Google Workspace SSO Login Configuration

This guide provides step-by-step instructions for obtaining OAuth credentials (Client ID and Client Secret) from Google Cloud and configuring them in Logsign USO so users can log in to Logsign with their Google Workspace account.

Note: this is a separate capability from the Google Workspace Response Integration (which suspends/reactivates users) and from Google Workspace identity/asset sync. All three share the same Google Workspace configuration screen in Logsign, but each uses its own credentials: SSO login uses a standard OAuth 2.0 Web Application client (Client ID/Secret), while the Response integration and identity/asset sync use a Domain-Wide-Delegation service account (Service Account JSON). Configuring one does not configure the others.

Prerequisite: identities must already be synced

Google Workspace SSO only lets an existing Logsign user log in with their Google account. It does not create Logsign users on its own. Before setting up SSO, sync your Google Workspace identities into Logsign (Settings > Enrichment > Identities > sync against your Google Workspace source, then assign each user a role), the same way you would for LDAP or Microsoft Entra ID identities. A login attempt for a Google account that has no matching synced Logsign user fails with "user not found".

Register an OAuth Client in Google Cloud

1. Open Google Cloud Console and select (or create) the project you want to use for Logsign login.
2. Go to APIs & Services > OAuth consent screen and configure it if you haven't already (Internal, if you only want your own Workspace domain's users to be able to authenticate; External otherwise).
3. Go to APIs & Services > Credentials, click + Create Credentials > OAuth client ID, and choose Web application as the application type.
4. Under Authorized redirect URIs, add exactly: https://<your-logsign-uso-hostname>/login. Logsign always redirects back to /login on its own hostname; a mismatched or missing redirect URI causes Google to reject the login with a redirect_uri_mismatch error.
5. Click Create. Copy the Client ID and Client Secret shown. You will need both in the next step. The Client Secret cannot be retrieved again later; if you lose it, generate a new one from the same Credentials page.

Configure Google Workspace SSO in Logsign USO

1. Go to Settings > Integrations > Responses, search for Google Workspace, click Configure, then open your existing Google Workspace device (or create one with +Device if you have not already configured the Response integration or identity sync).
2. Fill in the SSO-specific fields:

If either the Client ID or Client Secret is left blank, Logsign falls back to the normal username/password login form for that user instead of redirecting to Google.

How the login works

1. The user starts a login on the Logsign login screen. Logsign redirects the browser to Google's OAuth consent screen (accounts.google.com) using the configured Client ID and the requested scope openid email profile.
2. After the user signs in with their Google Workspace account and approves access, Google redirects back to https://<your-logsign-uso-hostname>/login with an authorization code.
3. Logsign exchanges the code for an ID token directly with Google, and verifies the token's signature, audience, and expiry (Logsign does not simply trust the redirect: it re-verifies the token against Google's public keys).
4. The email in the verified token is matched to a Logsign user by the part before the @ (for example jane.doe@yourcompany.com matches the Logsign user jane.doe). That user must already exist in Logsign as a synced Google Workspace identity: see the prerequisite above.
5. If everything matches, the user is logged in. If any step fails, Logsign logs the specific reason (see Troubleshooting) and the user sees a failed login.

Troubleshooting