The Google Authenticator uses OpenID Connect to authenticate using Google accounts. To use it, you need to configure certain things in Google. The steps to do this are described below.
To use Google accounts in the Authentication Service, you need to register it as a OAuth client in Google. To do this, add a new client in the Google Developer Console.
In the Google Developer Console, click Create project. For step by step instructions on how to create a project, refer to the Google Developer Console Help.
Fig. 78 Google - Create Project
Give your project a name, for instance CurityLogin.
Fig. 79 Google - Set project name
Click Create.
When a user chooses to login to the Authentication Service using their Google account, Google will show then a Web page asking for their consent to share certain Google-related user data with the client. How this page looks is also configurable in the Google Developer Console.
To begin with, click Enable and manage APIs to open the API Manager. (Refer to the Setting up OAuth 2.0 section of the Google Developer Console Help for in-depth instructions.)
Fig. 80 Google - Dashboard
In the API Manager, you will find a list of all of Google’s APIs. The Authentication Service will not access any Google APIs; only credentials are needed. So you need not search for any APIs or browse through them.
Fig. 81 Google - Manage APIs
Instead, click Credentials on the left side of the screen.
Fig. 82 Google - Credentials
Then, click the OAuth Consent Screen tab.
Fig. 83 Google - OAuth consent
Only Product name shown to users is mandatory, but fill in as many fields as you like.
Click Save.
Note
This is the only page you can show the user that it is your system that is prompting the user to authenticate, so add as much details as needed to make the user comfortable to continue.
Now click New credentials, and choose to create an OAuth client ID.
Fig. 84 Google - New credentials
In this section of the setup:
Fig. 85 Google - Create client
The new client ID and secret will be displayed. These are the credentials you need to configure the Authentication Service. Take note of them.
Fig. 86 Google - Client credentials
Tip
If you loose your client ID and secret, you can download them from Google again at any point.
The redirect URI is the URI where Google will redirect the user when the authentication is done. The URI that the Authentication Service uses is generated automatically based on configuration, and is the path to the authenticator with an added /callback. This last part of the path is only used in the communication between the Authentication Service and Google, and can not be changed whereas the preceding components of the path can be.
The form is like this:
<base-url>/<authentication-endpoint>/<authenticator-id>/callback
For example, for a server running on server1.local and a protocol of https and listening on port 8443 and having an authentication endpoint configured to be /authn/authenticate and with a Google authenticator instance called google1, the redirect URI would be:
https://server1.local:8443/authn/authenticate/google1/callback
The general authenticator configuration is described under Authenticator Base Configuration. This section describes the additional parameters that are available for the Google authenticator.
Important
Authenticator base is /profiles/profile{id type}/settings/authentication-service/authenticators/
List Entry: <authenticator_base>/authenticator/ (key id)
Example:
<authenticator xmlns="https://curity.se/ns/conf/profile/authentication"> <id>google1</id> <google xmlns="https://curity.se/ns/conf/authenticators/google"> <client-secret>$S3Cr3T</client-secret> <client-id>my-client-id.apps.googleusercontent.com</client-id> </google> </authenticator>