Skip to main content

Configure Google Identity

This guide connects DIAL to Google Identity so users authenticate with their Google account and DIAL authorizes them by Google Workspace group. Unlike most providers, DIAL Core resolves groups through a user info endpoint rather than a token claim. For the shared workflow, see the SSO / IdP setup overview.

Prerequisites​

  • A running DIAL deployment and the URL of your DIAL Chat instance, referred to below as <chat_url>.
  • A Google Cloud project and, for group-based access, a Google Workspace organization.

Step 1: Configure Google Identity​

  1. Create an OAuth consent screen in your Google Cloud project.
  2. Create an OAuth client under Google Auth Platform → Clients:
    • Application type: Web Application
    • Authorized JavaScript origin: <chat_url>
    • Authorized redirect URI: https://<chat_url>/api/auth/callback/google
  3. Capture the Client ID and Client secret from the dialog.
  4. (Optional, RBAC) Create a Google group and add members.
  5. (Optional, RBAC) Enable the Cloud Identity API under APIs & Services → Library so DIAL can read group membership.

Step 2: Configure DIAL Chat​

Set these environment variables on DIAL Chat. See DIAL Chat configuration — Google for the full list.

AUTH_GOOGLE_CLIENT_ID: "<google_client_id>"
AUTH_GOOGLE_SECRET: "<google_client_secret>"
AUTH_GOOGLE_SCOPE: "openid email profile https://www.googleapis.com/auth/cloud-identity.groups.readonly"

Step 3: Configure DIAL Core​

Add the provider to the identityProviders section of DIAL Core static settings (settings.json). Google does not expose a JWKS endpoint here; DIAL uses userInfoEndpoint instead. Generate a random loggingSalt, for example with pwgen -s 32 1.

{
  "identityProviders": {
    "google": {
      "userInfoEndpoint": "https://openidconnect.googleapis.com/v1/userinfo",
      "loggingKey": "sub",
      "loggingSalt": "<random_salt>",
      "rolePath": "fn:getGoogleWorkspaceGroups"
    }
  }
}

rolePath uses the built-in fn:getGoogleWorkspaceGroups function, which fetches the user's Workspace groups through the Cloud Identity API. For every setting, see the Identity providers reference.

note

DIAL Core reads static settings at startup. Restart Core after editing settings.json. Each setting can also be supplied as an aidial.identityProviders.google.* environment variable.

Step 4: Assign roles to resources​

In config.json (dynamic settings), add a Google group name to a deployment's userRoles array.

{
  "models": {
    "chat-gpt-35-turbo": {
      "userRoles": ["google-group-name"]
    }
  }
}

Result​

Users log in with Google, and DIAL Core authorizes their requests based on Google Workspace group membership.

Further reading​