAuth client ID.
  2. Choose Web application as the application type and give it a name.
  3. Under Authorised redirect URIs, add the callback URL shown on Oho's SSO settings screen (Settings → Developer → Single Sign-On) — your Oho URL followed by /callback/oidc.
  4. Click Create. Google shows your Client ID and Client secret — keep this dialog open, or download the JSON, so you can copy them.
Register the exact redirect URI Oho shows you

Google rejects the sign-in if the redirect URI doesn't match exactly — including https:// and any trailing path. Copy the value from Oho's SSO screen rather than typing the pattern from memory.

Expected outcome: you have a Client ID and Client secret for a Web application, with the Oho callback registered as an authorised redirect URI.

Step 3: Enter the details in Oho​

In Oho, go to Settings → Developer → Single Sign-On, turn on Enable Single Sign-On, choose OpenID Connect, and enter:

  • Client ID
  • Client secret
  • Discovery URI — Google's is the same for everyone: https://accounts.google.com/.well-known/openid-configuration

Set the Username Claim to email. Click Test connection, then Save.

The client secret is a credential

Anyone with the client secret can impersonate the Oho app against your Google project. Paste it straight into Oho's SSO screen rather than emailing or ticketing it, and rotate it in the Cloud Console if it's ever exposed.

Expected outcome: SSO is enabled in Oho with your Google details, and the connection test passes.

Step 4: Test the first sign-in​

After the connection test passes and you've saved:

  1. Go to your Oho URL in a private/incognito window.
  2. You're redirected to Google — sign in with a Workspace account.
  3. You're returned to Oho, signed in.

Expected outcome: a Workspace user can sign in to Oho end to end.

Common questions​

Google shows "Access blocked" or an unverified-app warning. Make sure the consent screen is set to Internal. Internal apps used only within your own Workspace don't need Google's verification.

Sign-in fails with redirect_uri_mismatch. The redirect URI on the OAuth client doesn't exactly match the callback URL on Oho's SSO screen. Re-check it in Credentials against the value shown there.

Can I map Google groups to Oho roles? Google's standard OIDC token doesn't include group membership, so role placement from Google groups isn't available the way it is with Okta or Entra. Assign roles in Oho instead — see Roles & access.