Google Workspace
Create an internal OAuth client in Google Cloud for your Workspace and connect it for single sign-on.
Costfluent signs your Workspace users in through Google over OpenID Connect. You create one OAuth client in a Google Cloud project of your Workspace organization, and Costfluent trusts the addresses at the domains you verify.
Before you start
- You need the Owner organization role in Costfluent, and a Google Cloud project in your Workspace organization.
- Your people's addresses are at a domain you can publish a DNS TXT record for.
- Google sends no groups, so teams are assigned in Costfluent, not mapped from Google.
Available on the Core, Optimize and Scale plans. Compare plans
Register the application
- In the Google Cloud console, configure the OAuth consent screen of your project for internal users, so only accounts of your Workspace organization can use it.
- Create an OAuth client ID of the web application type.
- Add the authorized redirect URI
https://app.costfluent.com/api/auth/sso/callback. - Copy the client ID and the client secret.
Your discovery URL is https://accounts.google.com/.well-known/openid-configuration.
Send groups
Google's ID token carries no groups claim, and its userinfo endpoint returns none either, so group to team mapping does nothing for a Google connection. Put people into teams in Costfluent instead: see Users, teams and roles.
A Google connection creates accounts at its default role and leaves team membership to you. Leave the connection's group mappings empty.
Connect in Costfluent
- Open Settings, then Single sign-on, and connect your provider with the discovery URL, the client ID and the client secret.
- Add your email domains to the connection and verify each with its DNS TXT record.
- Enable the connection.
Sign-in and security covers each of these steps, enforcement and break-glass Owners.
How it behaves
Costfluent reads these claims from the ID token, and from the userinfo endpoint where the ID token leaves one out:
iss, which must equalhttps://accounts.google.com, the issuer the discovery document named when you connected it.sub, the Google account's stable ID, as the identity Costfluent keeps.email, which must be at one of the connection's verified domains. Google is one issuer for every Google account, so the verified domain is what keeps out an account of another organization: an address outside every verified domain is refused, and so is a sign-in without an address.name, for the name of an account Costfluent creates.
Costfluent also refuses a token whose signature, audience, nonce or lifetime does not check out, and a discovery document that starts naming another issuer.