# Google Authentication - OIDC with Google IdP

## Log in to AC for Operations

### Setting

Confirm the values below according to the domain or IP and port where digiRunner is installed.

Example:

**DGR\_PUBLIC\_DOMAIN** = localhost

**DGR\_PUBLIC\_PORT** = 18080

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/Tuj6H4G7r6xtP6fhgg9m/image.png" alt=""><figcaption></figcaption></figure>

Confirm the IP:port of gtw\* according to the domain or IP where digiRunner is installed.

Example: <https://localhost:18080>

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/hgb2FjIQG2DKAskxxX86/image.png" alt=""><figcaption></figcaption></figure>

Test digiRunner well-known URL (based on the domain or IP of your installation):

<https://localhost:18080/dgrv4/ssotoken/API/.well-known/openid-configuration>

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/AfVQ4K4RNRgNKO7Y3HCf/image.png" alt=""><figcaption></figcaption></figure>

### Create API (Register & Enable)

Enter the information and click **Register**.

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/b6g6zJf3OuTQH4aZFwqw/image.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/QCuNoc5KUztru17OKOZ5/image.png" alt=""><figcaption></figcaption></figure>

Check the API you want to enable and click **Enable**.

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/Rdwd84G1JdfC76YhOOAF/image.png" alt=""><figcaption></figcaption></figure>

Click **Confirm**.

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/3vW6n79q1UQUXE3CXAoA/image.png" alt=""><figcaption></figcaption></figure>

Successfully enabled.

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/7vbcFjYd1okuT5t0o9FP/image.png" alt=""><figcaption></figcaption></figure>

### Create Group

Click Create Group.

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/Mhh5EM2h2lzWB4i3J4ma/image.png" alt=""><figcaption></figcaption></figure>

Enter information, click Select, and add the API to the group.

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/ddwx2fJPCq1RAVbRleDd/image.png" alt=""><figcaption></figcaption></figure>

In the selected API Module, click **Select**, then click **Apply**.

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/wFXnvUQJxmMXVAIJdDE1/image.png" alt=""><figcaption></figcaption></figure>

In the API Module, click **Select API**.

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/JOFhfIXJdCofEErChcB8/image.png" alt=""><figcaption></figcaption></figure>

In the selected API, click **Select**, then click **Apply**.

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/LZfECrMJFW5ICR1L0mDZ/image.png" alt=""><figcaption></figcaption></figure>

Click **Create**.

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/qFkzMeF0LFDfGhOJuhW3/image.png" alt=""><figcaption></figcaption></figure>

### Create Client

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/ag3jZbfwRkneKdjs2Afk/image.png" alt=""><figcaption></figcaption></figure>

#### googleclient

#### Set Redirect URL

Fill in Postman's callback URL:

<https://oauth.pstmn.io/v1/callback>

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/qWEmhAlmpNjJuo6jLKGx/image.png" alt=""><figcaption></figcaption></figure>

#### Add to group for authorization

## Log in to GCP (Google Cloud Platform) Developer Console

Using the Google scenario:

This page explains how to configure an APIM connection with a Google account.

### Obtain Client ID & Secret from Google

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/uEvZbY0Pw4bA1YhDY4UA/image.png" alt=""><figcaption></figcaption></figure>

Example:

Client ID:

254605600767-foopq8l8dj6cvptk110d6i\*\*\*\*\*\*\*\*\*\*.apps.googleusercontent.com

Client Secret:

GOCSPX-1aZqPRpQqU0Ga3Ssdy\*\*\*\*\*\*\*\*\*\*

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/qhWOVAuWzFpzgK62jP0Q/image.png" alt=""><figcaption></figcaption></figure>

### Set Authorized Redirect URI (digiRunner Callback URI)

Example:

Postman's testing callback URI:

<https://oauth.pstmn.io/v1/callback>

digiRunner's callback URI:

<https://localhost:8080/dgrv4/ssotoken/gtwidp/GOOGLE/gtwIdPCallback>

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/AXvUwt5umXPlMvFagfPB/image.png" alt=""><figcaption></figcaption></figure>

### Use Postman to Test Google OIDC and Obtain id\_token

1\. Go to the **Authorization** tab.

2\. Type: Select **OAuth 2.0**.

3\. Header Prefix: **Bearer**.

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/OC6x0BtVUUsw2lJowO7r/image.png" alt=""><figcaption></figcaption></figure>

4\. Grant Type: Select **Authorization Code**.

5\. Callback URL: Check **Authorize using browser**.

6\. Auth URL, Access Token URL, and Scope (points 1–3) can be obtained from Google’s well-known URL:

<https://accounts.google.com/.well-known/openid-configuration>

Scope: Separate with spaces.

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/JN7P6hjW0J5JOFDN8pUE/image.png" alt=""><figcaption></figcaption></figure>

7. Client ID & Client Secret: From the Google account registration (points 4 and 5).

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/qe7VlTcHcHrOES67P3XP/image.png" alt=""><figcaption></figcaption></figure>

8\. State: {{$guid}}

9\. Click **Get New Access Token**.

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/N16dTVMJc3RVAZULGETf/image.png" alt=""><figcaption></figcaption></figure>

10. The Google login page appears. User enters credentials.

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/VxL4GPVUt2L3KmXMPwAB/image.png" alt=""><figcaption></figcaption></figure>

11\. After successful authentication, click **Proceed**.

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/tdx8Jj6H2LCFEBZuy7J5/image.png" alt=""><figcaption></figcaption></figure>

12. Google id\_token is obtained.

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/MVF6gJmOA8to7BecKUMk/image.png" alt=""><figcaption></figcaption></figure>

## Log in to AC Again (Enter Google Information)

### Client Management / GTW OAuth 2.0 IdP

For the specified client, click **Details**.

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/LGNWwaY8yXnXDIJy6krz/image.png" alt=""><figcaption></figcaption></figure>

Click **Create**.

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/kfQJD4HYa1Cj62IvcyKD/image.png" alt=""><figcaption></figcaption></figure>

Fill in the fields:

* **Enable**: Whether to enable, e.g., Y
* **Type**: Google
* **Remark**: Description or notes
* **IdP Client ID**: Client ID registered with Google
* **IdP Client Name**: Human-readable identifier
* **IdP Client Password**: Client Secret registered with Google
* **Callback URL**: For Google to return the authentication result; this is the digiRunner callback URL, same as in section 2.2.\
  Example:\
  <https://localhost:8080/dgrv4/ssotoken/gtwidp/GOOGLE/gtwIdPCallback>
* **Well Known URL**: The Service Discovery URL provided by OIDC for protocol-based auto-discovery of features.\
  Example:\
  <https://accounts.google.com/.well-known/openid-configuration>

**Note**: Auth URL, Access Token URL, and Scope can be omitted, since these are included in the well-known config.

Click **Create**.

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/dnFv4uAnjAgo8g6CcfAC/image.png" alt=""><figcaption></figcaption></figure>

## Using Postman

1\. Go to the **Authorization** tab.

2\. Type: Select **OAuth 2.0**.

3\. Header Prefix: **Bearer**.

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/zxcQcUlC6LqJhQIblxbt/image.png" alt=""><figcaption></figcaption></figure>

4. Auth URL, Access Token URL, and Scope (points 1–3) can be obtained from digiRunner’s well-known URL:
   \
   <https://localhost:8080/dgrv4/ssotoken/GOOGLE/.well-known/openid-configuration>
   \
   Scope: Separate with spaces.

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/IiG9tlwgK7JgIne9XR5D/image.png" alt=""><figcaption></figcaption></figure>

5\. Client ID: digiRunner's client ID (e.g., googleclient)

6\. Client Secret: digiRunner’s client secret. Needs Base64 encoding.\
Use online tools for Base64 Encode.

7\. Scope: Separate with spaces\
openid email profile

8\. State: Random UUID\
{{$guid}}

9\. Click **Get New Access Token**

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/WAesor1IsKUGQGPJLvlZ/image.png" alt=""><figcaption></figcaption></figure>

10. The Google login screen will appear. Enter credentials.

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/heFbyupZrbOWzzswS632/image.png" alt=""><figcaption></figcaption></figure>

11\. Authentication success – click **Proceed**

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/GWlrbC682zUYT3oFXp3R/image.png" alt=""><figcaption></figcaption></figure>

12. id\_token from digiRunner is obtained.

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/lKj8JRvDHNPVACVRtTzg/image.png" alt=""><figcaption></figcaption></figure>

## Verifying id\_token with External Third-Party Website

Paste the id\_token value into the left-hand "Encoded" window on [JWT.io](https://jwt.io), and it will automatically obtain the public key.

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/0a0MXDrMRD6CEz43ZdUR/image.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://content.gitbook.com/content/0choIC1BbdPOkKWOYGgk/blobs/REvutfJkAqWhoLKqpmEl/image.png" alt=""><figcaption></figcaption></figure>
