This article walks you through setting up single sign-on to Coder using Google.

Configuring Coder's OpenID Connect feature requires you to provide three pieces of information from Google:

• Client ID
• Client Secret
• Issuer

This guide will show you how to set up an app on Google and obtain the information you need to provide to Coder.

Prerequisites

Before proceeding, please ensure that you've enabled and configured the Identity Platform for your Google Cloud account.

Step 1: Create the OAuth consent screen

1. Navigate to your GCP console.

2. Go to APIs & Services > OAuth consent screen. Create a new app or edit an existing app, setting the following fields:

   • App name
   • User support email
   • App domains (at minimum, you must provide the Application home page)
   • Authorized domains (e.g. coder.your-domain.com)

3. Click Save and continue to proceed.

Step 2: Create the OAuth Client

1. Under APIs & Services, go to Credentials.

2. Click Create Credentials and select OAuth Client ID.

3. When prompted for your Application type, choose Web Application.

4. Provide a Name for your application.

5. Under Authorized redirect URIs, click Add URI, and provide your URI (e.g. coder.your-domain.com/oidc/callback).

6. Click Create. Google shows you both your Client ID and Client Secret; copy both values and save them, since you'll need to provide these Coder.

Step 3: Provide the OIDC credentials to Coder

Now that you've registered an app, you can provide the relevant Client ID, Client Secret, and Issuer to Coder.

1. Log into Coder, and go to Manage > Admin > Authentication.

2. Toggle the top-most field to OpenID Connect.

3. Provide the Client ID and Client Secret supplied by Google.

4. For the Issuer, provide accounts.google.com.

5. Click Save preferences.

You can now use Google as an SSO provider with Coder.

Optional: Enable token refresh and redirect options

If you'd like to enable session token refresh and define redirect options, set the following values in Coder's Helm chart and update your deployment:

oidc:
  enableRefresh: true
  redirectOptions: { access_type: offline, prompt: consent }