Guide: Single Sign-on with Google Workspace
The Google Cloud console pages that give Berserk an OpenID Connect client for your Workspace, and what to enter in Berserk
Google Workspace signs in to Berserk over OpenID Connect, which Google provides as an OAuth client in the Google Cloud console, not in the Workspace admin console, whose SSO pages are SAML only. This guide names the pages. What each Berserk setting means is in Accounts and Sign-in; the provider-independent walkthrough, with the common errors, is Guide: Enabling Single Sign-on.
You need a Berserk cluster admin with a password and a Google account in the Workspace. The Berserk URL must be HTTPS: Google accepts plain HTTP only for localhost.
Copy the redirect URI
Settings → Single sign-on in Berserk shows https://<your Berserk URL>/auth/oidc/callback. Copy it.
Create a project
At console.cloud.google.com, signed in with your Workspace account, open the project picker and choose New project. Any name; pick your organisation as the parent if one is offered. The project holds only the OAuth client and costs nothing.
Configure the consent screen
Open Google Auth Platform in that project (older consoles: APIs & Services → OAuth consent screen) and click Get started:
- App name
Berserk, your email as the support address. - Audience Internal if offered: only your Workspace's accounts can sign in. If only External is offered, any Google account reaches the sign-in page, and Berserk's New sign-ins create accounts setting keeps strangers out (step 5).
Under Data access, add the scopes openid, .../auth/userinfo.email and .../auth/userinfo.profile. They are non-sensitive, so the app needs no Google verification and can stay in testing status.
Create the client
Open Clients (older consoles: APIs & Services → Credentials → Create credentials → OAuth client ID) and click Create client: application type Web application, name Berserk, and the redirect URI from step 1 under Authorized redirect URIs. Leave authorized JavaScript origins empty. Google shows the Client ID and the Client secret once; copy both.
Enter the settings in Berserk
On Settings → Single sign-on:
| Setting | Value |
|---|---|
| Issuer URL | https://accounts.google.com |
| Client ID, Client secret | From step 4. |
| Scopes | Leave as is. |
| Require a verified email | On. |
| New sign-ins create accounts | On with an Internal audience. Off with External, adding each member by email on Settings → Members instead. |
| Admin emails | Your Workspace address. |
Click Enable SSO.
Sign in once
In a private window, click Continue with SSO on the login page, choose your Google account and accept the consent screen. Settings → Members lists your account with the SSO badge. Your admin with the password stays a local account, and is the way in if Google misbehaves.
Google must have a first and a last name on the account: Berserk takes both from the ID token and refuses a sign-in without them. A redirect_uri_mismatch from Google means the URI in step 4 differs from the one Berserk shows.