Skip to content

Set up single sign-on with Google Workspace

Canvus Server 26.11.1 and later lets people sign in with their Google Workspace account. The login page shows a Sign in with Google button. You set it up as a Google Workspace provider in Admin > Authentication, without editing a configuration file and without restarting the server.

Warning

Google only accepts redirect addresses that are on a public domain name and use HTTPS. Google refuses internal names (for example canvus.corp.local), bare hostnames (for example canvus) and IP addresses. A server that is known only by an internal name cannot use Google sign-in. The server itself can stay on your internal network, as long as the address people type for it is a public DNS name, for example canvus.example.com.

Note

Microsoft Entra ID is the provider MultiTaction tests with. The steps on this page were written from Google's own documentation and have not been run by MultiTaction against Google.

For Microsoft, see Set up single sign-on with Microsoft Entra ID. To offer Google next to another provider, see Use several sign-in providers.

Before you start

You need:

  • Canvus Server 26.11.1 or later.
  • Administrator access to the Canvus Server web UI.
  • The server's external URL set to the public address that users type, for example https://canvus.example.com. See Before you start in the Entra ID guide.
  • A Google Workspace account that can create projects in your organisation's Google Cloud, and a Google Cloud organisation. The project must be inside the organisation, because only then can you choose the user type "Internal" below.
  • Outbound HTTPS (port 443) from the Canvus server to Google. If you use a proxy or an internal certificate authority, see Behind a proxy or with an internal certificate authority.

Step 1: Copy the redirect URI from Canvus

  1. Sign in to the Canvus Server web UI as an administrator.
  2. Open Admin > Authentication.
  3. Scroll to the bottom of the page and find the Redirect URI field. It reads <external-url>/users/login/oidc/callback.
  4. Select Copy.

If the address is an internal name or an IP address, stop. Google will refuse it. See the warning at the top of this page.

Step 2: Set up the project in Google Cloud Console

Google changes the names of its console menus from time to time. Where this page gives a menu path, the name of that menu may differ in your console. The destination described is what matters.

  1. Sign in to the Google Cloud console with an account of your Workspace organisation.
  2. Create a project, or pick an existing one. In the project picker at the top of the page, check that the project is inside your organisation and not under "No organisation".
  3. Open the Google Auth Platform. Google's documentation names its pages Branding, Audience and Clients. If the console asks you to set up the platform first, select Get started and enter an app name and a support e-mail address.
  1. Open the Audience page of the Google Auth Platform. In some console versions this page is called the OAuth consent screen. The name of this menu has changed between console versions.
  2. Set the user type to Internal.

Choose Internal because it makes Google itself refuse every account outside your organisation. Canvus also checks the domain (see What Canvus checks), but the consent screen is the first lock. An app with user type External can be used by any Google account.

Create the OAuth client

  1. Open the Clients page of the Google Auth Platform.
  2. Select Create client.
  3. For Application type, select Web application.
  4. Under Authorized redirect URIs, add the redirect URI you copied in step 1. It must start with https://.
  5. Select Create.
  6. Copy the Client ID and the Client secret. Google shows the secret only once, after you create the client. Store it safely.

Step 3: Add the provider in Canvus

  1. In Admin > Authentication, under Sign-in providers, select Add provider.
  2. Select Google Workspace.

  3. In Workspace domains, enter the domains whose members may sign in, one per line, for example:

    example.com
example.org

    You must enter at least one domain. Without one, Canvus shows Enter at least one Workspace domain, for example example.com. and does not save. 4. In Client ID, paste the client ID from Google. 5. In Client secret, paste the client secret. Canvus stores it encrypted and never shows it again. Google sign-in uses a client secret only. There is no certificate option. 6. Decide whether to select Allow new accounts. With it on, Canvus creates an account the first time someone signs in. The e-mail domain allow list and the admin approval setting of the server still apply. 7. Select Offer this provider on the sign-in page. 8. Select Test connection. A working setup reports Connection works. with the issuer and the number of signing keys. The test checks that the server can reach Google. It does not check the client ID or the secret. 9. Select Add provider. The provider appears in the list.

If the server's address is not on a public domain name, the form shows Your server's address must be on a public domain name. Google refuses internal names and IP addresses.

Step 4: Test the sign-in

  1. Open a private (incognito) browser window and go to your Canvus Server address.
  2. Select Sign in with Google and sign in with a test user from one of the listed domains.
  3. You should land in Canvus, signed in as that user.
  4. Try a personal Google account too. It must be refused.

What Canvus checks

Canvus applies these rules to every Google sign-in:

  • The account's Google organisation domain must be one of the Workspace domains you listed. Google puts this domain in the sign-in response only for accounts that belong to a Google Cloud organisation (a Workspace account).
  • Personal Google accounts, for example an address ending in @gmail.com, are refused.
  • Google must confirm the user's e-mail address. There is no switch to turn this off for Google.
  • The account is matched by Google's own user ID first, then by e-mail address on the first sign-in. See How accounts are matched.

A user from another organisation, or with a personal account, sees this message on the login page:

Your account is not in an organisation this server accepts. Sign in with your work account, or ask your administrator.

A user whose e-mail address Google has not confirmed sees:

Your e-mail address has not been verified by your organisation's sign-in service. Ask your administrator.

For the other messages on the login page, see Troubleshooting in the Entra ID guide.

Troubleshooting

  • Google shows an error about the redirect URI (the page names redirect_uri_mismatch) : the address in Authorized redirect URIs must be identical to the Redirect URI in Canvus, including https, the host name and no trailing slash.
  • Google refuses the address when you add it: the address is not on a public domain name. See the warning at the top of this page.
  • Test connection fails: the server cannot reach Google. Check the firewall and the Network section of Admin > Authentication.
  • Everyone from your organisation is refused: check the spelling of the Workspace domains. Enter the organisation's primary domain, as Google reports it for the account.

See also If you set up sign-in on a 26.11.1 preview build. A provider of the type Other OpenID Connect provider that points at Google must be removed and added again as Google Workspace.