Google Workspace

Frame supports Single Sign-On (SSO) with Google authentication through both OAuth2 and SAML2 integration options. The OAuth2 option is the easiest to setup and can be done in under a minute. The SAML2 option is also relatively quick and easy, but does require a few more steps.

Google Workspace OAuth2 SSO Integration

Configuring Google Workspace OAuth2

1. If you would like to enable Google Workspace OAuth2 integration with Frame, you will first need to following the procedure outlined in Google's guide to Control which third-party & internal apps access Google Workspace data.
2. On the Google Admin Console home page, go to Security > API controls.
3. Under App access control, click on MANAGE THIRD-PARTY APP ACCESS.
4. Click on “Configure new app” drop down menu and select OAuth App Name Or Client ID.
5. Search for the Client ID 884836301137-76l5epasioe5sb3qvsp31obn45qk6t5i.apps.googleusercontent.com.
6. Once you locate the Frame app in the search results, click Select.
7. Check the checkbox for the Frame app with the Client ID 884836301137-76l5epasioe5sb3qvsp31obn45qk6t5i.apps.googleusercontent.com and then click SELECT.
8. For App access, specify that this Frame app is to be TRUSTED and click CONFIGURE.

Configuring Google OAuth2 in Frame

1. Before Google OAuth2 can be added, the administrator must enable the Google toggle at a given level by navigating to the Admin Console. From there, navigate to the Customer or Organization page (depending on where you wish to add Google).
2. Select Users from the left-hand menu.
3. From there, navigate to the Authentication tab and enable the OAuth2 toggle. Click Save.

4. Click on the newly created Google tab. From there, click Add.

5. The Add Google authorization dialog window will appear:

6. From this window, you can specify individual email addresses or entire domains you wish to grant access to and their corresponding roles. For this example, we will give access to the domain mycompany.com. All users tied to this domain will be given “Launchpad User” access on the “Applications 2” Launchpad. Read more about permissions in the Manage User Permissions section of Frame documentation.

7. Click Add when you have finished specifying your emails/domains and roles.

Signing in with Google Workspace via OAuth2

You can now instruct your users to select the Sign in with Google option when accessing their Frame login page and enter their Google credentials.

They will be prompted to allow Frame access to their Google Drive the first time they sign in.

That's it! Your users can now use Sign in with Google on your account via our OAuth2 integration option. If you prefer to set up your integration using SAML2, continue reading.

Google Workspace SAML2 Integration

Getting Started

To begin, let's create a URL-friendly SAML2 Integration Name that we'll use in a few places throughout our setup. Continue below for help and examples that you can use in your SAML integration.

Using the values copied from above and following the steps below, we'll create and gather these details to configure proper communication between ADFS and Frame.

Google Admin Console

1. Navigate and log in to to your Google Admin Console. Click on Apps and then Web and mobile apps.

   

2. From the Apps Settings page, click Add App then Add custom SAML app from the drop-down.

   

3. Enter "Frame” for the App name and upload our logo icon below (right-click, save).

   

   

   Click Continue when ready.

4. Click the Download Metadata button. Save this somewhere accessible for a later step in the Frame Console; this metadata tells Frame how to communicate with Google on Frame's behalf.

   

   Click Continue when ready.

5. Next, we'll carefully enter values for ACS URL and Entity ID fields.

   • ACS (Assertion Consumer Service) URL: This is where Google will send assertions info (first name, last name, and email address) for authenticated users to Frame. Here, we'll enter the Frame ACS URL defined in the Getting Started section.

   • Entity ID: This field is also arbitrary and must be a URI, URN, or URL; this value is case-sensitive. Entity IDs are attached to event logs for Admin purposes and are required to match in both Google and Frame Console's settings to verify and identify each other via SAML2. For simplicity, we recommend using the Integration Name from the Getting Started section for this value. Copy the value you decide upon for use in later steps; Frame refers to the Entity ID in its SAML settings as “Application ID.”

6. Next, we have the Start URL.

   The Start URL allows users to authenticate and navigate directly to Frame from Google's Workspace portal. This is often referred to as a “Identity Provider initiated login”. For most cases, the value for Start URL is simply a Launchpad or Account Dashboard URL to the account the user will have access to. If this field is left blank, your users can still log in to Frame with this Google App from the Frame Console's sign in page(s).

   :::tip

   Leaving this blank may be desired if you have many Frame Accounts for your users to access or "land on".

   :::

7. Next, Ensure that the Name ID format field is set to PERSISTENT and the Name ID field is set to Basic Information > Primary email. Click Continue when ready.

   

8. Here, we need to configure mappings between user fields from Google to recognizable terms that Frame is expecting to receive when users sign in. Fill it out exactly as pictured below:

   

   Click Finish when completed.

9. You'll now be brought to the main page of your new Custom App. The last thing we need to do is enable user access, as the default setting for new Custom Apps is OFF for everyone. To enable access, click in the User Access section at the top of the page.

   Then, configure your user/group access and click SAVE. In our use-case, we wanted the service to be ON for everyone:

   

   That's it for the Google Admin portion of the setup – we're half way there! By this point you should have the following items needed to setup Frame Console as the SAML2 Service Provider:

   • Downloaded Metadata XML file
   • SAML2 Integration Name
   • Entity ID (later referenced as Application ID)

Configure SAML2 in Frame

10. Open up a new tab and navigate to your Frame account. A SAML2 authentication integration can be configured at any level (depending on administrative access) by navigating to the Admin page and clicking on the ellipsis listed next to the desired entity name. Select Users from the menu that appears. In our example, we're integrating with Google Workspace on the Customer scope/level.

![Customers Example for Configuring User Access](https://docs.difr.com/uploads/images/gallery/2025-10/customer-users.png)

</figure>