Google sign-in
Sign in with Google on self-hosted Proliferate.
On self-hosted Proliferate, Google sign-in runs through the server's OIDC
connection with Google as the identity provider. The desktop app's built-in sign-in methods
are email and password
and optional
GitHub; when your SSO
connection points at Google, the sign-in screen shows a Google SSO button
(the button label comes from SSO_DISPLAY_NAME, so set it to "Google").
Set up
Create a Google OAuth client
In Google Cloud Console, open APIs & Services, then Credentials, and create an OAuth client ID of type Web application:
- Authorized redirect URI: exactly
https://<site>/auth/sso/oidc/callback
Copy the client ID and client secret.
Configure the server
Set the SSO connection in .env.static in your deploy bundle:
Apply with ./update.sh (or restart the stack). Every SSO_* variable also
accepts a PROLIFERATE_ prefix; both names read the same setting.
SSO_JIT_POLICY decides who gets in:
disabled(the default): Google sign-in is off in practice.existing_user: only emails that already have an account can sign in with Google.create_member: accounts are created automatically on first sign-in, scoped toSSO_ALLOWED_DOMAINS.
Verify
Sign in from a desktop app pointed at your server: the sign-in screen shows the sign-in button labeled "Continue with Google", and completing the Google flow signs you in.
With SSO_JIT_POLICY=create_member, SSO arrivals bypass the invitation
allowlist: anyone with a Google account in your allowed domains gets an
account on first sign-in. Set SSO_ALLOWED_DOMAINS to your organization's
domains before enabling it.
The ADMIN_EMAILS admin floor is asserted on Google sign-ins like every
other method. For the login policy, display name, and the rest of the
SSO_* variables, see
Environment variables.