Set Up SSO with Google Workspace
Identity provider screens change often. If a menu or button named here has changed, look for the closest match.
Create an OAuth client for an internal app in Google Cloud, and tell MSPCFO your Workspace domain.
1. Choose or create a Google Cloud project
Sign in to the Google Cloud console (https://console.cloud.google.com) with an account in your Workspace organization. Pick an existing project or create one (e.g. MSPCFO SSO).
2. Configure the consent screen
- Go to APIs & Services → OAuth consent screen (shown as Google Auth Platform in newer consoles).
- Set the User type / Audience to Internal, so only people in your Workspace organization can use the app.
- Fill in the app name (e.g.
MSPCFO), a support email and a developer contact email. - No extra scopes are needed. MSPCFO asks only for the basic
openid,emailandprofilescopes.
[SCREENSHOT: Google OAuth consent screen with Internal selected]
3. Create the OAuth client
- Go to APIs & Services → Credentials (or Clients) and choose Create credentials → OAuth client ID.
- Application type: Web application. Name: e.g.
MSPCFO. - Under Authorized redirect URIs, add
https://app.mspcfo.com/user/auth/google_oauth2/callback. - Choose Create and copy the Client ID (ends in
.apps.googleusercontent.com) and Client secret.
ALERT Newer Google consoles show the secret only once, so copy or download it now.
[SCREENSHOT: Google Create OAuth client ID page with redirect URI filled in]
4. Finish in MSPCFO
| Field | Value |
|---|---|
| Provider | Google Workspace |
| Google Workspace domain | Your Workspace domain, e.g. yourcompany.com. Only accounts in this domain can sign in. Enter a domain only, not a URL and not *. |
| Client ID | From step 3 |
| Client secret | From step 3 |
Save, then run Test sign-in.
INFO One domain per configuration. Google sign-in is limited to the single Workspace domain you enter. If your organization has secondary domains, make sure people's MSPCFO email address is on the domain entered here, and that the domain is also registered with MSPCFO.
Google-specific problems
| Symptom | Fix |
|---|---|
Google error redirect_uri_mismatch | Add the exact callback URL under Authorized redirect URIs (step 3). Changes can take a few minutes to apply. |
Google error org_internal / "access blocked" | The person signed in with an account outside your Workspace organization (e.g. a personal Gmail account). Sign in with the work account. |
Google error invalid_client | The Client ID or Client secret in MSPCFO is wrong. Copy them again from the OAuth client. |
| "… is not on a domain of <company> …" | The person's Google address is on a domain MSPCFO doesn't have registered for your company. Ask MSPCFO Support to add it. |
0 Comments
Add your comment