Smoothwall SSL Google Login button Authentication

[timbo343]

We are trying to set up the Google Authentication login button on the SSL pages for those who use laptops and don't have an Active Directory account or want to move around schools.

 

I hate the API / development console of Google with a passion. I never know what account i need to be using to get to my projects and when creating these projects the help guides from Google are so bland!

 

Can anyone give an idiots guide to creating a Client ID and Secret please. I've put in a ticket to Smoothwall but hoping someone can talk me through it on here too.

[timbo343]

I think i'm nearly done getting this working so will type up the steps i did to get it working as Google's notes are a bit unclear.

[tom_newton]

If you do I will transpose it into a kb article and buy you a beer next time I see you

[timbo343]

Ive got it working, just need to do some more tests.

[timbo343]

So the process of getting this to work for me goes a follows:

 

Sign into Google Console Cloud (console.cloud.google.com) with an account you want to build the OAuth app with.

 

From the top left of the window, click on New Project, give it a name and click Create.

 

 

Form the top left of the window again, click the drop down menu and select the project you've just created.

 

Click on to APIs and Services and on the left click on OAuth Consent Screen.

 

 

Depending on who you want to authenticate with this OAuth app, you need to decide on Internal or External.

> Internal is to be used for ONLY those authenticating within this Google domain - this contains all subdomains of this domain.

> External is to be used when ANYONE with a Google account can use this authentication.

Click Create.

 

 

Now it's time to add the app information.

> App Name - the name of this app to be shown to users.

> User support email - this is usually the email of the account you are using.

> App Logo - you can add an app logo if you wish.

> App Domain

- add your business URL

- add your business URL Privacy policy link

- Terms of service is optional

> Authorised Domains - add your internal, external and Google Domains to this section.

> Developer contact information - Add an email address if anyone needs to contact you.

Click Save and Continue.

 

Now configure the Scopes

> Click on Add or Remove Scopes. I've added the first 3 which for me are:

- .../auth/userinfo.email

- .../auth/userinfo.profile

- openid

Tick the ones you want and click Update.

These will be added to the Your non-sensitive scopes section.

Click Save and Continue

 

On the summary screen click Back to Dashboard.

 

Now on the left hand side menu, click on Credentials.

From the top of this window, click on Create Credentials > Choose OAuth Client ID

Choose Web Application from the Application Type.

Give it a name.

 

Add in the Authorised JavaScript origins and Authorised redirect URIs. I added both http and https to cover all bases.

 

Authorised JavaScripts origins:

This was in the format http://[NetBIOSnameOfSmoothwall]:442 and https://[NetBIOSnameOfSmoothwall]

 

Authorised redirect URIs

This was in the format http://[NetBIOSnameOfSmoothwall]:442/oauth2callback and https://[NetBIOSnameOfSmoothwall]/oauth2callback

 

Click Save

 

 

You'll now be give the Client ID and Client Secret which need to be copied and pasted into your Smoothwall under the Google Section (Services > Authentication > Google).

 

I'm going to try and get our trust of 11 schools to use one ID.

 

You will need to make sure all the OUs you use / users are going to use are mapped in your Smoothwall to the correct Smoothwall groups.

[timbo343]

So, for those using anything other than a public top level domain for your internal domains, you will face this error:

 

Invalid origin: Must end with a public top-level domain (such as .com or .org).

[tom_newton]

That's awesome - and on top of that you have proved that you can do it for external google account holders too (could be nice for guests?)

[timbo343]

That's awesome - and on top of that you have proved that you can do it for external google account holders too (could be nice for guests?)

There is a caveat with external though. There is a limit to how many authentications can be made.