Last updated
Last updated
This guide provides a step-by-step walkthrough to configure Google as an external identity provider for Akamas users.
You will need a Google account with the privileges required to create app registrations.
To integrate Akamas with your Google Workspace, create a project with a dedicated OAuth client in the Google Developer Console.
Log in to your Google Developer Console.
Go to the API & Services section and navigate to Credentials.
If a warning prompts you to configure the consent screen, you’ll need to create an app for user consent.
Click on the provided button to launch the Consent Screen Wizard.
Follow the wizard to configure the consent screen according to your company's policies. For more details, refer to Configure the OAuth consent screen on the official documentation.
Once the consent screen configuration is complete, return to the Credentials page.
On the Credentials page, select Create Credentials and choose OAuth Client ID.
Configure the client as follow:
Application Type: Choose "Web application."
Name: Enter a name for the new client.
Authorized redirect URIs: Leave this blank for now; you’ll configure it in a later step.
After clicking Create, a confirmation popup will display the Client ID and Client Secret. Make note of these values.
In the Keycloak admin console, go to the Identity Providers section within the Akamas realm (see Configure an external identity provider for more details).
Select Google as the provider type.
Fill in the following fields using the values from the OAuth client:
Client ID: Enter the Client ID from the Google Developer Console.
Client Secret: Enter the Client Secret.
Copy the Redirect URI generated by Keycloak and click Add to save the configuration.
Return to the Credentials page in the Google Developer Console. Open the newly created OAuth client, and in the Authorized Redirect URIs section, add the Redirect URI copied from Keycloak.
If the hostname of the Akamas installation changes, update the Redirect URI in the app registration to avoid login errors such as:
The redirect URI 'https://...' specified in the request does not match the redirect URIS configured for the application '...'.
To automatically assign default roles to users, set up mappers in Keycloak so users can access the default workspace with read and write permissions upon first login.
In Keycloak, go to the provider's details page and navigate to Mappers:
Add the following configurations:
User role
Name: User role
Mapper type: Hardcoded role
Role: USER
Default Workspace Read
Name: Default Workspace Read
Mapper type: Hardcoded role
Role: WS_ac8481d3-d031-4b6a-8ae9-c7b366f027e8_R
Default Workspace Write
Name: Default Workspace Write
Mapper type: Hardcoded role
Role: WS_ac8481d3-d031-4b6a-8ae9-c7b366f027e8_W
Visit the Akamas installation's login page to verify that the new authentication method is displayed and working as expected.
