# Single sign-on with Google Workspace

Your people sign in to Shonin with their Google Workspace account. You create the OAuth client in your own Google Cloud, like you do for AWS IAM Identity Center: only your Workspace can use it.

## Set up

1. In the Google Cloud console of your company, create a project for Shonin. **Use a project of its own:** the app name and the audience belong to the project, so a dedicated project keeps them apart from your other apps, and only the people who manage single sign-on can change it.
2. In **Google Auth Platform**, choose **Get started**: app name Shonin, audience **Internal**.
3. In **Data Access**, add `openid`, `email`, `profile`, `https://www.googleapis.com/auth/admin.directory.user.readonly` and `https://www.googleapis.com/auth/admin.directory.group.readonly`. In **APIs & Services → Library**, turn on the **Admin SDK API**.
4. In **Clients**, create a **Web application** client. As authorized redirect URI, use the address Shonin shows in **Org settings** (`https://<your Shonin org>.app.shonin.ai/sso/google/callback`). Google shows the client secret once: copy it.
5. In Shonin, open **Org settings** (top of the page, next to your name), enter the client ID, the client secret and the domains of your people (every domain their addresses use), and choose **Save**.
6. In **Directory**, choose **Authorize** with an administrator of Google Workspace who can read users and groups: Shonin then reads your directory, and **People** shows who could not sign in with Google.
7. Turn on the switch next to **Single sign-on: Google Workspace**. Shonin lists who will not be able to sign in; choose **Turn on**, and sign in with Google once to check the client works. A new redirect URI can take a few minutes to work in Google.

## What changes for your people

- They sign in with **Sign in with Google**, and confirm with their second factor.
- Only people you invited sign in. Invitations go only to addresses of your domains, unless you select **People outside these domains sign in with a password** in **Password sign-in**. People of your domains sign in with Google whatever you choose there.
- Passwords are removed from the addresses of your domains. Primary admins keep theirs, to sign in if Google is unavailable (**Sign in with a password**).
- Google groups and aliases cannot sign in with Google. A group that is a primary admin signs in only with its password and authenticator app; any other group or alias cannot sign in. **People** marks them, and with the directory authorized Shonin does not invite them. Make your primary admins people with their own Google Workspace user.
- People deleted in Google Workspace are deleted in Shonin, with their access. People suspended are turned off. Shonin reads the directory every 5 minutes, and at once when Google tells it something changed. A primary admin is never changed automatically: the other primary admins get an email to confirm.

## Turn it off

In **Org settings**, turn off the switch next to **Single sign-on: Google Workspace**. People without a password get a link to choose one.