Skip to main content

​
Overview

This integration allows your users to sign in to Fiddler using their existing Google account, without needing a separate Fiddler password. Users are automatically provisioned on their first successful login — no manual invitations required.
Google OIDC does not support group synchronization — Google does not include group membership in its OIDC tokens. Users are provisioned individually; assign them to Fiddler teams and roles manually.

​
Prerequisites

Before starting, ensure you have:
  • Google Cloud Access: Permissions to create and configure OAuth 2.0 credentials in a Google Cloud project.
  • Fiddler AuthN Administrator Access: Org Owner role in Fiddler’s AuthN management console.
  • Deployment Information: The hostname of your Fiddler deployment, e.g. idpexample.dev.fiddler.ai.

​
Configuring Google

Fiddler requires two redirect URIs on the Google OAuth client. You will add both when creating the client below:
  • https://authn-{base_url}/ui/login/login/externalidp/callback
  • https://authn-{base_url}/idps/callback
Replace {base_url} with your Fiddler deployment host (e.g. idpexample.dev.fiddler.ai).
1

Configure the OAuth Consent Screen

  1. In the Google Cloud Console, select your project and go to APIs & Services → OAuth consent screen.
  2. In App information, enter the App name and User support email.
  3. In Audience, select Internal or External depending on your organization’s setup and access requirements.
  4. In Contact Information, add the required email addresses.
  5. Agree to the Google API Services: User Data Policy, then select Create.
If you selected External, the app starts in testing mode — only accounts added under Test users can sign in until you publish the app (set it to In production). See Manage app audience for details.
2

Create an OAuth 2.0 Client

  1. Go to APIs & Services → Credentials, then select Create Credentials → OAuth client ID. Google Cloud create OAuth client
  2. Select Web application for the Application type and enter a name, e.g. Fiddler IdP Example.
  3. Under Authorized redirect URIs, add both redirect URIs (replace the host with your deployment):
    • https://authn-idpexample.dev.fiddler.ai/ui/login/login/externalidp/callback
    • https://authn-idpexample.dev.fiddler.ai/idps/callback
    Google Cloud OAuth client name, type, and redirect URIs
  4. Select Create.
  5. Copy the Client ID and Client Secret — you will need them when configuring Fiddler. Google Cloud OAuth client credentials

​
Configuring Fiddler

1

Fiddler AuthN Console Sign-in

The URL to the Fiddler AuthN management console is your Fiddler instance base URL prepended with authn-. For example, if your Fiddler base URL is https://idpexample.dev.fiddler.ai then you will access the AuthN management console at https://authn-idpexample.dev.fiddler.ai.
Sign in using the AuthN console Org Owner user account credentials provided by your Fiddler representative.Fiddler AuthN console sign-in page
2

Select Your Organization

Ensure your organization is selected in the dropdown. You may see the fiddler organization, but this is reserved for system use and should not be edited. Here we are using the idpexample organization.Fiddler AuthN console home page
3

Navigate to Identity Providers in Settings

Select Settings tab from the top menu and then select Identity Providers from the left navigation menu.Fiddler AuthN console add provider page
4

Add a New Google Provider

  1. Select the Google option in the Add provider section, which brings up the Google Provider form.
  2. Note the callback URL shown in the form — it corresponds to the redirect URIs you registered in Google earlier, so no further changes are needed in Google. Fiddler AuthN console add new Google provider form with callback URL
5

Configure the Google Provider in Fiddler

In the Google Provider form, paste the Client ID and Client Secret copied from Google earlier.Fiddler AuthN console Google provider client credentials
6

Configure Additional Parameters

  1. Expand the optional section.
  2. Ensure the Scopes List includes openid, profile, and email.
  3. Ensure the Automatic create and Automatic update checkboxes are selected.
  4. Set the Determines whether an identity will be prompted to be linked to an existing account dropdown to Check for existing Username. Fiddler AuthN console automatic create/update and check existing username settings
7

Save the Configuration Changes

Select the Create button and then select the Save button. You will be returned to the Organization Settings page.Fiddler AuthN console with newly created Google OIDC IdP
8

Activate the Google OIDC IdP

  1. Select your IdP from the list and select the Activate button on the identity provider page. Fiddler AuthN console activate new Google OIDC IdP
  2. Close the settings and then select Login Behavior and Security from the left nav menu and ensure the External login allowed checkbox is selected. Fiddler AuthN console allow external login behavior
  3. Select the Save button. Fiddler AuthN console external login allowed
9

Create a Custom Action

Select the Actions tab from the top menu.Fiddler AuthN console new custom Action script
  1. Select the New button in the Scripts section to create a new action script.
  2. Copy the Google OIDC Action Script below and paste it into the script text area.
  3. Enter setAttributesOnGoogleOIDCAuth in the Name text box.
  4. Select the Add button.
File: Google OIDC Action Script
function setAttributesOnGoogleOIDCAuth(ctx, api) {
    let firstName = ctx.v1.providerInfo.getFirstName();
    let lastName = ctx.v1.providerInfo.getLastName();
    let email = ctx.v1.providerInfo.getEmail();

    let nameParts = [firstName, lastName];
    let filteredParts = nameParts.filter(part => part);
    let displayName = filteredParts.join(' ');

    if (firstName != undefined) {
      api.setFirstName(firstName);
    }
    if (lastName != undefined) {
      api.setLastName(lastName);
    }
    if (email != undefined) {
      email = email.toLowerCase();
      api.setEmail(email);
      api.setEmailVerified(true);
      api.setPreferredUsername(email);
    }

    if (displayName) {
      api.setDisplayName(displayName);
    }

    api.v1.user.appendMetadata('fiddler_authentication_type', 'SSO:GOOGLE:OIDC');
    api.v1.user.appendMetadata('fiddler_groups', []);
}
10

Configure the Action Trigger

Scroll down to the Flows section.Fiddler AuthN console new Action trigger creation
  1. Select the External Authentication option for the Flow Type dropdown.
  2. Select the + Add trigger button.
  3. Select the Post Authentication option for the Trigger Type dropdown.
  4. Select the setAttributesOnGoogleOIDCAuth option for the Actions dropdown.
  5. Select the Save button.
11

Set the Organization SSO Authentication Type

Add an organization metadata key so Fiddler can correctly identify and process this SSO connection. Set this once during setup.
  1. Go to the Metadata section and select Edit. Fiddler AuthN console organization metadata section
  2. Select the Add button, then enter the key fiddler_sso_authentication_type with the value SSO:GOOGLE:OIDC. Fiddler AuthN console organization metadata with Google OIDC authentication type
  3. Select the Save button next to the new entry.
12

Validate the Integration

Before validating, make sure your Google account can sign in: for an Internal consent screen it must belong to your Google Workspace organization; for an External app still in testing it must be added as a Test user.
  1. Open your Fiddler URL (e.g. https://idpexample.dev.fiddler.ai).
  2. Ensure you see the Fiddler sign-in page and that it displays the Google SSO login button. Fiddler application homepage displaying the new SSO login method in addition to the email sign-in form
  3. Select the button and confirm that the Fiddler application loads. Fiddler application landing page
The first user to sign in to the Fiddler application is automatically assigned the Fiddler Org Admin role; subsequent members are Org Members by default.

​
Getting Help

If sign-in fails, verify the OAuth client configuration in the Google Cloud Console (redirect URIs, consent screen status, client credentials). For Fiddler-side issues, see the SSO Authentication Guide. If the issue persists, contact your Fiddler representative with the specific error message.

​
Important Notes

  • Data Storage: Fiddler stores the following profile attributes from Google: first name, last name, display name, and email address.
  • No Group Synchronization: Google OIDC does not provide group membership, so group sync to Fiddler teams is not available. Assign users to teams and roles manually.
  • API Access: For programmatic API access, users create an API key from the Credentials tab in Fiddler’s Settings page.
  • Single Authentication Method: Users can only authenticate via either SSO or email authentication, not both.

​
Next Steps

After successful integration:
  • Train Users: Provide guidance on accessing Fiddler through Google SSO.
  • Assign Roles: Manually assign users to the appropriate Fiddler teams and roles after their first login.
  • Monitor Usage: Review authentication logs and user access patterns.