Connect Google Workspace (SSO)

What works and what doesn’t

SSO (OpenID Connect)

Yes. People log in with their company Google account.

SCIM

No. Google Workspace sends people over SCIM only to apps in Google’s catalog.

Instead of SCIM

• Turn on “When someone who isn’t registered yet logs in, register them as a learner” in Aiyori. People on your company’s domain become learners the first time they log in.
• To sort people into groups such as departments, or to register them in advance, export the roster from the Google Admin console and add it with Aiyori’s “Bulk add” (CSV) (section 4 below).
• When someone leaves, suspending their Google account stops them from logging in. Their Aiyori learner remains, so a trainer suspends or deactivates them on the learner’s page, for example when importing the monthly roster.
• If you really need it to be automatic, put Okta or Microsoft Entra ID in front of Google and use SCIM through them.

What you need

• Someone who can create a project inside your company’s organization in the Google Cloud console (https://console.cloud.google.com).
• You don’t need a super administrator of the Google Workspace Admin console (Aiyori asks only for openid email profile and uses no sensitive scopes).
• It costs nothing (OAuth clients are free).

1. Project and consent screen

1. Google Cloud console → project picker at the top → New Project → name it aiyori-sso, choose your company’s organization under Organization, then Create.
2. Google Auth Platform (reached from APIs & Services → OAuth consent screen in the menu) → Get started. Enter Aiyori as the App name and your IT team’s address as the User support email and contact information, set Audience to Internal, agree, then Create.
3. Add nothing under Data Access (openid, email and profile are available from the start).

With the audience set to Internal, only people in your company’s Google Workspace can log in. Google accounts outside your company are stopped on Google’s screen.

2. OAuth client

1. Google Auth Platform → Clients → + Create client.
2. Set Application type to Web application, and the name to Aiyori.
3. Authorized redirect URIs → + Add URI → https://app.aiyori.app/api/web/sso/callback. Authorized JavaScript origins can stay empty.
4. Create → note the Client ID and Client secret. The secret may not be viewable later. If you forget to note it, add a new secret on the client’s page and replace it.

3. Enter the values in Aiyori

On Aiyori’s trainer screen, go to “Settings” → “Connect your company’s identity provider” → “SSO”, enter the values and press “Save”.

Issuer URL

https://accounts.google.com

Client ID

The value you noted in section 2 (….apps.googleusercontent.com)

Client secret

The value you noted in section 2

Allowed email domains

Required (you can’t save without them). Your company’s Google Workspace primary domain (e.g. example.com), plus any other domains used for employee email addresses (secondary domains), one per line.

Automatic registration

Turn on “When someone who isn’t registered yet logs in, register them as a learner” (because there is no SCIM).

After saving, log in with one company account to check (login screen → “Log in with company account” → organization code → choose the Google account → back to Aiyori). Administrators can also test with “Try with my company account” in “Try logging in yourself”.

The issuer https://accounts.google.com is the same for every Google account. Who can get in is narrowed in two places: Internal on the consent screen, and the allowed domains in Aiyori. Always set both.

4. Roster and groups

1. Google Admin console → Directory → Users → Download users (CSV).
2. Open it in a spreadsheet, keep three columns, Name (given and family name in one column), Email and Department (for example the Org Unit Path, renamed to something easy to read), and change the headings to these names. Google’s headings (such as Email Address [Required]) can’t be read as they are.
3. On Aiyori’s learners page → paste into “Bulk add” or choose the CSV → “Check” → register. The Department column becomes groups (up to 1,000 people at a time).
4. Repeat whenever people join or move (or every month). The same person is only updated, never duplicated (matched by employee number, then by email address).

5. Check on the day you connect

• People can get in with a company account. First-time users are registered as learners.
• Google accounts outside your company (personal gmail.com) are stopped on Google’s screen (because the consent screen is Internal). Even if they aren’t, Aiyori doesn’t let them in (because there’s no hd).
• People whose Google account is suspended can’t get in with a company account.

How Google Workspace works with Aiyori

After a Google login, Aiyori checks the following.

• The ID token issuer (iss) is https://accounts.google.com or accounts.google.com (Google uses both).
• hd (the person’s Google Workspace primary domain) is one of the allowed domains. Personal Google accounts (gmail.com and so on, which have no hd) and people from other companies’ Workspace can’t get in (this stops them even if the consent screen was set to External by mistake).
• The domain of the email address (email) is also one of the allowed domains. People whose email_verified is false can’t get in.
• First-time users are registered as learners if automatic registration is on (the ID is the part of the email address before the @, and the name is their Google display name). From the second time, they are recognized by their Google sub.