Skip to content
downpipes docs

Sign in to downpipes with Google Workspace

downpipes signs people in to the console against Google Workspace over OpenID Connect, restricted to your own Workspace domain. Google does not put group membership in its ID token, so invite each person by email inside downpipes before they sign in. The shared add-a-connection mechanics and the pre-save test live on Connect OIDC or OAuth2.

What you need

  • A Google Cloud project owned by your Workspace organisation, where you can create an OAuth client.
  • Owner access to the downpipes console, since connection management is owner-only and asks for a step-up sign-in.

Set it up

  1. In the Google Cloud console, create or select a project owned by your Workspace organisation.
  2. Open Google Auth Platform, then Audience, and set User type to Internal. Internal limits sign-in to your organisation and skips Google’s external app-verification review.
  3. Under Branding set an app name and support email, and under Data Access add the openid, email and profile scopes.
  4. Open Google Auth Platform, then Clients, Create Client, set Application type to Web application, and under Authorized redirect URIs add your downpipes callback URL, which is your console origin followed by /admin/oidc/callback/<connId>, for example https://console.example.com/admin/oidc/callback/google.
  5. Copy the Client ID and Client Secret (the full secret is shown only once).
  6. In the downpipes console, open Govern, Identity providers (the /access/idp screen), choose the Google Workspace tile to open its add form. This is owner-only and asks for a step-up sign-in.
  7. Enter your exact Workspace domain (for example yourcompany.com), paste the client id and secret, run Test connection, then choose Add Google Workspace.

Group-to-role mapping

Google does not put group membership in the ID token, so invite each person by email inside downpipes. The engine refuses a person with no invite or role at sign-in. See Group-to-role mapping for how those per-person grants sit alongside group mapping for the providers that do send groups.

Good to know

  • The Workspace-domain gate is mandatory. Without it any consumer Google account could sign in. downpipes enforces your domain server-side. The signed hd (hosted-domain) claim decides alone: a token whose hd is not your domain is refused, even when its email is in your domain, and a Google token with no hd claim is refused. A spoofed hd value cannot pass. Each person in your domain still needs an invite or a role.
  • Choose Internal, not External. Internal limits sign-in to your organisation and avoids Google’s app-verification review.
  • Google serves its signing keys and token endpoint on sibling hosts, which the preset already pins, so you do not configure them by hand.
  • The old OAuth consent screen is now called Google Auth Platform; older guides that point at APIs and Services, Credentials redirect there.

Last updated .