This article guides setup of Google Workspace as a client-managed identity provider for signing into Finalsite, including what to configure in Google Cloud Console and which values to send to Finalsite to complete the connection.
Looking for a different Google product?
Schools use several different Google products day to day, and only one of them is what this article covers. Not sure which one applies here?
| Google product | Does this article apply? |
|---|---|
| Google Classroom, Google Sites, Google Calendar, Google Drive, Gmail, and other Google apps | No. These are day-to-day tools for students, families, and staff. Nothing in this article changes how they work. |
| Google Workspace (sign-in only) | Yes. This article covers using a Google Workspace account as a sign-in method for Finalsite. It does not touch Classroom, Sites, Calendar, or any other Google product's settings. |
💡Quick answers
- What is this setup used for? Signing into Finalsite using a Google Workspace account, with the school's own IT team keeping full control over the connection.
- Which protocol does it use? OAuth 2.0 and OpenID Connect (OIDC), an industry-standard way for one system to confirm a user's identity to another without sharing a password. This connection does not use SAML.
- What access is needed before starting? Administrative access to Google Cloud Console for the school's organization, permission to create or modify Google Cloud projects, and sufficient OAuth admin rights to publish the consent screen (a Google Workspace super admin typically has this).
- What does Finalsite need at the end of setup? Two values: the Client ID and Client Secret, sent over a secure channel rather than email.
- Does this require Google's app verification process? Not for schools that keep the consent screen set to Internal user type, which limits sign-in to accounts in the school's own Google Workspace domain. Choosing External user type instead requires completing Google's app verification before it can be used beyond a short list of test users.
- Is this the only way to set up Google sign-in? No. Schools that do not need this level of control can use the Quick Setup with Finalsite option instead, which requires no configuration on the school's side.
Google Workspace is Google's suite of cloud identity and productivity tools, widely used by schools for email, documents, and sign-in. Not familiar with it? Google's own overview of Google Workspace covers what it includes and how schools typically use it. Setting it up as a client-managed identity provider lets a school's own IT team register and control the OAuth connection Finalsite uses to check who someone is, rather than relying on a connection Finalsite manages by default.
This guide walks through creating an OAuth client in Google Cloud Console, generating the values Finalsite needs, and where to go if something stops working.
In this article
- When to use this setup
- Before starting
- Step 1: Create or select a Google Cloud project
- Step 2: Configure the OAuth consent screen
- Step 3: Create OAuth 2.0 client credentials
- Step 4: Add the authorized redirect URI
- Step 5: Capture the Client ID and Client Secret
- Step 6: Send the values to Finalsite
- Troubleshoot common issues
- Alternative: Quick Setup with Finalsite
Am I eligible, and how does this work?
This setup is available to schools that manage their own Google Cloud Console access for their Google Workspace domain and want full control over the connection Finalsite uses to sign users in. Schools that do not need that level of control can skip this guide entirely and request the Quick Setup with Finalsite option instead, which requires no configuration on the school's side.
Once set up, this works as a sign-in option, not a data sync. Instead of typing a Finalsite password, someone can choose to sign in with the Google Workspace account already used at school. Google checks who they are and sends Finalsite a confirmation; Finalsite never sees or stores the Google password.
Setting this up requires creating an OAuth client in Google Cloud Console and sending Finalsite two values from that client: a Client ID and a Client Secret. The steps below cover exactly what to do and where to find each value.
When to use this setup
Use this setup when a school requires full control over the Google OAuth application Finalsite uses for authentication. Schools that do not need this level of control can request the Quick Setup with Finalsite option instead; it requires no configuration on the school's side and is enough for most schools.
Before starting
Confirm access to the following before beginning:
- Administrative access to Google Cloud Console for the school's organization
- Permission to create or modify Google Cloud projects in the school's domain
- Sufficient OAuth admin rights to publish the consent screen (a Google Workspace super admin typically has this)
Finalsite also provides one value needed during setup:
-
Authorized redirect URI:
https://auth-us-east1.finalsite.com/oauth2/callback
Step 1: Create or select a Google Cloud project
- Sign in to the Google Cloud Console with an account that has admin rights for the school's organization.
- In the top-left, click the project picker, then click New Project.
- Name the project, such as
Finalsite SSO, and assign it to the school's organization. Click Create. - Once the project is created, make sure it is selected in the project picker.
- An existing project can be used instead; just make sure it is selected before continuing.
Step 2: Configure the OAuth consent screen
- In the left menu, select APIs & Services, then OAuth consent screen.
- Choose a User Type:
- Internal (recommended for most schools): only members of the school's Google Workspace domain can sign in. No Google verification process is required.
- External: any Google account can sign in. Google requires app verification before the app can be used outside a short list of test users.
- Click Create.
- On the App information page, fill in:
-
App name:
Finalsite SSO, or a name users will recognize. - User support email: the school's IT support address.
-
Authorized domains: add
finalsite.com. Google's Authorized domains field accepts the top-level domain only, with no protocol and no subdomain, and is what permits Finalsite's redirect URI host to be used by this OAuth client. - Developer contact information: an email address Google can reach the school at.
-
App name:
- Click Save and Continue.
- On the Scopes page, click Add or Remove Scopes and add the scopes the school's IT lead has approved for this integration. The typical set Finalsite requests is
openid,.../auth/userinfo.email, and.../auth/userinfo.profile. - Click Update, then Save and Continue.
- For External user type only: on the Test users page, add email addresses of users who should be able to test before app verification. Click Save and Continue.
- Review the summary and click Back to Dashboard.
Check with IT before adding scopes
Confirm the scope list above with the school's IT lead before adding it. Some organizations restrict which OAuth scopes can be granted to third-party applications. If a different set is approved, let the Finalsite contact know; some scopes are required for sign-in to function, and Finalsite will flag anything in the approved set that is incompatible.
Need more help? Visit Google's guide on configuring the OAuth consent screen.
Step 3: Create OAuth 2.0 client credentials
- In the left menu, select APIs & Services, then Credentials.
- Click + Create Credentials, then OAuth client ID.
- Choose Application type: Web application.
- Set Name:
Finalsite SSO. - Do not click Create yet; continue to the next step.
Step 4: Add the authorized redirect URI
- Under Authorized redirect URIs, click + Add URI.
- Paste the redirect URI Finalsite provided:
https://auth-us-east1.finalsite.com/oauth2/callback - Click Create.
Need more help? Visit Google's guide on managing OAuth clients, which also covers redirect URIs and client secrets.
Step 5: Capture the Client ID and Client Secret
- A window appears showing the Client ID and Client Secret. Copy both values immediately and save them somewhere secure.
- If the window is closed before copying, both values can still be retrieved later by selecting the client on the Credentials page.
Step 6: Send the values to Finalsite
Send the Finalsite contact the following two values. Use a secure channel; the client secret is sensitive and should not be shared by email.
| Field | Where to find it |
|---|---|
| Client ID | OAuth client details page |
| Client Secret | OAuth client details page |
Finalsite uses these values to configure the connection, tests it, and confirms once sign-in is working.
Troubleshoot common issues
- Users see a "This app isn't verified" warning when signing in. This applies only to External user-type apps. Complete Google's app verification process, or switch the consent screen to Internal user type if all users are in the school's Google Workspace domain.
- "Error 400: redirect_uri_mismatch" when users try to sign in. The redirect URI configured in Step 4 does not exactly match the one Finalsite expects. Verify the URI character-for-character with the Finalsite contact and update Authorized redirect URIs on the Credentials page.
- "Access blocked: Authorization Error" with no further detail. The two most common causes are that the consent screen has not been published, or the user signing in is not on the Test users list (External apps still in testing mode). Publish the consent screen, or add the user under OAuth consent screen, then Test users.
Alternative: Quick Setup with Finalsite
Schools that do not need this level of control, or would rather not manage a Google Cloud project, can request the Quick Setup with Finalsite option instead. It requires no configuration on the school's side and is enough for most schools.
Comments
Please Sign in to leave a comment if you don't see the comment box below.