Single sign-on with Google

Updated 15 October 2026 · applies to 1.3.0 · Commercial

This guide lets people sign in to BROKA with their Google account, over OpenID Connect. Google signs people in to BROKA accounts that already exist; it sends no groups, so it neither maps groups to teams nor creates accounts. What each BROKA setting does is described on Single sign-on.

In BROKA, first

In Settings ▸ Security ▸ Single sign-on, choose New provider, then OpenID Connect and Google, and give it the name people will see on the sign-in page and a Slug, part of the address Google sends people back to. The sheet's Give your identity provider these section then shows the Redirect URI Google needs. Keep the sheet open.

In Google Cloud

In the Google Cloud console, in a project of your organisation's, open Google Auth Platform and choose Get started. Under App Information, give the App name and a User support email. Under Audience, with Google Workspace, choose Internal: only accounts in your organisation can then sign in. External lets any Google account through to BROKA, which then decides by the rules below. Give the Contact Information e-mail addresses, agree to the Google API Services: User Data Policy under Finish, and Create. In a project that is already set up, the user type is under Google Auth Platform ▸ Audience.
Under Google Auth Platform ▸ Clients, Create client: Application type Web application, and a Name. Under Authorized redirect URIs, Add URI and paste BROKA's Redirect URI, then Create. APIs & Services ▸ Credentials reaches the same clients.
The OAuth client created dialog shows the Client ID and the Client secret. Copy them, or Download JSON, at once: Google shows the secret only when the client is created. Google deletes a client that has not been used for six months.

Back in BROKA

Issuer URL: https://accounts.google.com.
Client ID and Client secret from step 3.
Scopes: the default, openid profile email.
Allowed hosted domains: your organisation's Google Workspace domains, such as example.com. Google names the domain of the person's own address, so list every domain your people's addresses are in: an address in a secondary domain of your Workspace comes with that domain, not with your primary one. With any listed, BROKA refuses a sign-in from a Google account outside them — an account already linked included, and a personal Google account, which belongs to no hosted domain. Left empty, a linked account signs in from the Google account it is linked to, whatever its domain.

Save, then Test sign-in: Google asks you to choose an account, and the result shows what it sent. When it has passed, Enable the provider.

Who signs in, and to which account

Google sends no groups, so a Google provider has no group mappings — put people in teams by hand, under Settings ▸ Teams — and Create an account at first sign-in never creates one, since that needs a mapped group.

People sign in to accounts that exist, linked in one of two ways:

Link existing accounts by e-mail, with your organisation's domain among the allowed domains. BROKA counts a Google address as verified only when Google also names the account's hosted domain as that address's domain — a Google Workspace account in your domain. A personal Google address is never linked by e-mail.
An administrator links anyone else from their refused sign-in, on the account's Sign-in tab.

Signing out