Configuring Google Apps as an IdP through OAuth2 using OpenAM

This guide was written using Debian based ( e.g. Ubuntu ) operating system. In other distributions just change the "apt-get" to their respective package manager tool. This example use a OAuth 2 OpenAM authentication.

Please replace every openid.ga with your Google Apps domain.

Prerequisites:

Tomcat 7
Google Apps domain

Instructions:

Install OpenAM follow the Installing OpenAM guide.
Log-in to OpenAM web admin:

Click on “Access Control”
Click on / (Top Level Realm)
Click on “Authentication”
On “Module Instances” section click on “New”
Type “google” as name and select OAuth 2.0 option and click on the “OK” button
Click on the new option created
Open a new tab on browser
Go to http://console.developers.google.com
Create a new project
Just fill the project name (project id is auto generated)
Click on the created project
Go to APIs & auth > Credentials
Click on “Create new Client ID”

Select Web application
Javascript origins: http://openam.openid.ga:8080/
Redirect URL: http://openam.openid.ga:8080/openam/oauth2c/OAuthProxy.jsp

Copy the generated values
Return to previous tab ( openam )
Fill the fields with the following values:

Client Id: (Paste generated value)
Client Secret: (Paste generated value)
Authentication Endpoint URL: https://accounts.google.com/o/oauth2/auth
Access Token Endpoint URL: https://accounts.google.com/o/oauth2/token
User Profile Service URL:https://www.googleapis.com/oauth2/v1/userinfo
Scope: email
Proxy URL: http://openam.openid.ga:8080/openam/oauth2c/OAuthProxy.jsp
Account Mapper Configuration: email=mail (remove the other options)
Attribute Mapper Configuration: email=mail (remove the other options)
Email attribute in OAuth2 Response: email
Prompt for password setting and activation code: Uncheck
OAuth 2.0 Provider logout service: https://mail.google.com/mail/?logout

Click on “Save”
Open a new Tab on browser and test it by going to:
http://openam.openid.ga:8080/openam/UI/Login?realm=&module=google
Now you are logged in into OpenAM using Google Apps credentials.

Comments