Setting up SSO with Google Workspace

Google Workspace is one of three identity providers iShared.app supports for single sign-on, alongside Okta and Microsoft Entra ID. This guide covers connecting Google Workspace via OIDC and using just-in-time (JIT) provisioning so accounts are created automatically the first time someone signs in — no manual invite, and no SCIM directory sync needed.

You'll need Admin or Primary Owner access to your iShared.app organization, and access to the Google Cloud console for your Workspace domain.

Why Google Workspace works differently

Google Workspace doesn't support SCIM the way Okta and Entra ID do here, so instead of push provisioning, iShared.app uses just-in-time provisioning: the first time someone signs in with Google, if their email domain is verified for your organization, their account is created automatically. There's no separate directory sync to configure, and no seat to remove manually if someone leaves — access is controlled by whether they can still sign in with a Google Workspace account on your domain.

Step 1: Verify your company domain

JIT provisioning only creates accounts for a verified domain, so this needs to happen before configuring SSO.

1. In iShared.app, go to Settings → Company domains.
2. Add your Workspace domain (e.g. yourcompany.com) and follow the verification steps shown there.

Step 2: Create an OAuth client in Google Cloud

1. In the Google Cloud console, select or create a project associated with your Workspace domain.
2. Go to APIs & Services → OAuth consent screen and configure it if you haven't already (internal or external, depending on your setup).
3. Go to APIs & Services → Credentials → Create Credentials → OAuth client ID.
4. Choose Web application as the application type and give it a name (e.g. "iShared.app").
5. Leave Authorized redirect URIs blank for now — you'll add it in Step 4.
6. Click Create. Copy the Client ID and Client secret shown.

Step 3: Start the connection in iShared.app

1. In iShared.app, go to Settings → Single sign-on.
2. Set Provider to Google Workspace and Protocol to OIDC.
3. The card shows the redirect URI in the form <API base>/auth/sso/oidc/callback.

Step 4: Set the redirect URI in Google Cloud

Back in the Google Cloud console, edit the OAuth client from Step 2 and add the redirect URI from Step 3 under Authorized redirect URIs. Save.

Step 5: Complete the connection in iShared.app

Back in Settings → Single sign-on, fill in:

• Issuer URL: https://accounts.google.com
• Client ID: the client ID from Step 2.
• Client secret: the client secret from Step 2.

Check Automatically create accounts on first sign-in for anyone at a verified company domain — this is the JIT provisioning toggle, and it's the setting that actually gets people into your organization automatically. It's on by default for Google Workspace connections, since there's no SCIM option to use instead.

Check Enabled, then click Save.

Step 6: Try it

Have someone at your verified domain who isn't already a member go to the iShared.app login page and choose Continue with single sign-on. On success, an account and membership are created for them automatically, and they land in your organization immediately — no invite email required.

Requiring SSO org-wide

Once you've confirmed sign-in works, go back to Settings → Single sign-on and check Require SSO. This blocks password login for everyone in the organization except the primary owner, who keeps password access as a fallback in case your Google Workspace domain or OAuth client is ever misconfigured. Turn this on only after verifying SSO works for at least one non-owner account.

Managing access

Because there's no SCIM sync for Google Workspace, removing someone's access happens on the iShared.app side: suspend or remove their membership from Team, or disable their Google Workspace account entirely, which prevents them from completing sign-in. If you need push-based provisioning and deprovisioning instead of JIT, that's available for Entra ID and Okta — see the Entra ID guide or the Okta guide.

Troubleshooting

"redirect_uri_mismatch" from Google: the URI in the OAuth client's Authorized redirect URIs must exactly match the one shown on the Settings card.

Sign-in succeeds but no account is created: confirm the domain is fully verified under Settings → Company domains, and that Automatically create accounts on first sign-in is checked — without it, JIT is off and the person needs an existing invite instead.