Displaying OIDC App for Custom SAML App on Google Workspace

Google Workspace does not natively display OpenID Connect (OIDC) applications directly within the Admin Console alongside SAML apps. The Admin Console is designed for identity federation and user access management, not for hosting or listing OIDC client metadata. To manage an OIDC app, you must configure it in Google Cloud Console as a separate OAuth 2.0 client ID, which then functions independently of your SAML configuration.

Distinguishing SAML from OIDC Architectures

It is critical to understand that SAML and OIDC serve different purposes in enterprise identity management, even though both rely on Google Workspace as the identity provider. A Custom SAML App allows third-party services to authenticate users via XML-based assertions. This process is managed entirely within admin.google.com. When you create a custom SAML app there, you are defining how Google sends identity tokens to that specific application. In contrast, an OIDC application requires a Client ID and a Client Secret. These credentials are used by applications to request identity information via standard HTTP requests. Google Workspace does not expose these OIDC credentials through the SAML app interface. Attempting to find an OIDC link inside the SAML app configuration will fail because the two protocols operate on different technical stacks. The visibility issue arises from expecting a unified dashboard that does not exist in the current Google Workspace architecture.

Creating the OIDC Client in Google Cloud Console

To obtain the necessary credentials for an OIDC application, you must use Google Cloud Console. This is where all OAuth 2.0 and OpenID Connect clients are registered. Follow these steps to create the client:

1. Navigate to console.cloud.google.com and select your project. If you do not have a project, create one linked to your Workspace organization.
2. In the navigation menu, go to APIs & Services and then select Credentials.
3. Click the Create Credentials button and choose OAuth client ID.
4. If prompted, configure the OAuth consent screen first. Select External if your app is for users outside your organization, or Internal if it is strictly for Workspace users.
5. Choose the application type Web application or Desktop app depending on your integration needs.
6. Add authorized redirect URIs. These must match the endpoints in your OIDC provider exactly.
7. Save the generated Client ID and Client Secret. These are your OIDC identifiers.

The Client ID obtained here is what you provide to your OIDC application. It is distinct from any Service Account or SAML key you might have created previously.

Configuring the Application to Use Workspace Identity

Once you have the Client ID, you must configure your application to trust Google Workspace as the identity provider. This involves setting up the discovery document URL. For most Workspace organizations, the issuer URL is https://accounts.google.com or https://oauth2.googleapis.com/token depending on the specific flow. Your application must be configured to accept ID tokens signed by Google. You can verify the signature using the public keys available at the JWKS URI: https://www.googleapis.com/oauth2/v3/certs. Ensure your application validates the aud (audience) claim against the Client ID you generated in the previous step. This validation ensures that only your specific application can use the tokens issued by your Workspace. Open Microsoft Office Files on Desktop with Full-Featured Google Docs, Sheets, Slides by Double Clicking demonstrates how Workspace handles external integrations, but note that file access mechanisms differ significantly from authentication flows. Authentication relies on token validation, while file access often uses API scopes.

Managing Access and Permissions

After configuring the OIDC client, you may need to restrict who can sign in. In Google Cloud Console, under the OAuth consent screen, you can define allowed domains. By restricting this to your Workspace domain, you ensure that only employees can authenticate. Additionally, check the APIs & Services > Enabled APIs & services list. Ensure that the Google People API or Google Drive API is enabled if your OIDC app needs to access user data after authentication. Enabling these APIs allows your application to make calls on behalf of authenticated users, provided the correct scopes are requested during the authorization flow. If you encounter errors regarding invalid client IDs, verify that the Client ID matches the one in your application configuration exactly. Case sensitivity and trailing slashes in redirect URIs can also cause failures. Test the flow using a tool like Postman or a simple HTML page before integrating it into your main application code. For organizations dealing with email security, understanding domain verification is equally important. See Google Workspace: Setting DKIM Keys for Alias Domains for details on securing email domains, which complements your authentication setup by ensuring message integrity.

Troubleshooting Common Issues

Users often confuse the Service Account JSON key with OIDC credentials. A Service Account is used for server-to-server authentication and does not represent a human user. It cannot be used for standard OIDC login flows unless specifically configured for domain-wide delegation, which is a different mechanism entirely. Another common error is the "redirect_uri_mismatch" error. This occurs when the URI sent in the authorization request does not exactly match one of the URIs listed in the OAuth client ID configuration in Cloud Console. Always double-check the protocol (http vs https) and the port number. Finally, remember that changes to the OAuth consent screen settings can take up to 24 hours to propagate. If you update allowed domains or add new redirect URIs, wait before testing again to avoid caching issues.

Frequently Asked Questions

Can I see my OIDC Client ID in the Admin Console?

No, the Admin Console does not display OIDC Client IDs. You must generate and view them in Google Cloud Console under Credentials. The Admin Console only manages SAML app configurations and basic user directory settings.

Do I need a separate Google Cloud Project for each OIDC app?

You can create multiple OAuth client IDs within a single Google Cloud Project. However, best practices suggest separating projects by environment (development, production) or by business unit to maintain clear audit trails and permissions.

How do I revoke access for an OIDC app?

To revoke access, you can delete the OAuth client ID in Google Cloud Console. This immediately invalidates the Client ID and Secret. Users will no longer be able to authenticate using that specific client configuration.

Is OIDC supported for all Workspace editions?

Yes, OIDC support is available across all Google Workspace editions, including Business Starter, Business Standard, and Enterprise. The capability depends on your ability to create and manage Google Cloud Projects associated with your organization.

Why does my SAML app not work with OIDC credentials?

SAML and OIDC are incompatible protocols. A SAML app expects XML assertions and specific metadata URLs, while an OIDC app expects JSON Web Tokens. You cannot mix credentials between the two systems; they must be configured separately according to their respective standards.