SSO - Google Workspace

SecDim offers SSO (Single Sign-On) integration with Google Workspace via OpenID Connect (OIDC). This allows users to log in to the SecDim platform using their existing Google Workspace credentials. This guide walks you through the setup steps your Google Workspace administrator needs to complete.

What SecDim Needs from You

Before SecDim can activate SSO for your organisation, collect the following from your Google Workspace setup and send them to your SecDim account manager.

Value Description

Client ID

OAuth 2.0 client ID from your Google Cloud project

Client Secret

OAuth 2.0 client secret — send via a one-time secret tool, not email

Primary email domain

e.g. acme.com — the domain your users sign in with

SecDim will provide you with a provider name and your SSO login URL in the format https://id.secdim.com?auth=<provider>&origin=play once configuration is complete.

Step 1 — Create an OAuth Client in Google Cloud

  1. Go to the Google Cloud Console

  2. Select or create a project for your organisation

  3. Navigate to APIs & Services → Credentials

  4. Click Create Credentials → OAuth client ID

  5. Select Web application as the application type

  6. Set the Name to SecDim SSO (or similar)

  7. Under Authorised redirect URIs, add:

    https://id.secdim.com/account/login/sso/<provider>/callback

    SecDim will give you the exact <provider> slug.

  8. Click Create

  9. Copy the Client ID and Client Secret from the confirmation dialog

Step 2 — Configure the OAuth Consent Screen

  1. Go to APIs & Services → OAuth consent screen

  2. Select Internal as the user type (restricts sign-in to your organisation)

  3. Fill in the required fields:

    • App name: SecDim SSO

    • User support email: your admin email

    • Developer contact information: your admin email

  4. Under Scopes, add:

    • openid

    • email

    • profile

  5. Save the configuration

Step 3 — Send Credentials to SecDim

Send the following to your SecDim account manager securely (not by email):

Value Where to find it

Client ID

APIs & Services → Credentials → OAuth 2.0 Client IDs

Client Secret

Shown on creation (send securely)

Primary email domain

e.g. acme.com

Google OAuth client secrets do not expire by default, but you can rotate them at any time from the Google Cloud Console. If you rotate the secret, send the new value to your SecDim account manager.

Step 4 — (Optional) Automatic Department Assignment

If you want users to be automatically assigned to departments within SecDim on first login, you can expose a custom department claim from your Google Workspace directory.

Let your SecDim account manager know the exact claim name so they can configure the mapping on the SecDim side. The department name in SecDim must match exactly with the value from Google.

Step 5 — Test

Once SecDim confirms the configuration is active:

  1. Open https://id.secdim.com?auth=<provider>&origin=play in a private browser window

  2. You will be redirected to Google to authenticate

  3. Sign in with a Google Workspace account from your organisation

  4. Confirm you land in SecDim associated with the correct company subscription

See Also