Google (OIDC)

This guide provides step-by-step instructions on how to configure Google Workspace as the SSO provider for Glean using the OpenID Connect (OIDC) protocol.

Single Sign-On (SSO) is a user authentication service that permits a user to use one set of login credentials to access multiple applications.

​

Prerequisites

Before you begin the setup process, ensure you have the following:

• An active Google Workspace administrator account.
• Access to your Glean admin account with Admin or Setup Admin roles to configure SSO settings.
• Basic understanding of SSO concepts.

​

Google Configuration

​

1 - Set OAuth Consent

You must have create an OAuth consent screen for your Glean before proceeding.

To configure the OAuth consent screen for Glean:

1. In the Google Cloud Console, navigate to APIs and Services > OAuth consent screen.
2. Select Internal as the user type, then click Create.

3. Fill in the fields as per the table below, then click Save and Continue:

Field	Value
App name	Glean
User support email	Email alias for your IT helpdesk, e.g. helpdesk@company.com
App logo	Download this Glean icon to set as the app logo.
App home page	https://app.glean.com
App privacy policy link	https://www.glean.com/privacy-policy
App Terms of Service link	https://www.glean.com/terms
Authorized domain	glean.com
Developer Contact Email	Email alias for your IT team, e.g. it@company.com

4. On the next page, scroll to the bottom and select Save and Continue: No scopes are required to be added.

5. On the summary page, proceed to the dashboard. Your OAuth screen for Glean should now be configured.

​

2 - Create an OAuth Client

1. In the Google Cloud Console, navigate to APIs and Services > Credentials, and select Create Credentials > OAuth Client ID.

2. Fill in the fields as per the table below, and then click Create.

Field	Value
Application type	Web application
Name	Glean SSO
Authorized Javascript origins	https://app.glean.com
Authorised redirect URIs	Add both the following URIs: https://tenant_name-be.glean.com/authorization-code/callback?isExtension=1 https://tenant_name-be.glean.com/authorization-code/callback

Replace tenant_name with your actual tenant ID.

3. On the next screen, you will show a success modal that contains your Client ID and Client Secret. Copy these as you will need them in the next section.

   • If you accidentally close the modal, you can open it again by clicking the download icon next to the Glean SSO OAuth client.

​

Glean Configuration

​

1 - Configure Google SSO

1. In the Glean UI, navigate to Workspace Settings > Setup > Authentication.
2. Select GSuite from the list of SSO Providers.

3. Paste the Client ID and Client Secret values copied from the Google console into their respective fields in the Glean UI.
4. Click Save.

​

2 - Activate SSO

You must activate SSO in Workspace Settings before your users can sign in to Glean using SSO.

1. Return to the Workspace Settings > Setup > Authentication screen.
2. Under the Switch to logging into Glean via SSO section, click the Switch to Gsuite SSO button.

3. You will be prompted to confirm the switch and then sign-in via SSO.
4. After SSO has been activated, you will see GSuite present in the list of Authentication apps with a Status of Connected.

​

Testing the Configuration

There are two key phases of SSO to test: The Glean to Google Workspace redirect, and the Google Workspace back to Glean redirect.

​

Glean to Google

To test your SSO configuration, open a new Incognito or Private Browsing window and navigate to https://app.glean.com. Enter your work email and click Log In.

You should be redirected to your SSO platform successfully.

​

Google to Glean

When you have been redirected to Google SSO, attempt to sign in. You should be redirected back to Glean and successfully signed in.

​

Troubleshooting

If any of the above SSO flows fail, consult the table below. If you have issues that persist, or issues not mentioned below, please contact Glean support.

Issue	Description	Fix
The code cannot be verified [Error Code 13]	The Client ID or Client Secret are incorrect.	Double check that you have copied the Client ID and Client Secret values correctly into the Glean UI.
The code cannot be verified [Error Code 13]	In addition to the above, this error code may indicate that Glean cannot validate the email domain being used for sign-in.	Glean checks the email domain of every user that authenticates via SSO against a list of known company domains that are assigned to your tenant. If Glean is not aware of the email domain that your user is attempting to SSO with, it denies access to your Glean environment for security reasons. Notify your Glean engineer or Glean support of all email domains that your users will be authenticating from.
You do not have access to Glean. Please contact your IT administrator to get access. You do not have access to Glean. Please contact your IT administrator to get access. [Error Code 15]	A user will receive this error if they are not included in the Google Group which manages access to Glean.	Add the user to the Google Group. If you are unsure of which Google Group manages access, please reach out to Glean Support for assistance retrieving the Google Group email.