SSO with Google Workspace using OIDC

Use OpenID Connect (OIDC) to let your team sign in to EchoMark with their Google Workspace accounts.

1. Begin SSO provider setup in EchoMark

You can begin setup from an SSO invitation email or from an existing EchoMark administrator account.

1. From the setup email: Open the “Set up Single Sign-On for your EchoMark account” email and click Start SSO Configuration. Then continue to step 3 below.

   Important: Keep this link open while you create the OIDC client in Google. If you need to reopen it, use the same browser to avoid creating a duplicate entry.

   

2. From an existing administrator account: Log in to EchoMark, click Settings, and select Authentication in the left menu.

   

   

   Choose one of the following:

   • To have your IT or SSO administrator complete setup, click Invite IT admin to set up SSO provider. Enter their email address, optionally edit or remove the personal note, and click Send invitation.

     

     

   • To configure the provider yourself, click Add SSO provider.

     

3. In Configure your SSO provider, enter:
   • Friendly name: A name that helps you identify this provider.
   • Provider type: OIDC.
4. Copy the Redirect URI (Callback URL). You will use it when creating the Google OIDC client.

5. You will also need a File Share URI. Use the same URI, replacing app.<domain> with view.<domain> and leaving the rest unchanged.

   

2. Create the OIDC application in Google

1. In a new browser window or tab, open the Google Workspace developer console.

2. Select Clients in the left navigation.

   

3. Click + Create client above the client list.

   

4. Complete the following fields:
   • Application type: Web application.
   • Name: A name that helps you identify the EchoMark client.

   • Authorized redirect URIs: Add both the EchoMark Redirect URI copied in section 1 and the File Share URI with app replaced by view. For example:

     • https://app.yourdomain.com/api/auth/callback/dkke774x
     • https://view.yourdomain.com/api/auth/callback/dkke774x

     Use your own copied URI and its matching File Share URI, not these example values.

5. Click Create.

   

6. In the confirmation dialog, copy the Client ID and Client secret and store them securely before clicking OK.

   Important: You will no longer be able to view or download the client secret after closing this dialog.

   

3. Complete SSO provider configuration in EchoMark

1. Return to the Configure your SSO provider dialog in EchoMark and complete the remaining fields:
   • Client ID: Paste the Client ID from Google.
   • Client secret: Paste the client secret from Google.
   • Client secret expiration (optional): Leave this blank for Google.
   • Issuer: https://accounts.google.com

   • Use federated logout (optional): If you want users to be fully logged out of Google when they log out of EchoMark, select this option and enter https://accounts.google.com/Logout.

     Warning: Federated logout signs users out of their Google account, including Gmail.

   • Well-known path: /.well-known/openid-configuration
   • ID claim (optional): sub
   • Email claim (optional): email
   • Name claim (optional): name
   • Role claim (optional): roles
   • Email domains: Add at least one email domain associated with your Google Workspace organization. Enter the domain, such as example.com, then click Add when the button becomes enabled. The domain must be unique across the environment and associated with your organization.

2. Click Continue to save the configuration.

   

3. Review the provider type, issuer, client ID, and email domains. When the details are correct, click Enable SSO and test.

   Important: This enables SSO immediately for testing. You can disable it after testing if necessary.

   

4. Verify that you can sign in with the new provider.

   Avoid locking yourself out: If this is your only SSO provider, or you are currently signed in to EchoMark with a user from the same SSO provider, use an incognito or private browser session to test the login.

   Otherwise, click Open test sign-in. This opens the login page in a new tab and logs out your current session.

   Return to the test dialog after checking the login:

   • If the login succeeds, click It worked.
   • If the login fails, click It didn’t work — disable SSO.

   

5. If the test succeeded, click Done in the success confirmation. Your users can now sign in with this provider.

   

   If the test failed, It didn’t work — disable SSO immediately disables the new provider. In the confirmation, click Done to finish, or Edit my configuration to correct the settings and try again.