Skip to main content
Version: Current

Google

Configure Google OAuth for workforce or customer authentication.

Step 1: Install the package​

dotnet add package PrimusSaaS.Identity.Broker

Step 2: Configure Program.cs and middleware​

using PrimusSaaS.Identity.Broker;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddPrimusAuthBroker(builder.Configuration, builder.Environment.IsDevelopment());
builder.Services.AddControllers();

var app = builder.Build();
app.UseAuthentication();
app.UseAuthorization();
app.UsePrimusCsrfProtection();
app.MapControllers();
app.MapPrimusAuthBroker();
app.Run();

Step 3: Configure appsettings.json​

{
  "Google": {
    "ClientId": "YOUR_CLIENT_ID",
    "ClientSecret": "YOUR_CLIENT_SECRET"
  }
}
How to get configuration values
  1. Go to Google Cloud Console > APIs & Services > Credentials.
  2. Create OAuth 2.0 Client ID (Web application).
  3. Authorized redirect URI: https://your-api.com/api/auth/google/callback
  4. Copy Client ID and Client Secret.

Step 4: Configure endpoint​

Broker endpoints are mapped by app.MapPrimusAuthBroker().

  • GET /api/auth/providers
  • GET /api/auth/google
  • GET /api/auth/me

Step 5: Test the endpoint​

  1. Call GET /api/auth/providers once on app startup to seed the CSRF cookie.
  2. Navigate to GET /api/auth/google and sign in.
  3. Call GET /api/auth/me to confirm the session.

SAML 2.0 SSO​

Google Workspace supports both OIDC and SAML 2.0. SAML is common for organizational Google Workspace deployments.

Create a custom SAML app in Google Workspace​

  1. In the Google Admin console, go to Apps → Web and mobile apps → Add app → Add custom SAML app.
  2. Set ACS URL to: 
    https://app.example.com/api/auth/saml/google-saml/Acs
  3. Set Entity ID to https://app.example.com.
  4. Copy the IdP metadata URL shown on the IdP details page.

Configure appsettings.json​

{
  "PrimusAuth": {
    "Saml": {
      "EntityId": "https://app.example.com",
      "IdentityProviders": [
        {
          "Scheme": "google-saml",
          "DisplayName": "Google Workspace",
          "IdpType": "GoogleWorkspace",
          "MetadataUrl": "https://accounts.google.com/o/saml2?idpid=YOUR_IDP_ID"
        }
      ]
    }
  }
}

SAML endpoints​

EndpointDescription
GET /api/auth/saml/google-samlReturns SP metadata XML — configure as the SP Entity ID in Google Admin
GET /api/auth/saml/google-saml/SignInInitiates SP-initiated SSO — redirects the browser to Google
POST /api/auth/saml/google-saml/AcsAssertion Consumer Service — handled automatically

Advanced features​

The following features work with Google exactly the same way as any other provider:

Next Steps​