Sign-in & directories

Google Workspace

Connect your organisation's Google Workspace – create an OAuth client and enter it in DDM.

With Google Workspace, your people sign in with the account they use for Gmail and Drive. You create an OAuth client in your Google Cloud project and enter it in DDM under Settings › Single sign-on.

1. Create the OAuth client

In the Google Cloud console, in a project of your Google Workspace organisation:

Under Google Auth Platform (formerly OAuth consent screen), enter the app name DDM and a support address, and choose Internal as the Audience – then only accounts of your own Workspace can sign in, and Google does not need to review the app.

Client

Under Clients › Create client, choose Web application and add as Authorized redirect URI the Redirect URI from DDM, Settings › Single sign-on – e.g. https://cms.documentdistributionmanager.com/api/auth/sso/callback.

Copy the credentials

Copy the Client ID and the Client secret.

2. Enter it in DDM

Field	Value
Button label	e.g. `Google` or your company's name
Issuer	`https://accounts.google.com`
Client ID	`….apps.googleusercontent.com`
Client secret	from Google
E-mail claim	`email`

Click Save, then Test connection, and switch on Single sign-on active – see Single sign-on.

Map groups

Google sends no groups by OpenID Connect. To have DDM put people into groups by their Google groups, connect Google Workspace by SAML instead – see below.

With SAML instead

Under Settings › Single sign-on, add a provider with Google Workspace and SAML 2.0. DDM shows three values for it.
In the Google Admin console, go to Apps › Web and mobile apps › Add app › Add custom SAML app, name it DDM.
On the page Google Identity Provider details, click Download metadata and paste the file's content in DDM under Your provider's metadata › Paste metadata. Save.
Back in Google, under Service provider details, enter DDM's Reply URL (ACS URL) as ACS URL and DDM's Identifier (Entity ID) as Entity ID. Name ID format: EMAIL, Name ID: Basic Information › Primary email.
Under Attribute mapping, add Primary email → email, First name → firstName, Last name → lastName. For groups, add under Group membership the Google groups DDM should know and name the app attribute groups – enter that as the Group claim in DDM, and map the groups by their name.
Switch the app ON for everyone (or for an organisational unit) under User access.

Common errors

Problem	Solution
`Error 400: redirect_uri_mismatch`	The redirect URI in Google differs from the one DDM shows – copy it again.
`Error 403: org_internal`	The person signed in with an account outside your Workspace – e.g. a private Gmail address.
Your e-mail address is not on one of your organisation's confirmed domains	The account's address is on a domain you have not confirmed in DDM – e.g. a secondary domain of your Workspace. Confirm it under Settings › Organisation.

Whoever runs a DDM installation can also offer Sign in with Google Workspace to every organisation on it, set up on the server (GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, NUXT_PUBLIC_SSO_PROVIDERS="google", redirect URI <BETTER_AUTH_URL>/api/auth/callback/google). It does not create accounts and is the same for everybody; an organisation that wants its own client and rules uses single sign-on as described above.

Okta

Connect your organisation's Okta – create an OpenID Connect app integration and enter it in DDM.

Two-factor authentication

After the password, a code from an authenticator app – optional for everybody, required for your organisation if you decide so, with codes by e-mail as a fallback you can switch off.