// Module included in the following assemblies:
//
// * osd_install_access_delete_cluster/config-identity-providers.adoc
// * rosa_install_access_delete_clusters/rosa-sts-config-identity-providers.adoc

:_mod-docs-content-type: PROCEDURE
[id="config-google-idp_{context}"]
= Configure a Google identity provider

[role="_abstract"]
Configure a Google identity provider to allow users to authenticate with their Google credentials.

[WARNING]
====
Using Google as an identity provider allows any Google user to authenticate to your server. You can limit authentication to members of a specific hosted domain with the `hostedDomain` configuration attribute.
====

.Procedure

. From {cluster-manager-url}, navigate to the *Cluster List* page and select the cluster that you need to configure identity providers for.

. Click the *Access control* tab.

. Click *Add identity provider*.
+
[NOTE]
====
You can also click the *Add OAuth configuration* link in the warning message displayed after cluster creation to configure your identity providers.
====

. Select *Google* from the drop-down menu.

. Enter a unique name for the identity provider. This name cannot be changed later.
** An *OAuth callback URL* is automatically generated in the provided field. Provide this URL to Google.
+
ifndef::openshift-rosa-hcp[]
----
https://oauth-openshift.apps.<cluster_name>.<cluster_domain>/oauth2callback/<idp_provider_name>
----
endif::openshift-rosa-hcp[]
ifdef::openshift-rosa-hcp[]
----
https://oauth.<cluster_name>.<cluster_domain>/oauth2callback/<idp_provider_name>
----
endif::openshift-rosa-hcp[]
+
For example:
+
----
https://oauth-openshift.apps.openshift-cluster.example.com/oauth2callback/google
----

. Configure a Google identity provider using link:https://developers.google.com/identity/protocols/OpenIDConnect[Google OpenID Connect integration].

. Return to {product-title} and select a mapping method from the drop-down menu. *Claim* is recommended in most cases.

. Enter the *Client ID* of a registered Google project and the *Client secret* issued by Google.

. Enter a hosted domain to restrict users to a Google Apps domain.

. Click *Confirm*.

.Verification

* The configured identity provider is now visible on the *Access control* tab of the *Cluster List* page.
