Sign in to Google Workspace

You can set up Google Workspace so that your people open Gmail, Drive, Calendar and the rest of Google with an EntryIdP face scan instead of a Google password. No code is involved: Google's SSO with third-party IdP setting accepts any OpenID Connect provider, and EntryIdP is one.

You'll need about 30 minutes, an EntryIdP tenant administrator, and a Google Workspace administrator.

How it works

1. Someone goes to Gmail and types their work address.
2. Google sees they're in a group that uses EntryIdP, and sends them to EntryIdP.
3. They do a face scan. EntryIdP finds their account.
4. Google reads their email address from EntryIdP and opens the Google account with that address.

Google matches on email address alone

Google opens whichever account matches the email EntryIdP returns. EntryIdP only returns an email once the person has verified it, so an unverified address can't open anyone's mailbox. It also means everyone must verify their email in EntryIdP before their first Google sign-in.

Before you start

Each person must create an EntryIdP account and verify their email before you add them

The code that verifies an email address is sent to that person's Gmail. Once they are in the EntryIdP group, Gmail only opens for a verified EntryIdP email. So if you add someone before they have verified, and their Google session ends, they can't read the code and can't get into Gmail. Follow Add people in this order for everyone, including your first tester.

• [ ] You have someone who can add SSO profiles and groups in the Google Admin console.
• [ ] You know which of your people are Google super admins. Google has always signed super admins in with their Google password. Check whether that still applies to OIDC profiles; if it does, a super admin needs a separate everyday account to sign in with EntryIdP.

Step 1: Register Google as an app in EntryIdP

In your tenant's admin portal ({issuer}/tenant), add a new app:

Setting	Value
Name	Google Workspace
Type	Confidential (it has a client secret)
Scopes	openid profile
Redirect URI	Any placeholder for now, such as http://localhost:8081/callback. You'll replace it in step 2.

Copy the client ID and client secret. The secret is shown only once.

Limit who can use it

Turn on Require access approval for this app. Only people you approve can then sign in to Google through EntryIdP.

Step 2: Add EntryIdP to Google

In the Google Admin console:

1. Go to Security → Authentication → SSO with third party IdP.

2. Under Third-party SSO profiles, select Add OIDC profile.

3. Fill in:

   Field	Value
   Profile name	EntryIdP
   Client ID	From step 1
   Client secret	From step 1
   Issuer URL	Copy the issuer value from {issuer}/.well-known/openid-configuration exactly, including any trailing /
   Change password URL	{issuer}/me. EntryIdP has no passwords, but Google requires this field.

4. Select Save, then copy the Redirect URI Google now shows.

5. Back in EntryIdP, replace the app's placeholder redirect URI with Google's, exactly as shown. Updating the app doesn't change its secret.

Your issuer is https://idp.entryidp.com on Production. See How it works for the other environments.

Step 3: Turn it on for one group only

Google applies an SSO profile to your top-level organisational unit, and so to everyone, unless you tell it otherwise. That unit can't be removed from the assignment screen, so set it to None and assign EntryIdP to a group instead. A group's assignment overrides its members' organisational unit.

Still in the Google Admin console, under Security → Authentication → SSO with third party IdP, select Manage SSO profile assignments:

1. Turn it off for everyone. Under Organizational Units, select your top-level unit (your organisation's name). Set Select SSO profile to None, then Save. Everyone keeps signing in with their Google password.
2. Create a group, for example entryidp-sso, in Directory → Groups. Leave it empty for now.
3. Turn it on for the group. Back in Manage SSO profile assignments, under Groups, select the group. Set Select SSO profile to EntryIdP, choose Have Google prompt for their username, then redirect them to this profile's IDP sign-in page, then Save.

The other option, Require users to enter their Google username and password to sign in, keeps the Google password for anyone who goes straight to Gmail, so the profile would have no effect for them.

Changes can take a few minutes to apply. Then add one person to test with, following the order below.

Add people in this order

Do this for each person, including your first tester:

1. They create their EntryIdP account: at {issuer}/me, select Create Entry Account. They must use exactly their Google Workspace primary address.
2. They verify their email, while they can still sign in to Gmail with their Google password: open the code EntryIdP sends, or verify later at {issuer}/me.
3. You check it's verified. They can see it on {issuer}/me.
4. Only then, you add them to the group.

Their next Google sign-in goes through EntryIdP. Anyone already signed in to Google stays signed in until their Google session ends.

Step 4: Test

Use a private browser window for each test.

Test	Expected result
A person with a verified EntryIdP email signs in at gmail.com	Face scan, then Gmail opens
The same person in the Gmail app on iOS and Android	Same as above
A person whose EntryIdP email isn't verified	Face scan, then Google's "Couldn't sign you in"
A person with no EntryIdP account	Face scan, then Google's "Couldn't sign you in"

Also sign in as someone not in the group: Google should ask for their Google password as before. If it sends them to EntryIdP, the profile is still assigned to an organisational unit; go back to step 3.

When everything behaves as expected, add the rest of your people to the group, each in the order above.

Troubleshooting

What the person sees	Likely cause	What to do
Google asks for a password instead of sending them to EntryIdP	They aren't in the group yet, the assignment hasn't applied, or the group's profile uses the Require users to enter their Google username and password option	Check the group and its option, then wait a few minutes
People outside the group are sent to EntryIdP	The profile is still assigned to an organisational unit	Set that unit's profile to None (step 3)
"Couldn't sign you in. Google couldn't verify this account belongs to you."	They have no EntryIdP account, their EntryIdP email isn't verified, or it doesn't exactly match their Google address	See Someone is locked out
Recover account then says "Google doesn't provide another way to sign in to this account"	Same as above: they're locked out of Google	See Someone is locked out
An EntryIdP error about the redirect URI	The app's redirect URI doesn't match Google's	Copy it again from the Google profile, exactly
Google says the issuer doesn't match	A trailing / is missing or extra in the Issuer URL	Copy issuer exactly from the discovery document

Someone is locked out

They can't verify their email, because the code goes to the Gmail they can't open. To let them back in:

1. A Google admin removes them from the group. They can now sign in with their Google password.
2. At {issuer}/me, they create their EntryIdP account if they haven't (Create Entry Account), and verify their email.
3. You add them back to the group.

Turn it off

Remove the group's SSO profile assignment in the Google Admin console. Its members go back to their Google passwords straight away. Nothing needs to change in EntryIdP.

Good to know

• The face scan happens when someone signs in to Google, not every time Gmail opens. To ask more often, shorten the session under Security → Access and data control → Google session control.
• Google accounts are still created in Google. EntryIdP only signs people in.
• Google's Cloud command-line tool doesn't support signing in again through OIDC, according to Google.

See Google's own guide: Set up SSO with a third-party IdP.