Setting Up Authentication for OpenID Connect with Google

adding a google application configure google app as an identity provider go to https //developers google com/identity/protocols/openidconnect https //developers google com/identity/protocols/openidconnect obtaining oauth 2 0 credentials setting a redirect uri you need oauth 2 0 credentials, including a client id and client secret, to authenticate users and gain access to google's apis to find your project's client id and client secret, do the following go to the google developers console at https //console developers google com/start https //console developers google com/start select an existing project or click create project to create a new one in the dashboard area, click use google apis in the overview area, select an api if you do not need a specific api, select any of them, such as google drive and then click enable to enable the api from the sidebar on the left, click credentials in the credentials panel, under create credentials , click oauth client id enter the requested information and then click create the application displays a dialog box with the client id and client secret note that not all types of credentials use both a client id and client secret these are not listed in the table if they are not used the redirect uri that you set in the google developers console determines where google sends responses to your authentication requests to find the redirect uri for your oauth 2 0 credentials, do the following go to the google developers console at https //console developers google com/start https //console developers google com/start select an existing project or click create project to create a new one in the dashboard, click use google apis in the sidebar on the left, click credentials from the list of oauth 2 0 client ids , click the client id you just created under authorized redirect uris , enter the path in your application that users are redirected to after they have authenticated with google click save creating a neurons for itsm authentication provider to set up users for authentication via the , refer to setting up itsm users for authentication via the neurons platform docid\ wnkkhhscs2a4b5njr5ng4 and authentication https //help ivanti com/ht/help/en us/cloud/vnow/authentication htm this feature is early access only and may not be available in your environment for more information, please contact your customer success manager from the configuration console, click configure > security controls > authentication providers to open the authentication providers workspace from the new record menu drop down list, select new openid connect enter data into the fields field description default specifies if this authentication provider is called automatically set by the application you change this in the list to make this authentication provider the default, you must first change the default setting for all other authentication providers to false and then change the default setting for this authentication provider to true disabled specifies if this authentication provider is disabled name the name of the openid connect provider authentication url the url that accepts the openid connect request the default value is https //accounts google com/o/oauth2/auth https //accounts google com/o/oauth2/auth must be able to initiate an outbound https (port 443) connection to this url token verification url the url to use to verify and extract authentication information from the response of the authentication request the default value for google is https //www googleapis com/oauth2/v3/token https //www googleapis com/oauth2/v3/token must be able to initiate an outbound https (port 443) connection to this url logout url if sign out from google is required when the user logs out from , enter https //www google com/accounts/logout https //www google com/accounts/logout after logging out from , the openidconnect endsession endpoint is called and clients in the same browser session are also signed out session renewal url the url to request to renew the session if this field is empty, the application uses the value of the authentication url field must be able to initiate an outbound https (port 443) connection to this url client id a value from the target google application see obtaining oauth 2 0 credentials docid 3ehto9dnoxmloezoshsmz client secret a value from the target google application refer to obtaining oauth 2 0 credentials docid 3ehto9dnoxmloezoshsmz oidc hosted domain optional authentication parameters for the specific google application not used in this release of oidc realm optional authentication parameters for the specific google application not used in this release of certificate url the url of the certificate used to verify the signature of the authentication response the default value for google is https //www googleapis com/oauth2/v3/certs must be able to initiate an outbound https (port 443) connection to this url certificate issuer the name of the certificate authority who issued the certificate the default value for google is accounts google com http //accounts google com/ expiration date the expiration date of the certificate not used in this release of auto provisioning enables auto provisioning profile information url gets additional information about users (such as email addresses) for auto provisioning the default value is https //www googleapis com/plus/v1/people/me/openidconnect https //www googleapis com/plus/v1/people/me/openidconnect do not change this value it is submitted automatically when a new openid connect record is created must be able to initiate an outbound https (port 443) connection to this url auto provision role role associated with the new user auto provision status status of the new user auto provision team team associated with the new user auto provision user business object type of user record to create can be either employee or external contact to verify the authentication, click test authentication click save security considerations application servers must be able to initiate outbound connections to the following endpoints authentication url https //accounts google com/o/oauth2/auth https //accounts google com/o/oauth2/auth if a session renewal url is specified https //accounts google com/o/oauth2/auth https //accounts google com/o/oauth2/auth token verification url https //www googleapis com/oauth2/v3/token https //www googleapis com/oauth2/v3/token if auth response is required, certificate url https //www googleapis com/oauth2/v3/certs https //www googleapis com/oauth2/v3/certs if auto provisioning is enabled, profile information url https //www googleapis com/oauth2/v3/userinfo https //www googleapis com/oauth2/v3/userinfo