Verkada Command supports Single Sign-On (SSO) through OpenID Connect (OIDC) with Google Workspace. This integration allows our users to seamlessly and securely authenticate using their existing Google credentials, streamlining access to Command and enhancing overall security.
OIDC configuration
Log in to your Google Cloud console.
Click New Project to create a new project under your Google Workspace organization.
In your new project, navigate to APIs & Services > Library.
Enable the following APIs:
Identity and Access Management (IAM) API
Admin SDK API
Navigate to APIs & Services > OAuth Consent Screen. Select Internal for the User Type and click Create.
Click Edit App.
Configure your OAuth Consent Screen. Give your app an identifiable name (e.g., Verkada SSO OIDC), and put the email of the entity that manages your organization’s Google Workspace (e.g., IT) as your app’s user support email. Click Save and Continue.
Configure your OAuth Scopes.
Select the following scopes:
userinfo.email
userinfo.profile
openid
Click Update.
If you do not see the last option, you may have to Add To Table under Manually add scopes.
Click Save and Continue and return to your application’s dashboard.
Navigate to Credentials. Click Create Credentials and create an OAuth client ID.
Select Web application as your application type. Give your client an identifiable name, and add https://command.verkada.com/oidc/google/callback to the list of authorized redirect URIs. Click Create.
Copy your Client ID. Note that we will not be using the Client secret.
Verkada Command Configuration
In Verkada Command, go to All Products > Admin
. In the left navigation, select Privacy & Security
.Under Authentication & User Configuration select Single Sign-On Configuration.
Next to OIDC Configuration, click Add New.
Under Select Provider, select Google.
Under Client and Tenant ID's click Add.
In the Client ID field, paste the Client ID you copied from Google Cloud Console.
In the Tenant ID field, enter the domain used by your organization’s Google Workspace (if your Google email is [email protected], enter your-domain.com).
Click on Done to complete the configuration.
Under Login Test click Run Login Test.
A successful login test should redirect to the OIDC configuration page. Once you’re logged in, add the domain that you need to whitelist under Associated Domains.
Once your domain is added, run the login test again. SSO will not be enabled until this second login test successfully completes.
Once your domain is verified, you should see it successfully validated.
Need more help? Contact Verkada Support.