Skip to content
downpipes docs

Sign in to downpipes with Google Workspace

downpipes signs people in to the console against Google Workspace over OpenID Connect, restricted to your own Workspace domain. Google does not put group membership in its ID token, so this connection signs people in and you assign each person’s role inside downpipes. The shared add-a-connection mechanics and the pre-save test live on Connect OIDC or OAuth2.

What you need

  • A Google Cloud project owned by your Workspace organisation, where you can create an OAuth client.
  • Owner access to the downpipes console, since connection management is owner-only and asks for a step-up sign-in.

Set it up

  1. In the Google Cloud console, create or select a project owned by your Workspace organisation.
  2. Open Google Auth Platform, then Audience, and set User type to Internal. Internal limits sign-in to your organisation and skips Google’s external app-verification review.
  3. Under Branding set an app name and support email, and under Data Access add the openid, email and profile scopes.
  4. Open Google Auth Platform, then Clients, Create Client, set Application type to Web application, and under Authorized redirect URIs add your downpipes callback URL, which is your console origin followed by /admin/oidc/callback/<connId>, for example https://console.example.com/admin/oidc/callback/google.
  5. Copy the Client ID and Client Secret (the full secret is shown only once).
  6. In the downpipes console, open the external identity providers screen (/access/idp), choose the Google Workspace tile and Add a connection. This is owner-only and asks for a step-up sign-in.
  7. Enter your exact Workspace domain (for example yourcompany.com), paste the client id and secret, run Test connection, then Add the connection.

Group-to-role mapping

Google does not put group membership in the ID token, so this connection is sign-in only: everyone who signs in lands at the viewer floor, and you grant each person a role by email inside downpipes. See Group-to-role mapping for how those per-person grants sit alongside group mapping for the providers that do send groups. Workspace group sync through the Cloud Identity API is a possible future addition, not part of sign-in today.

Good to know

  • The Workspace-domain gate is mandatory. Without it any consumer Google account could sign in. The hd (hosted-domain) claim is signed inside Google’s ID token, so downpipes enforces your domain server-side and a spoofed hd value cannot pass.
  • Choose Internal, not External. Internal limits sign-in to your organisation and avoids Google’s app-verification review.
  • Google serves its signing keys and token endpoint on sibling hosts, which the preset already pins, so you do not configure them by hand.
  • The old OAuth consent screen is now called Google Auth Platform; older guides that point at APIs and Services, Credentials redirect there.

Last updated .