shonindocs

Set up

Single sign-on with Google Workspace

Your people sign in to Shonin with their Google Workspace account. You create the OAuth client in your own Google Cloud, like you do for AWS IAM Identity Center: only your Workspace can use it.

#Set up

  1. In the Google Cloud console of your company, create a project for Shonin. Use a project of its own: the app name and the audience belong to the project, so a dedicated project keeps them apart from your other apps, and only the people who manage single sign-on can change it.
  2. In Google Auth Platform, choose Get started: app name Shonin, audience Internal.
  3. In Data Access, add openid, email, profile and https://www.googleapis.com/auth/admin.directory.user.readonly. In APIs & Services → Library, turn on the Admin SDK API.
  4. In Clients, create a Web application client. As authorized redirect URI, use the address Shonin shows in Org settings (https://<your Shonin org>.app.shonin.ai/sso/google/callback). Google shows the client secret once: copy it.
  5. In Shonin, open Org settings (top of the page, next to your name), enter the client ID, the client secret and the domains of your people (every domain their addresses use), and choose Save.
  6. Choose Turn on: you sign in with Google once, to check the client works. A new redirect URI can take a few minutes to work in Google.
  7. In People who leave, choose Authorize with an administrator of Google Workspace: Shonin then reads your directory.

#What changes for your people

  • They sign in with Sign in with Google, and confirm with their second factor.
  • Only people you invited sign in. Invitations go only to addresses of your domains, unless Org settings allow people outside them to sign in with a password.
  • Passwords are removed from the addresses of your domains. Primary admins keep theirs, to sign in if Google is unavailable (Sign in with a password).
  • People deleted in Google Workspace are deleted in Shonin, with their access. People suspended are turned off. Shonin reads the directory every 5 minutes, and at once when Google tells it something changed. A primary admin is never changed automatically: the other primary admins get an email to confirm.

#Turn it off

In Org settings, choose Turn off. People without a password get a link to choose one.

View as Markdown