​

Google Workspace Single Sign-On

Single Sign-On (SSO) lets your organization members sign in to NeuralTrust with their Google Workspace accounts instead of a separate password. NeuralTrust has a dedicated Google Workspace provider — you no longer need to configure it as a generic OIDC provider — which adds directory group sync: NeuralTrust reads your Workspace groups and their members to drive platform roles and gateway access.

​

What you get

• Login — a Sign in with Google button on the NeuralTrust login page (OAuth 2.0).
• Directory group sync (optional) — NeuralTrust pulls your Workspace groups and members from the Admin SDK Directory API, so you can map groups to roles and gateway access. Without it, login still works; only group-based governance is unavailable.

​

Prerequisites

Before you begin, ensure you have:

• A Google Workspace organization
• Super Admin access to the Google Admin console (only a super admin can authorize directory access org-wide)
• Access to a Google Cloud project
• Owner or Admin role in NeuralTrust

---

​

Part 1: Create the OAuth client (login)

​

Step 1: Configure the OAuth consent screen

1. Go to Google Cloud Console → APIs & Services → OAuth consent screen
2. Set User type to Internal (only your Workspace users can sign in)
3. Fill in the app name (e.g. NeuralTrust), support email, and developer contact
4. Save

​

Step 2: Create the OAuth client ID

1. Go to APIs & Services → Credentials
2. Click + Create Credentials → OAuth client ID
3. Application type: Web application
4. Name: NeuralTrust SSO
5. Under Authorized redirect URIs, add:
   https://app.neuraltrust.ai/api/auth/callback/google-workspace
   
6. Click Create

​

Step 3: Copy your credentials

Copy the Client ID and Client secret shown after creation — you’ll enter them in NeuralTrust. The login flow requests the standard openid email profile scopes only.

---

​

Part 2: Enable directory group sync (optional)

Skip this part if you only want login. Complete it to map Google groups to NeuralTrust roles and gateway access.

​

Step 1: Enable the Admin SDK API

1. In your Google Cloud project, go to APIs & Services → Library
2. Search for Admin SDK API and click Enable

​

Step 2: Create a service account and key

1. Go to IAM & Admin → Service Accounts
2. Click + Create Service Account, name it neuraltrust-directory, and create it
3. Open the service account → Keys → Add key → Create new key → JSON
4. A JSON key file downloads. Keep it safe — you’ll paste its contents into NeuralTrust
5. On the service account’s Details page, copy its Unique ID (Client ID) — a long numeric value you’ll need in the next step

​

Step 3: Authorize domain-wide delegation

1. Go to Google Admin console → Security → Access and data control → API controls → Domain-wide delegation
2. Click Add new
3. Client ID: the service account’s numeric Client ID from the previous step
4. OAuth scopes: paste these three, comma-separated (read-only):
   https://www.googleapis.com/auth/admin.directory.group.readonly,
   https://www.googleapis.com/auth/admin.directory.group.member.readonly,
   https://www.googleapis.com/auth/admin.directory.user.readonly
   
5. Click Authorize

---

​

Part 3: Configure NeuralTrust

​

Step 1: Open SSO settings

1. Log in to NeuralTrust as Owner or Admin
2. Open the sidebar gear → Platform settings → SSO Configuration
3. Select the Google Workspace tab

​

Step 2: Enter your credentials

​

Step 3: Test and save

1. Click Test Connection — this validates the OAuth client and, if provided, the service account and delegation
2. On success, click Save

---

​

Part 4: Verify your email domain

Domain verification ensures only members of your organization’s domain can use SSO.

1. Open Platform settings → SSO Configuration → Domains
2. Click Add Domain and enter your company domain (e.g. yourcompany.com)
3. Copy the verification token (e.g. neuraltrust-verify-abc123-def456)
4. In your DNS provider, add a TXT record with the token as its value (Name @, TTL default)
5. Back in NeuralTrust, click Verify

---

​

Part 5: Map Google groups to roles

Role mapping assigns NeuralTrust roles automatically from Google Workspace group membership. It requires directory group sync (Part 2) to be configured, and it lives in the Role Provisioning section — the same place for every provider. See Role Provisioning for the full guide. In short:

1. Go to Platform settings → Role Provisioning
2. Turn on User provisioning & role mapping
3. Set a Default Access role for users who match no group
4. Choose an Enforcement mode — At sign-up only or At sign-up and login
5. Under Role Mapping, add a row per Google group and pick its platform role:

​

Review synced groups

The Groups tab under Users & groups lists every group in your unified directory with its source (SCIM, Directory, or Login) and member count, so you can confirm the sync is working before you rely on a mapping.

---

​

Part 6: How directory sync stays fresh

Once configured, group membership is kept current from three sources, so a mapping always reflects reality:

---

​

Part 7: Enforce SSO-only mode (optional)

1. Open Platform settings → SSO Configuration
2. Toggle Enforce SSO to ON and confirm

---

​

User experience

Once configured, users see a Sign in with Google button on the login page. After clicking it they are redirected to Google, authenticate, and return signed in. For new users on a verified domain, accounts are created automatically on first login.

---

​

Troubleshooting

---

​

Security best practices

1. Keep the consent screen Internal so only your Workspace users can sign in
2. Grant read-only scopes only — the directory scopes above are all .readonly
3. Rotate the service account key periodically (paste a new JSON to rotate)
4. Enforce SSO-only mode once all users are onboarded, keeping a Break the Glass account for outages
5. Verify every email domain your organization uses
6. Monitor audit logs for suspicious login patterns

​

Next steps

• Role Provisioning — Map Google groups to roles and choose enforcement
• Microsoft Entra ID SSO — Configure SSO with Microsoft Entra ID
• Generic OIDC SSO — Okta, Auth0, and other providers
• Configure Break the Glass — Emergency access for IdP outages
• Configure SCIM Provisioning — Automate user account lifecycle
• Set Up Audit Logs — Monitor SSO-related security events