# Google as identity provider - SSO Setup

{{<tags>}}

> Note: Please be aware that for this process, Truora must provide information that you will use in certain steps, 
> and later, you will need to supply information to complete the process. Before starting, please contact your sales representative or reach out to the support line.

## Step 1: Create a Project in Google Cloud
1. Log in to [Google Cloud Console](https://console.cloud.google.com/).
   {{<img src="/images/illustrations/account/google_console.png" alt="Initial messages" width="90%" class="border border-slate-300 rounded-md">}}
2. Click on Select a project, then New Project.
3. Assign a name to the project and click Create.
   {{<img src="/images/illustrations/account/google_new_project.gif" alt="google_new_project" width="90%" class="border border-slate-300 rounded-md">}}


## Step 2: Enable Google Identity Services API
1. Navigate to **APIs & Services** > **OAuth consent screen**.
2. Select External or Internal, depending on who will be using the app:
   - Internal is only available to users within your organization.
   - External is required if you’re allowing users outside your organization.
3. Click Enable to activate it.
   {{<img src="/images/illustrations/account/google_enable_identity_services.gif" alt="google_enable_identity_services" width="90%" class="border border-slate-300 rounded-md">}}
4. Fill in the App information (app name, user support email, etc.), remember to use the link that Truora provides to set up the authorized domains and add the scopes required.
   {{<img src="/images/illustrations/account/google_fill_app_info.gif" alt="google_fill_app_info" width="90%" class="border border-slate-300 rounded-md">}}

## Step 3: Set Up Scopes
In the Scopes section, click on Add or Remove Scopes in the non-sensitive section. 
1. To access the user's email and basic profile information, ensure the following scopes are added:
   - email: ``https://www.googleapis.com/auth/userinfo.email`` (retrieves the user’s email).
   - profile: ``https://www.googleapis.com/auth/userinfo.profile`` (retrieves the user’s name, profile picture, and other public information).
2. Click Update to save the scopes.
   {{<img src="/images/illustrations/account/google_set_up_scopes.gif" alt="google_set_up_scopes" width="90%" class="border border-slate-300 rounded-md">}}

## Step 4: Create OAuth 2.0 Credentials
1. Go to **APIs & Services** > **Credentials**.
2. Click Create Credentials and select OAuth 2.0 Client IDs.
   {{<img src="/images/illustrations/account/google_create_oauth_credentials.gif" alt="google_create_oauth_credentials" width="90%" class="border border-slate-300 rounded-md">}}
3. Choose Web application as the application type.
4. Name the credential.
5. Under Authorized redirect URIs, add the redirect URL provided by Truora. Example:
   - ``https://account.truora.com``
   - https://<<your-cognito-domain>>.auth.<<region>>.amazoncognito.com/oauth2/idpresponse
6. Save the configuration and copy the generated Client ID and Client Secret.
   {{<img src="/images/illustrations/account/google_generate_id_and_secret.gif" alt="google_generate_id_and_secret" width="90%" class="border border-slate-300 rounded-md">}}

## Step 5: Share Credentials
Securely share the Client ID and Client Secret with Truora.