OIDC Single Sign-On with Google Workspace

Who this guide is for: The Google Workspace administrator who manages your organization’s Google tenant. You will need Google Workspace Super Admin access. See also: SSO Admin Guide for the EmbayLMS configuration side.

Overview

This guide walks through creating an OAuth 2.0 / OIDC client in Google Workspace and connecting it to EmbayLMS. Once complete, your users can click Sign in with SSO on the EmbayLMS login page and authenticate with their Google Workspace account.

Protocol: OpenID Connect (OIDC), authorization code flow

Prerequisites

• Google Workspace Super Admin access
• EmbayLMS admin access
• Your EmbayLMS tenant slug (e.g., acme for acme.embaylms.com)

Step 1 — Create an OAuth 2.0 client in Google Cloud Console

1. Go to the Google Cloud Console and select or create a project for your organization.
2. Navigate to APIs & Services → Credentials.
3. Click Create Credentials → OAuth client ID.
4. If prompted, configure the OAuth consent screen first:
   • Set User type to Internal (limits access to your Workspace org).
   • Fill in the app name (e.g., EmbayLMS) and support email.
   • Add the scope: openid, email, profile.
   • Save.
5. Back on Create OAuth client ID:
   • Application type: Web application
   • Name: EmbayLMS
   • Authorized redirect URIs — add:

     https://{slug}.embaylms.com/api/auth/oidc/{slug}/callback
     Replace {slug} with your EmbayLMS tenant slug.
6. Click Create.

Google will display your Client ID and Client Secret — copy both now.

Step 2 — Note the Google OIDC discovery URL

Google’s OIDC discovery URL is always:

https://accounts.google.com/.well-known/openid-configuration

You do not need to find this yourself — use it exactly as shown above.

Step 3 — Enter values in EmbayLMS

1. In EmbayLMS, navigate to Admin Panel → Settings → User Management → SSO / Identity.
2. Click Add Identity Provider.
3. Select Google Workspace as the provider type.
4. Fill in the fields:

5. Under JIT Provisioning, configure:
   • Enabled: ON (recommended — creates accounts on first login)
   • Default role: learner
6. Click Save and ensure the configuration is set to Enabled.

Step 4 — Test

1. Open a private / incognito browser window.
2. Navigate to https://{slug}.embaylms.com/login.
3. Click Sign in with SSO.
4. You should be redirected to the Google sign-in page.
5. Sign in with a Google Workspace account in your organization.
6. You should land on the EmbayLMS dashboard.

Configuration reference

Troubleshooting

“Error 400: redirect_uri_mismatch” The redirect URI in Google Cloud Console does not match exactly. Ensure the authorized redirect URI is:

https://{slug}.embaylms.com/api/auth/oidc/{slug}/callback

No trailing slash. Check the slug matches your EmbayLMS tenant exactly.

“Error 403: access_denied” The OAuth consent screen is set to External and the signing-in user is not added as a test user, OR the consent screen is Internal and the user is outside your Google Workspace organization. Verify the user belongs to your Workspace org.

“Your account was not found” in EmbayLMS JIT provisioning is disabled. Enable it in EmbayLMS (Settings → User Management → SSO / Identity → Edit) or pre-create the user account manually.

“The SSO response from your identity provider was invalid” The Client Secret stored in EmbayLMS may be incorrect or rotated. Generate a new secret in Google Cloud Console and update it in EmbayLMS.

Related guides

• SSO Admin Guide
• SAML with Okta
• SAML with Microsoft Entra ID