> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fiddler.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Google OIDC
> Learn how to configure Fiddler with Google for Single Sign-On (SSO) using the OpenID Connect (OIDC) protocol.
## Overview
This integration allows your users to sign in to Fiddler using their existing Google account, without needing a separate Fiddler password. Users are automatically provisioned on their first successful login — no manual invitations required.
Google OIDC does not support group synchronization — Google does not include group membership in its OIDC tokens. Users are provisioned individually; assign them to Fiddler teams and roles manually.
## Prerequisites
Before starting, ensure you have:
* **Google Cloud Access**: Permissions to create and configure OAuth 2.0 credentials in a Google Cloud project.
* **Fiddler AuthN Administrator Access**: Org Owner role in Fiddler's AuthN management console.
* **Deployment Information**: The hostname of your Fiddler deployment, e.g. `idpexample.dev.fiddler.ai`.
## Configuring Google
Fiddler requires two redirect URIs on the Google OAuth client. You will add both when creating the client below:
* `https://authn-{base_url}/ui/login/login/externalidp/callback`
* `https://authn-{base_url}/idps/callback`
Replace `{base_url}` with your Fiddler deployment host (e.g. `idpexample.dev.fiddler.ai`).
1. In the [Google Cloud Console](https://console.cloud.google.com/), select your project and go to *APIs & Services → OAuth consent screen*.
2. In *App information*, enter the *App name* and *User support email*.
3. In *Audience*, select *Internal* or *External* depending on your organization's setup and access requirements.
4. In *Contact Information*, add the required email addresses.
5. Agree to the *Google API Services: User Data Policy*, then select *Create*.
If you selected *External*, the app starts in testing mode — only accounts added under *Test users* can sign in until you publish the app (set it to *In production*). See [Manage app audience](https://support.google.com/cloud/answer/15549945) for details.
1. Go to *APIs & Services → Credentials*, then select *Create Credentials → OAuth client ID*.
2. Select *Web application* for the *Application type* and enter a name, e.g. `Fiddler IdP Example`.
3. Under *Authorized redirect URIs*, add both redirect URIs (replace the host with your deployment):
* `https://authn-idpexample.dev.fiddler.ai/ui/login/login/externalidp/callback`
* `https://authn-idpexample.dev.fiddler.ai/idps/callback`
4. Select *Create*.
5. Copy the *Client ID* and *Client Secret* — you will need them when configuring Fiddler.
## Configuring Fiddler
The URL to the Fiddler AuthN management console is your Fiddler instance base URL prepended with `authn-`. For example, if your Fiddler base URL is `https://idpexample.dev.fiddler.ai` then you will access the AuthN management console at `https://authn-idpexample.dev.fiddler.ai`.
Sign in using the AuthN console Org Owner user account credentials provided by your Fiddler representative.
Ensure your organization is selected in the dropdown. You may see the *fiddler* organization, but this is reserved for system use and should not be edited. Here we are using the *idpexample* organization.
Select *Settings* tab from the top menu and then select *Identity Providers* from the left navigation menu.
1. Select the *Google* option in the *Add provider* section, which brings up the Google Provider form.
2. Note the callback URL shown in the form — it corresponds to the redirect URIs you registered in Google earlier, so no further changes are needed in Google.
In the Google Provider form, paste the *Client ID* and *Client Secret* copied from Google earlier.
1. Expand the *optional* section.
2. Ensure the *Scopes List* includes `openid`, `profile`, and `email`.
3. Ensure the *Automatic create* and *Automatic update* checkboxes are selected.
4. Set the *Determines whether an identity will be prompted to be linked to an existing account* dropdown to *Check for existing Username*.
Select the *Create* button and then select the *Save* button. You will be returned to the Organization Settings page.
1. Select your IdP from the list and select the *Activate* button on the identity provider page.
2. Close the settings and then select *Login Behavior and Security* from the left nav menu and ensure the *External login allowed* checkbox is selected.
3. Select the *Save* button.
Select the *Actions* tab from the top menu.
1. Select the *New* button in the *Scripts* section to create a new action script.
2. Copy the *Google OIDC Action Script* below and paste it into the script text area.
3. Enter `setAttributesOnGoogleOIDCAuth` in the *Name* text box.
4. Select the *Add* button.
**File:** `Google OIDC Action Script`
```javascript theme={null}
function setAttributesOnGoogleOIDCAuth(ctx, api) {
let firstName = ctx.v1.providerInfo.getFirstName();
let lastName = ctx.v1.providerInfo.getLastName();
let email = ctx.v1.providerInfo.getEmail();
let nameParts = [firstName, lastName];
let filteredParts = nameParts.filter(part => part);
let displayName = filteredParts.join(' ');
if (firstName != undefined) {
api.setFirstName(firstName);
}
if (lastName != undefined) {
api.setLastName(lastName);
}
if (email != undefined) {
email = email.toLowerCase();
api.setEmail(email);
api.setEmailVerified(true);
api.setPreferredUsername(email);
}
if (displayName) {
api.setDisplayName(displayName);
}
api.v1.user.appendMetadata('fiddler_authentication_type', 'SSO:GOOGLE:OIDC');
api.v1.user.appendMetadata('fiddler_groups', []);
}
```
Scroll down to the *Flows* section.
1. Select the *External Authentication* option for the *Flow Type* dropdown.
2. Select the *+ Add trigger* button.
3. Select the *Post Authentication* option for the *Trigger Type* dropdown.
4. Select the *setAttributesOnGoogleOIDCAuth* option for the *Actions* dropdown.
5. Select the *Save* button.
Add an organization metadata key so Fiddler can correctly identify and process this SSO connection. Set this once during setup.
1. Go to the *Metadata* section and select *Edit*.
2. Select the *Add* button, then enter the key `fiddler_sso_authentication_type` with the value `SSO:GOOGLE:OIDC`.
3. Select the *Save* button next to the new entry.
Before validating, make sure your Google account can sign in: for an *Internal* consent screen it must belong to your Google Workspace organization; for an *External* app still in testing it must be added as a *Test user*.
1. Open your Fiddler URL (e.g. `https://idpexample.dev.fiddler.ai`).
2. Ensure you see the Fiddler sign-in page and that it displays the Google SSO login button.
3. Select the button and confirm that the Fiddler application loads.
The first user to sign in to the Fiddler application is automatically assigned the Fiddler Org Admin role; subsequent members are Org Members by default.
## Getting Help
If sign-in fails, verify the OAuth client configuration in the Google Cloud Console (redirect URIs, consent screen status, client credentials). For Fiddler-side issues, see the [SSO Authentication Guide](/reference/access-control/sso-authentication-guide). If the issue persists, contact your Fiddler representative with the specific error message.
## Important Notes
* **Data Storage**: Fiddler stores the following profile attributes from Google: first name, last name, display name, and email address.
* **No Group Synchronization**: Google OIDC does not provide group membership, so group sync to Fiddler teams is not available. Assign users to teams and roles manually.
* **API Access**: For programmatic API access, users create an API key from the *Credentials* tab in Fiddler's *Settings* page.
* **Single Authentication Method**: Users can only authenticate via either SSO or email authentication, not both.
## Next Steps
After successful integration:
* **Train Users**: Provide guidance on accessing Fiddler through Google SSO.
* **Assign Roles**: Manually assign users to the appropriate Fiddler teams and roles after their first login.
* **Monitor Usage**: Review authentication logs and user access patterns.