Google SSO | Axero Documentation

Axero supports Google integration for single sign-on (SSO) out of the box. This page covers how to set up Google OAuth 2.0 credentials (the client ID and secret that let your site use Google sign-in), how to turn on Google integration, and what the Google login looks like.

Setting up Google SSO takes about 1-2 hours. Once you complete the guide, Google SSO will be active on your intranet. For help from the Axero team, submit a private case.

Choose Your Google Sign-In Method

There are two ways to let people sign in to Axero with Google, and they are not interchangeable. Read this before you start.

• Google sign-in, described on this page. It adds a Sign in with Google button to the login page. It is a good fit for smaller teams and for sites where people use personal Google accounts.
• Google Workspace as a SAML provider, described in SAML 2.0 SSO. Choose this if your organization needs any of these: people sent to Google automatically instead of clicking a button, signing out of Google when they sign out of Axero, or sign-in that works in the Axero mobile app. The button described on this page offers none of those three.

What Google Sign-In Does

• Adds a Sign in with Google button to the login and registration pages
• Lets people sign in with a Google account, either personal or Google Workspace
• Creates an intranet account on first sign-in, without the person filling in the registration form

Configure OAuth 2.0 Credentials

1. Visit the Google Cloud Console. Sign in with a valid Google account. Google reorganizes this console from time to time, so if a screen below is named differently, look for the setting name rather than following the screenshots exactly.
2. If you don't have a project for your intranet yet, create one. Click the project menu in the header.
   
3. Click New project.
4. Enter a name for the project.
5. Click Create.
6. Click Branding. On older projects this screen is named OAuth consent screen.
7. Enter an App name.
8. Select the User support email.
9. Upload an App logo. (Optional)
10. In Application Homepage link, enter your site URL.
11. In Authorized domains, add the domain of your site. (Do not use the full URL. For example, the domain for https://my.intranet.com is intranet.com.)
12. Enter an email address in Developer contact information.
13. Click Save and Continue.
14. Click Data Access, then Add or remove scopes. On older projects the scopes step is part of the consent screen wizard.
15. Check .../auth/userinfo.email and .../auth/userinfo.profile. These two are the only scopes Axero requests.
16. Click Update.
17. Click Save and continue.
18. Click Clients, then Create client. On older projects the same screen is Credentials > Create credentials > OAuth client ID.
19. Select Web application.
20. Enter a name for your application.
21. Under Authorized redirect URIs, click Add URI.
22. Enter your site URL followed by /oauth2/google/callback (for example, https://myintranet.com/oauth2/google/callback). Google accepts only https addresses here, apart from localhost, so your site needs an SSL certificate (the certificate that lets it use https) before Google sign-in will work. Axero does not need an entry under Authorized JavaScript origins.
23. Click Create.
24. Copy the client ID and client secret and save them for later.

Configure Axero

1. In Axero, click the gear icon > Control Panel > System > General Settings.
2. Expand the Social Integration Settings section.
3. Enter the client ID in the Google integration API key field.
4. Enter the client secret in the Google integration Secret field.
5. Check Enable Google integration.
6. Check Enable 3rd party login.
7. Click Save System Settings.

The Enable Google integration checkbox stays grayed out until both the API key and the Secret are filled in, so enter those two first.

What Axero Reads from Your Google Account

When someone signs in with Google for the first time, Axero creates their intranet account from the information Google returns:

• Email address, which is also what Axero matches on to find an existing account
• Full name, split into first, middle, and last name
• Profile photo

Axero picks the username from the person's first name, adds the last name if that username is taken, and adds a number after that. To have Axero assign a generated username instead, set the UseGenericSSOUsernames system property to true in Control Panel > System > System Properties.

Login via Google

On the login page, click the Sign in with Google button.

Enter your Google login information if Google asks for it.

If Auto approve members is unchecked in Control Panel > System > General Settings > Site Settings, you'll see a message that your account is pending approval.

The first time you sign in, you are asked to set your username.

Customize Login Page

You can customize the login page to show only the Google login option.

Before you do this: hiding the standard login fields leaves the Google button as the only way in. Anyone without a Google account linked to their profile, including you, will not be able to sign in from this page. Confirm that every account that needs access can sign in with Google, and keep a way to reach the site as an administrator, before you publish the change.

1. Go to Control Panel > People > User Profiles.
2. For the Login page, click the gear icon > Edit Page. For more on this page, see Edit Login Page.
3. On the Login to your account section widget, click the gear icon > Edit properties.
4. Click Advanced.
5. In Custom CSS class, enter hide .
6. Click Save Widget.
7. Click Publish changes.

Login button image

You can also change the login button image. Add the following code to CSS Overrides:

[id$='LoginUsingGoogle']:before {
 position: absolute;
 content: '';
 background-image: url('https://developers.google.com/identity/images/btn_google_signin_light_normal_web.png');
 width: 191px;
 height: 46px;
 pointer-events: none;
 z-index: 20000;
}

Login via Mobile App

Signing in with Google is not available in Mobile Apps. On a site with no SAML provider set up, people sign in to the app with their username or email and their Axero password. On a site that uses a SAML provider, including Google Workspace configured as one, the app signs people in through that provider instead.

To set an Axero password for the app, select your name in the header, then Password.

Related pages

• Single Sign-On (SSO) (the other sign-in providers)
• SAML 2.0 SSO (to use Google Workspace as a SAML provider instead)
• Edit Login Page (to change what the login page shows)
• General Settings (the Social Integration Settings section in full)
• System Properties (where UseGenericSSOUsernames is set)
• Facebook SSO (the Facebook equivalent)