Breadcrumbs

Setting Up Google Sign-In (OIDC)

This guide shows how to let users sign in to GlobalForms with their Google account (Google Workspace or a personal Gmail account), using OpenID Connect (OIDC).

This feature requires GlobalForms version 10.17.1 or greater.

Before you begin

You will need:

  • A Google account that can create projects in the Google Cloud Console.

  • The public HTTPS address of your GlobalForms server, for example https://forms.example.com. See Configuring HTTPS.

  • Access to config\local.json on the GlobalForms server, and permission to restart the GlobalForms service.

  • A GlobalForms user resource whose records contain each user's Google email address. Google can only sign in people who already have a matching GlobalForms user record.

Part 1: Create the OAuth client in Google

1. Select or create a project

  1. Go to the Google Cloud Console.

  2. Use the project picker at the top of the page to select an existing project, or choose New Project.

  1. Open APIs & Services → OAuth consent screen. In newer versions of the console this is Google Auth Platform, with Branding and Audience pages.

  2. Choose who can sign in (User type or Audience):

    • Internal: only users in your Google Workspace organization. Recommended for company use.

    • External: any Google account. While the app's publishing status is Testing, only the test users you add can sign in.

  3. Enter the app name, user support email and developer contact email, then save.

  4. Make sure the scopes openid, email and profile are included. These are Google's basic scopes and need no extra verification.

3. Create the client ID

  1. Open APIs & Services → Credentials (or Google Auth Platform → Clients).

  2. Select Create Credentials → OAuth client ID.

  3. Set Application type to Web application and give it a name, such as GlobalForms.

  4. Under Authorized redirect URIs, select Add URI and enter your GlobalForms callback address, for example https://forms.example.com/oidc/callback

  5. Select Create.

The redirect URI must exactly match redirectUrl in the GlobalForms configuration (Part 2), including https, host name, port and path. Google accepts plain http only for localhost.

4. Record your credentials

Google shows a Client ID and a Client secret. Copy both. Treat the secret like a password: don't email it or store it in shared documents.

Google's issuer URL is https://accounts.google.com

Part 2: Configure GlobalForms

  1. Open config\local.json in the GlobalForms install folder (C:\GlobalForms by default).

  2. Add or update the oidc section, replacing the placeholders with your values:

    JSON
    "oidc": {
  "issuer": "https://accounts.google.com",
  "clientId": "<Client ID from Google>",
  "clientSecret": "<Client secret from Google>",
  "redirectUrl": "https://forms.example.com/oidc/callback"
}

  3. Save the file and restart the GlobalForms service.

Setting

What to enter

issuer

https://accounts.google.com

clientId

The Client ID from Google

clientSecret

The Client secret from Google

redirectUrl

The exact redirect URI you registered in Part 1

prompt

Optional. select_account always shows Google's account chooser, which helps people who are signed in to more than one Google account.

For all oidc settings, see Single Sign-On with OpenID Connect.

Part 3: Add the sign-in button to the sign-in page

Add a button labeled Sign in with Google to the User Login form (path user/login), which is the form on the GlobalForms sign-in page. In short:

  • Button Action: Submit, with Button Custom Logic data.name="oidc"; data.password="oidc"; data.oidc=true

  • Button Property Name (API tab): oidc

  • OIDC Login action: your user resource, triggered only if the button Equals true

  • Existing Login action: triggered only if the button Not Equal true

For the full steps, see Step 3 in Single Sign-On with OpenID Connect.

Part 4: Make sure users can be matched

After Google confirms who the user is, GlobalForms looks in the selected user resources for a record whose usernameField (default email) matches the user's Google account email. Upper and lower case are ignored.

Single sign-on does not create GlobalForms accounts. Create or update the user records before asking people to sign in.

Part 5: Test the sign-in

  1. Open the GlobalForms sign-in page in a private browser window.

  2. Select Sign in with Google, choose a Google account and approve access.

  3. Confirm you return to GlobalForms signed in as the matching user, and that name-and-password sign-in still works.

Troubleshooting

Message or symptom

Cause and fix

Google shows redirect_uri_mismatch

The redirect URI in Google doesn't exactly match redirectUrl. Compare protocol, host name, port and path.

Google shows access_denied, or says the app is not verified or the user can't access it

For an External app in testing, add the user as a test user, or publish the app. For an Internal app, the account must belong to your Google Workspace organization.

invalid_client

The Client ID or Client secret is wrong or has extra spaces. Copy both again from Google.

Unable to complete OIDC login. User not found: …

No GlobalForms user record matches the email shown. Check the email in GlobalForms, or see Part 4.

The wrong Google account is used automatically

Set prompt to select_account so Google always shows the account chooser.

For messages shown by GlobalForms, see the troubleshooting table in Single Sign-On with OpenID Connect.

Security notes

  • Never run production workloads in GlobalForms without HTTPS. Sign-in tokens and user data travel between the browser and the server and can be intercepted without it.

  • Choose Internal if all your users are in one Google Workspace organization.

  • If the client secret is ever exposed, create a new one in Google, update clientSecret and restart GlobalForms.