Configuring Google OAuth2

You must register your thingshub tennat with Google in order to use Google OAuth2 with thingshub. You will need the client ID and client secret key that Google generates for you after the registration.

Configure Oauth and register Thingshub in Google Workspace

1. Open https://console.developers.google.com/apis/credentials in your browser.

2. Sign in with a Google account with appropriate privilege, if not done already.

3. Click on Create Credentials and then click on OAuth Client ID from the dropdown.

4. In the dropdown for Application Type select Web Application.

5. Type Thingshub SSO in the Name field

6. Click on the ADD URI button in the Authorised JavaScript origins section and type the domain address of your thingshub tenant. This is the address where your thingshub system is running.
   (Eg: https://foo-bar.thingshub.smartmakers.de)

7. Click on the ADD URI button in the Authorised Redirect URIs section and type the domain address of your thingshub tenant followed by the path /google-oauth2/callback. This is the address that Google will redirect to after the authentication is complete, be it successful or failure.
   (Eg: https://foo-bar.thingshub.smartmakers.de/google-oauth2/callback)

8. Click on Create

9. Copy Client ID and Client Secret values.

Enable and configure Google OAuth2 in Thingshub

global:
  domain: foo.bar.com
  tenant_mode: trackinghub

...

  identity_providers:
    google_oauth2:
      enabled: true
      params:
        client_id: <Client ID from above>
        client_secret: <Client Secret from above>
        auth_url: "https://accounts.google.com/o/oauth2/auth"
        token_url: "https://oauth2.googleapis.com/token"
        user_info_url: "https://www.googleapis.com/oauth2/v2/userinfo?access_token="
        scopes:
          - openid
          - "https://www.googleapis.com/auth/userinfo.email"
      button:
        logo: "data:image/png;base64,iVBORw0KG........"
        text: "Sign-in with Google"
        btn_color: "#B12B28"
        text_color: "#402306"

...

google_oauth2 configurations:

• enabled: The enabled flag is used to toggle google_oauth2 on or off.

• params: This block provides the configurations for thingshub to set google_oauth2

  • client_id: This is the ID of the thingshub client registered to the Google Workspace which is provided during client registration.

  • client_secret: This is the secret the Google Workspace provides for the thingshub client during client registration.

  • auth_url: This is the endpoint that thingshub uses to interact with Google Workspace to get the authorization to access the user data through the consent screen after you are logged-in.

  • token_url: This is the endpoint that thingshub uses to get access tokens by exchanging the authorization code it gets from the auth_url.

  • user_info_url: This is the endpoint that thingshub uses to get the consented Google user data to be used for Thinshub users.

  • scopes: The scopes parameter is a list of OAuth 2.0 scopes allowing user to configure multiple scopes at a time.
    A scope is a URI string that OAuth 2.0 provides to the Google Workspace to let it know what data thingshub wants to access. The Workspace then sees if its user itself has access for the said data and if it has consented to sharing it with thingshub. Thingshub expects the following scopes to be available: "email"
    The appropriate scope can be selected from the available Google API scopes from https://developers.google.com/identity/protocols/oauth2/scopes

    For getting the user email, the scope is: "https://www.googleapis.com/auth/userinfo.email”

• button: The button block holds the theme for the button for Google OAuth displayed on the thingshub login page.

  • logo: It is the base64 encoded string of the image to be displayed in the login button for Google OAuth. The base64 encoding should be in Data URI format.

  • text: Text is the message to be displayed in the login button for Google OAuth.

  • btn_color: It sets the color of the login button for Google OAuth.

  • text_color: It sets the color of the message in the text field that is to be shown in the login button for Google OAuth