Configure OpenID Connect through Google accounts

Summary

OpenID Connect is an authentication layer on top of OAuth 2.0, which is similar to the Security Assertion Markup Language (SAML) authentication. It allows third-party applications to verify the identity of an end-user and provides basic user profile information. This article provides the instructions to configure OpenID Connect through Google accounts.

Procedure

In the Google API Console

1. Open the Google API Console, and log in with a Google account.
2. Click Dashboard > CREATE PROJECT.

3. On the New Project page, fill in the Project name box, and click CREATE.

4. Click OAuth consent screen, and select the External option for User Type. Click CREATE.

5. On the Edit app registration page in the OAuth consent screen section, fill in the App name, User support email, and Email addresses boxes. Click SAVE AND CONTINUE.

6. In the Scopes section, click ADD OR REMOVE SCOPES.

7. In the Update selected scopes window, check the /auth/userinfo.email, /auth/userinfo.profile, and openid check boxes. Click UPDATE.

8. Click SAVE AND CONTINUE.
9. In the Test users section, click ADD USERS. In the Add users window, fill in the email address of the test users, and click ADD.

10. Click SAVE AND CONTINUE.
11. Click Credentials > CREATE CREDENTIALS > OAuth client ID.

12. On the Create OAuth client ID page, click the Application type box, and select Web application.
13. Fill in the name in the Name box, and click CREATE. A Client ID and Client Secret is created. Proceed with the next workflow in ArcGIS Online.

1. Log in to the ArcGIS Online organizational account.
2. Click the Organization tab > Settings. Navigate to Security.
3. On the Security page, navigate to the Logins section. Click New Open ID Connect login.

4. In the Set up OpenID Connect login window, fill in the Login button label, Registered client ID, Registered client secret, Provider scopes/permissions, Provider issuer ID, OAuth 2.0 authorization endpoint URL, Token endpoint URL, and JSON web key set (JWKS) URL boxes.

Note:
The Registered client ID and Registered client secret sections are obtained from Step 13 in the previous workflow. The Provider issuer ID, OAuth 2.0 authorization endpoint URL, Token endpoint URL, and JSON web key set (JWKS) URL sections are obtained from the openid configuration web page.

5. Click Save.

6. Click the Edit icon. In the Edit OpenID Connect login window, navigate to the Login Redirect URI section. Click the Copy button.
7. Click Save.

8. Open Google API Console once more, and navigate to APIs & Services. Click the Credentials tab.
9. In the OAuth 2.0 Client IDs section, click the Edit OAuth client icon on the newly created project.

10. Navigate to the Authorized redirect URIs section, and click ADD URI. Paste the URI from Step 6, and click SAVE.

11. On the Security page in ArcGIS Online, navigate to the Logins section. Toggle the created OpenID Connect login option on.

12. Log out from ArcGIS Online, and log in again through the ArcGIS Online login page.