import Image from "next/image";

# Enable SSO with Google Workspace (OIDC)

Firezone supports Single Sign-On (SSO) using Google Workspace and Cloud Identity
through the generic OIDC connector. This guide will walk you through how to
obtain the following config settings required for the integration:

1. **Config ID**: The provider's config ID. (e.g. `google`)
1. **Label**: The button label text that shows up on your Firezone login screen.
   (e.g. `Google`)
1. **Scope**:
   [OIDC scopes](https://openid.net/specs/openid-connect-basic-1_0.html#Scopes)
   to obtain from your OIDC provider. This should be set to
   `openid email profile` to provide Firezone with the user's email in the
   returned claims.
1. **Response type**: Set to `code`.
1. **Client ID**: The client ID of the application.
1. **Client secret**: The client secret of the application.
1. **Discovery Document URI**: The
   [OpenID Connect provider configuration URI](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig)
   which returns a JSON document used to construct subsequent requests to this
   OIDC provider.

<Image className="mx-auto"
  alt="firezone google sso login"
  src="/images/firezone-google-sso-login.gif"
  width={960}
  height={540}
/>

## Step 1: Configure OAuth consent screen

If this is the first time you are creating a new OAuth client ID, you will be
asked to configure a consent screen.

**IMPORTANT**: Select `Internal` for user type. This ensures only accounts
belonging to users in your Google Workspace Organization can create device
configs. DO NOT select `External` unless you want to enable anyone with a valid
Google Account to create device configs.

<Image className="mx-auto"
  alt="oauth consent internal"
  src="/images/oauth-consent-internal.png"
  width={960}
  height={540}
/>

On the App information screen:

1. **App name**: `Firezone`
1. **App logo**: [save link as](/images/save-logo.png).
1. **Application home page**: the URL of your Firezone instance.
1. **Authorized domains**: the top level domain of your Firezone instance.

<Image className="mx-auto"
  alt="oauth consent app info"
  src="/images/oauth-consent-app-info.png"
  width={960}
  height={540}
/>

On the next step add the following scopes:

<Image className="mx-auto"
  alt="oauth consent scopes"
  src="/images/oauth-consent-scopes.png"
  width={960}
  height={540}
/>

## Step 2: Create OAuth client

_This section is based off Google's own documentation on
[setting up OAuth 2.0](https://support.google.com/cloud/answer/6158849)._

Visit the Google Cloud Console
[Credentials page](https://console.cloud.google.com/apis/credentials) page,
click `+ Create Credentials` and select `OAuth client ID`.

<Image className="mx-auto"
  alt="create oauth client id"
  src="/images/create-oauth-client-id.png"
  width={960}
  height={540}
/>

On the OAuth client ID creation screen:

1. Set `Application Type` to `Web application`
1. Add your Firezone `EXTERNAL_URL + /auth/oidc/<Config ID>/callback/` (e.g.
   `https://firezone.example.com/auth/oidc/google/callback/`) as an entry to
   Authorized redirect URIs.

<Image className="mx-auto"
  alt="create oauth client id"
  src="/images/create-oauth-client-id-2.png"
  width={960}
  height={540}
/>

After creating the OAuth client ID, you will be given a Client ID and Client
Secret. These will be used together with the redirect URI in the next step.

<Image className="mx-auto"
  alt="copy client id and secret"
  src="/images/copy-client-id-and-secret.png"
  width={960}
  height={540}
/>

## Step 3: Integrate with Firezone

Navigate to the `/settings/security` page in the admin portal, click "Add OpenID
Connect Provider" and enter the details you obtained in the steps above.

Enable or disable the **Auto create users** option to automatically create an
unprivileged user when signing in via this authentication mechanism.

And that's it! The configuration should be updated immediately. You should now
see a `Sign in with Google` button on the sign in page.
