Skip to main content

Google SSO Configuration

This guide walks you through configuring Google as an identity provider (IdP) for single sign-on (SSO) in Ask. This enables users to authenticate using their Google accounts.

Prerequisites​

  • Organization Admin access to Ask
  • A Google Cloud Platform (GCP) account with project access
  • Ability to create OAuth 2.0 credentials in Google Cloud Console

Step 1: Register a New OAuth Client in Google Cloud Platform​

  1. Navigate to the Google Cloud Console Credentials page and select your project.
  2. Click "+ CREATE CREDENTIALS" and select "OAuth client ID".
  3. In the Application type dropdown, select "Web application".
  4. Enter a descriptive name for your OAuth client (e.g., "Ask SSO").
  5. In the Authorised redirect URIs section, add the Ask callback URL: https://sso.ask.ai71.ai/idps/callback
  6. Click "CREATE" to generate your OAuth client credentials.

Google Cloud Console OAuth client creation

Step 2: Retrieve Client Credentials​

After creating the OAuth client, Google Cloud Console will display your Client ID and Client Secret. Save these credentials securely, as you'll need them in the next step.

Google OAuth client ID and secret

Step 3: Configure Google SSO in Ask​

3.1 Navigate to Security Settings​

  1. Log in to Ask as an Organization Admin.
  2. Navigate to Security in the organization settings.

Security navigation in Ask

3.2 Select Google as Identity Provider​

  1. In the Security settings, locate the Single sign-on section.
  2. Select Google from the available identity provider options.

Select Google SSO option

3.3 Enter OAuth Credentials​

  1. Enter the Client ID from Step 2.
  2. Enter the Client Secret from Step 2.
  3. Click Done to save the configuration.

Enter Google OAuth credentials

3.4 Fetch the Callback URL​

After saving the credentials, Ask will provide a callback URL that you need to use in your Google Cloud Console configuration. Ensure that this URL matches the one you entered during OAuth client registration. Fetch Google SSO callback URL

3.5 Enable SSO Authentication​

After configuring the Google identity provider, you must enable SSO for your organization:

  1. Navigate to Security > Authentication.
  2. Select the appropriate authentication option to enable Google SSO.

Enable SSO authentication

Step 4: Verify the Configuration​

To verify that Google SSO is configured correctly:

  1. Open an incognito or private browsing window to avoid cached authentication.
  2. Navigate to your Ask login page.
  3. You should see a "Sign in with Google" button or similar Google authentication option.
  4. Click the button to verify it redirects to Google's authentication screen.
  5. Complete the authentication flow using valid Google credentials.

The Ask login page with the Google SSO button

Google identity provider login screen

Troubleshooting​

If you encounter issues during setup:

  • Verify callback URL: Ensure the callback URL in Google Cloud Console exactly matches https://sso.ask.ai71.ai/idps/callback.
  • Check credentials: Verify that the Client ID and Client Secret are entered correctly without extra spaces or line breaks.
  • Review OAuth consent screen: In Google Cloud Console, ensure your OAuth consent screen is properly configured for your application.
  • Check API scopes: Ensure the required OAuth scopes (email, profile, openid) are enabled for your application.
  • Test in incognito mode: Use an incognito window to avoid cached authentication interfering with your tests.
  • Check expiry: Ensure the client secret hasn't expired and regenerate if necessary.