# Google SSO

![Set up Google Single Sign-On Integration](https://assets.relyanceuat.xyz/images/docs/29967459651981/ext-8c658ff385.png)
Google Single Sign-On (SSO) enables users to log in to multiple apps with their Google credentials, simplifying access and enhancing security through features like two-factor authentication (2FA).

In order to integrate Google SSO with Relyance AI you will need:

- A client Secret
- A client ID
- Domain name
- Admin SDK API

In some instances, you may need to grant permissions to the Relyance Google App. Please have your Google workspace admin configure the trust relationship as outlined [here](https://support.relyance.ai/hc/article_attachments/29967459648525).

#### **In your Google Cloud Console:**

1. Create a Google Cloud Project:
    1. Go to the Google Cloud Console (console.cloud.google.com), navigate to "IAM & Admin", click then in "Manage Resources".
    2. Click on "Create Project" and give it a name.
        - You can do this on an existing project but we advise creating a new one for easier management of the integration/troubleshooting
    3. Enable the Google Workspace Admin SDK API:
        - In the Google Cloud Console, navigate to the API Library APIs & Services, click on "Enable APIs and Services".
        - Search for Google Workspace API "Admin SDK API" and enable it.
    4. Create consent screen:

        - In the Google Cloud Console, navigate to the API Library APIs & Services, click on "OAuth Consent Screen".
        - Select Internal for User Type.
        - Fill in the required fields for the consent screen page such as App name, User Support Email, Developer contact information. Click Save and continue.
        - On scopes, click save and continue and then click back to the dashboard.

    1. Create OAuth 2.0 Client ID:
        - In the Google Cloud Console, go to the Credentials page under APIs & Services, and click on "Credentials".
        - Click on "Create Credentials" and select "OAuth client ID".
        - Choose the application type as Web Application
        - Fill in the required fields and update Authorized redirect URIs with: [https://root.relyance.ai/api/oauth2](https://root.relyance.ai/api/oauth2)
        - Generate Client Secret: After creating the client ID, you'll be prompted to generate a client secret. This secret is highly confidential and should be stored securely. In the Relyance AI tenant:

#### In your Google workspace (optional):

![gdrivepre-1.png](https://assets.relyanceuat.xyz/images/docs/29967459651981/29967446271629.png)
Our OAuth2.0 application needs to be trusted explicitly by the administrator of the Google workspace (our Google App Verification Request is in progress). You may need to involve the Google workspace administrator.

![gdrivepre-3.png](https://assets.relyanceuat.xyz/images/docs/29967459651981/29967446272141.png)

![gdrivepre-5.png](https://assets.relyanceuat.xyz/images/docs/29967459651981/29967459651085.png)

1. Navigate to **Security > API Controls** in your Google Admin console Home page.
2. Click on **MANAGE THIRD-PARTY APP ACCESS.**

3. Click on **Configure new app** dropdown and select **OAuth App Name Or Client ID**.

![gdrivepre-2.png](https://assets.relyanceuat.xyz/images/docs/29967459651981/29967446271757.png)

4. In the resulting screen, search for the following client ID (the Relyance AI client ID for Google Drive):
```
892114676652-slst0t12i39117d4qvdg8rm3sjlnldlf.apps.googleusercontent.com
```
5. The app should be displayed below.

6. Click on **Select.**
7. Check the **Client ID** to configure, and click on **Select** at the bottom.

![gdrivepre-4.png](https://assets.relyanceuat.xyz/images/docs/29967459651981/29967446272653.png)

8. Select **Trusted: Can access all Google services**.

9. Click on **Confirm**.
10. Ensure the **Access** column for the Relyance AI app is **Trusted.**

![gdrivepre-6.png](https://assets.relyanceuat.xyz/images/docs/29967459651981/29967459651341.png)

#### **In the Relyance AI application:**

1. Login to your Relyance account.
2. Navigate to the **Settings** Menu in the bottom left-hand side.
3. Select **Integrations**.
4. Search for the **Google SSO** integration card and click it to open its connections.
5. On the **Authentication** step, pick the method under **Authentication Method**., select the OAuth2.0/App Token option
6. Add the domain `<companyname.xyz>`
7. Add the client secret and client ID generated from your Google Cloud project
8. Click Connect

Congratulations, you are now connected to Google SSO

<!-- auth-methods:begin (generated from the integration catalog; do not hand-edit) -->

## Authentication methods and fields

Pick one of these under **Authentication Method** on the connection wizard's **Authentication** step. This table is generated from the integration catalog, so it always matches what the form actually asks for.

| Method | Required | Optional |
| --- | --- | --- |
| **Oauth2 / App Token** | `Domain`, `Client ID`, `Client Secret` (secret) | — |

<!-- auth-methods:end -->

### Verify the connection is really working

The connection uses two scopes: `admin.directory.user.readonly` and `feeds.domain`.

1. **A failure at Authenticate** is usually the **Domain** field. It must be the
   primary domain of the Workspace account, not an alias and not a user's email
   domain if they differ.
2. **Connected but no users discovered** means the OAuth client was not authorised
   for the directory scope in the Admin console. In Workspace, a client ID has to be
   granted its scopes under **Security › API controls › Domain-wide delegation** —
   the client existing is not the same as the client being trusted, and the
   difference shows up as an empty result rather than an error.
3. **The account that authorises matters.** The consent must come from an
   administrator with directory read rights; a non-admin can complete the flow and
   produce a connection that can see nothing.

<!-- terraform-examples:begin (generated from the integration catalog; do not hand-edit) -->

## Manage this integration with Terraform

Connections for this integration can be managed as code with the [Relyance Terraform provider](https://registry.terraform.io/providers/Relyance/relyance/latest). Non-secret fields go in `auth.params`; secret fields go in `auth.secrets_wo`, which is write-only — never stored in Terraform state. Rotate secrets by bumping `auth.secrets_wo_version`.

The **OAuth (browser authorization)** method uses a browser authorization flow, so the connection is created in the Relyance app. Manage it in Terraform afterwards by importing it (`terraform import relyance_integration_connection.example google_sso/<connection_id>`) or reading it with the `relyance_integration_connection` data source.

<!-- terraform-examples:end -->