# OIDC Based SSO for Google Workspace

Verkada Command supports Single Sign-On (SSO) through OpenID Connect (OIDC) with Google Workspace. This integration allows our users to seamlessly and securely authenticate using their existing Google credentials, streamlining access to Command and enhancing overall security.

{% hint style="danger" %}
OIDC is not supported on the Pass app or Desk Station apps.
{% endhint %}

{% hint style="info" %}
Enable [Enterprise Controlled Encryption (ECE)](https://help.verkada.com/command/single-sign-on-sso/oidc/enable-enterprise-controlled-encryption-ece) for enhanced security.
{% endhint %}

***

## OIDC configuration

{% stepper %}
{% step %}

#### Log in to your [Google Cloud console](https://console.cloud.google.com/).

{% endstep %}

{% step %}

#### Click **New Project** to create a new project under your Google Workspace organization.

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-884236e69220503157e3c186d79d29c3cb7167af%2Fadf638b013e362ffde911084012d560c03eeefab.png?alt=media" alt="" width="697"></div>
{% endstep %}

{% step %}

#### In your new project, navigate to **APIs & Services > Library**.

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-56e96bb0ac3d8b1c8900574c5cbd41edd66577ad%2F8cbca777f82cc9a5dd434f81e73cc2b7338db38c.png?alt=media" alt="" width="800"></div>

a. Enable the following APIs:

1. Identity and Access Management (IAM) API

   <div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-ae89f5976810694518f3355ae25eb1bfeaf529a3%2Fac8c527ab9b9487e5eb46bc38a0c4367a70fc991.png?alt=media" alt="" width="607"></div>
2. Admin SDK API

   <div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-6ca1c235c69e501918f7b7d53dd6a009570bec89%2F742d66b0d105811436c0ae22ae679acefa3f0d70.png?alt=media" alt="" width="577"></div>

{% endstep %}

{% step %}

#### Navigate to **APIs & Services > OAuth Consent Screen**. Select **Internal** for the User Type and click **Create**.

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-7f9e31ce7e9cc06ba77eb96e6c73f33bd7ab89e2%2F3c61c77fe771830937aeabff21c7fff82fee0bcb.png?alt=media" alt="" width="800"></div>
{% endstep %}

{% step %}

#### Click **Edit App**.

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-b264a64faa30b8adba944d60e79a14c47627e057%2F2e31007c5ca1be3dc3a7907c642ac5caee323143.png?alt=media" alt="" width="800"></div>
{% endstep %}

{% step %}

#### Configure your **OAuth Consent Screen**. Give your app an identifiable name (e.g., **Verkada SSO OIDC**), and put the email of the entity that manages your organization’s Google Workspace (e.g., IT) as your app’s user support email. Click **Save and Continue**.

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-c21bd05aad0f48accb9494daa7243a5c21ded685%2F7f838ada4a73a788d059b5d8196b25bf6271d2a5.png?alt=media" alt="" width="800"></div>
{% endstep %}

{% step %}

#### Configure your OAuth **Scopes**.

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-3a733f18965e032a92a822acc0ef7f6dedd20617%2F2c1878b82e12e17883245fb7ae786bab89f34dbc.png?alt=media" alt="" width="800"></div>
{% endstep %}

{% step %}

#### Select the following scopes:

* userinfo.email
* userinfo.profile
* openid
* <https://www.googleapis.com/auth/admin.directory.user.readonly>
  {% endstep %}

{% step %}

#### Click **Update.**

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-03195565d76097392a95b8c51f07a43912de638c%2F193a7388344227b731f24036977ec1c45b402cfe.png?alt=media" alt="" width="669"></div>

If you do not see the last option, you may have to **Add To Table** under **Manually add scopes**.

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-60516cddd098d8ebd4be0e4a069079178e6e2069%2F9681180117337bca5ecd0912211472dd1f3d35a7.png?alt=media" alt="" width="659"></div>
{% endstep %}

{% step %}

#### Click **Save and Continue** and return to your application’s dashboard.

{% endstep %}

{% step %}

#### Navigate to **Credentials.** Click **Create Credentials** and create an **OAuth client ID.**

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-9e6fb9ecc56404a2fea814e703b6d36a2f324dc2%2F91981f0d012b115d347d36144058770c831e6fd3.png?alt=media" alt="" width="621"></div>
{% endstep %}

{% step %}

#### Select **Web application** as your application type. Give your client an identifiable name, and add the following to the list of authorized redirect URIs:

* <https://command.verkada.com/oidc/google/callback>
* [https://org-short-name.command.verkada.com/oidc/google/callback](http://org-short-name.command.verkada.com/oidc/google/callback) (where org-short-name is the short-name for your Command organization)

Click **Create**.

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-a8560fc5eb1fa64f56e23e6e833cd631fcc2fa82%2Ff25929e6d8cdd27f67d4b1376d7f91a6891bf483.png?alt=media" alt="" width="407"></div>
{% endstep %}

{% step %}

#### Copy your **Client ID**. Note that we will not be using the **Client secret**.

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-2227897f30e47ae2401daa92736c5d9984ac0058%2Fbf7841ec6a680f5501e99bcc8016ce3c109a38c0.png?alt=media" alt="" width="474"></div>
{% endstep %}
{% endstepper %}

***

## Verkada Command Configuration

{% stepper %}
{% step %}

#### In Verkada Command, go to **All Products** > **Admin**.

{% endstep %}

{% step %}

#### In the left navigation, select **Login & Access**.

{% endstep %}

{% step %}

#### Select **Single Sign-On Configuration.**

{% endstep %}

{% step %}

#### Under **OIDC Configuration,** click **Add New.**

a. Toggle on **Enable.**\
b. (Optional) Toggle on **Require OIDC SSO.**\
c. Under **Select Provider**, select **Google**.\
d. Under **Add Client and Tenant,** click <i class="fa-plus">:plus:</i>.

1. In the **Client ID** field, paste the Client ID you copied from Google Cloud Console.
2. In the **Tenant ID** field, enter the domain used by your organization’s Google Workspace (if your Google email is <example@your-domain.com>, enter your-domain.com).
3. Click on **Done** to complete the configuration.

   <div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-a73c6839f058034a8f510bf1f265ae05c4aada2e%2F0ef79b636454c994d674e62556e118529bf0c957.png?alt=media" alt="" width="476"></div>

h. **Email Domains,** click <i class="fa-plus">:plus:</i>**.**

1. Enter your domain name present (e.g. @verkada.com).
2. Click **Done**.

   <div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-03a2ba25ea251f2a72146ba1464a58bc4e11e7fd%2Ff054308c20f7523b4f1f29da383884cb7c2e6453.png?alt=media" alt="" width="215"></div>

{% endstep %}

{% step %}

#### Under **Login Test** click **Run Login Test**.

{% endstep %}

{% step %}

#### A successful login test should redirect to the OIDC configuration page. Once you’re logged in, add the domain that you need to whitelist under **Associated Domains**.

{% endstep %}

{% step %}

#### **Once your domain is added, run the login test again. SSO will not be enabled until this second login test successfully completes**.

{% endstep %}

{% step %}

#### Once your domain is verified, you should see it successfully validated.

{% endstep %}
{% endstepper %}

{% hint style="success" %}
**Need more help?** Contact [Verkada Support](https://help.verkada.com/command/need-help/contact-verkada-support).
{% endhint %}
