Add a Google Identity Provider

This guide walks you through registering a Google identity provider (IdP) in ThunderID. Once configured, you can add Sign in with Google to any application by including a Google social login executor in its authentication flow.

Prerequisites

• ThunderID is running. See Get Started.
• You can sign in to the ThunderID Console.
• A Google account with access to Google Cloud Console.

1

Step 1: Register an OAuth App in Google Cloud Console

1. Go to Google Cloud Console and sign in.

2. Select or create a project.

3. In the navigation menu, go to APIs & Services → Credentials.

4. Click Create Credentials → OAuth client ID.

5. Set Application type to Web application.

6. Under Authorized redirect URIs, add the callback URL for your ThunderID deployment:

   https://<your-thunderid-host>/gate/callback

   You can copy this value exactly from the Console in the next step, so it does not need to match character for character here.

7. Click Create. Google displays your Client ID and Client Secret. Copy both values. You need them in the next step.

2

Step 2: Configure the Google Connection in the Console

These steps create a Google connection. To change an existing connection, see Manage Identity Providers.

1. Sign in to the ThunderID Console.
2. Navigate to Connections.
3. Click the Google Login card marked Not configured.
4. The form shows a setup hint with the Redirect URI. Copy it and add it to your Google OAuth client's authorized redirect URIs if you have not already done so.
5. Enter your Client ID and Client secret from the previous step.
6. Click Create connection.

ThunderID automatically uses the Google authorization, token, userinfo, and JWKS endpoints. You do not need to supply them.

note

The connection requests the openid email profile scopes by default. To change this, open the connection after creation and set Scopes on its edit page.

The Google connection also accepts a prompt field to control the Google consent screen behavior (for example, consent or select_account). Set it on the connection's edit page, or through the Connections API.

To map Google's profile fields to local user attributes, open the connection and select the Attribute Configuration tab. See Attribute Configuration.

Next Steps

• Connect an IdP to an Application: Add this Google IdP to an application's authentication flow.
• Manage Identity Providers: Update or delete identity providers.