Set up Google SSO in rConfig V8 Core

After reading this page, I can configure Single Sign-On for rConfig V8 Core using Google Workspace. This covers creating an OAuth 2.0 client in Google Cloud Console, adding the credentials to rConfig, and approving the first SSO user so they can sign in.

When to use this

Use this page when your organisation authenticates with Google Workspace and you want users to sign in to rConfig with their Google accounts instead of separate local passwords. It suits teams that have standardised on Google as their identity provider and want centralised account control.

Prerequisites

• Administrator access to the Google Cloud Console and Google Workspace Admin Console
• Administrator access to rConfig V8 Core
• rConfig reachable over HTTPS with a valid domain name (see SSL setup)
• Shell access to the rConfig server to edit the .env file

Create the Google OAuth credentials

Step 1: Open the Google Cloud Console

Sign in to the Google Cloud Console with an administrator account and select the project that will own the rConfig OAuth client.

Step 2: Configure the OAuth consent screen

1. Navigate to APIs & Services > OAuth consent screen.
2. Select Internal or External based on your organisation’s requirements.
3. Enter the required application information.
4. Add authorised domains if needed.
5. Save the configuration.

Step 3: Create the OAuth 2.0 client ID

1. Navigate to APIs & Services > Credentials.
2. Click Create Credentials > OAuth client ID.
3. Select Web application as the application type.
4. Enter a name for the OAuth client, for example rConfig V8 Core.
5. Under Authorised redirect URIs, add your callback URL:

   https://your-rconfig-domain.com/auth/callback/google

6. Click Create.
7. Copy the Client ID and Client Secret. You need both for the rConfig configuration.

Configure rConfig V8 Core

Step 4: Edit the environment file

Open the rConfig .env file:

vim /var/www/html/rconfig/.env

Step 5: Add the Google SSO values

Add or update these lines with the values copied from Google Cloud Console:

GOOGLE_CLIENT_ID=your_client_id
GOOGLE_CLIENT_SECRET=your_client_secret
GOOGLE_REDIRECT_URI=https://your-rconfig-domain.com/auth/callback/google

• GOOGLE_CLIENT_ID: OAuth 2.0 Client ID from Google Cloud Console.
• GOOGLE_CLIENT_SECRET: OAuth 2.0 Client Secret from Google Cloud Console.
• GOOGLE_REDIRECT_URI: Must match the authorised redirect URI configured in Google exactly.

Step 6: Clear the application cache

Save the file and clear the rConfig cache so the new values take effect:

php /var/www/html/rconfig/artisan rconfig:clear-all

Step 7: Verify the login page

Reload the rConfig login page. A Sign in with Google button now appears below the standard username and password fields.

Approve the first SSO user

When a user signs in via Google for the first time:

1. The user authenticates successfully with Google.
2. rConfig creates the account with SSO access disabled.
3. The user sees a message that approval is required.

An administrator then completes the approval:

1. Log in to rConfig as an administrator.
2. Navigate to the Users section.
3. Locate the new SSO user.
4. Enable SSO access for that user.
5. Assign an appropriate role and permissions.

After approval, the user can authenticate with Google and access rConfig.

Common gotchas

• New SSO users are never granted access automatically. Each account is created with SSO disabled and an administrator must approve it in User Management before the user can sign in.
• The GOOGLE_REDIRECT_URI in .env must match the authorised redirect URI in Google character for character, including the scheme and any trailing path. A mismatch causes the sign-in to fail.
• The Sign in with Google button only appears after rconfig:clear-all is run. If it is missing, confirm the cache was cleared and all three environment variables are set.
• An “Access blocked” error from Google usually means the OAuth consent screen is still in testing mode or the user’s email domain is not authorised. Publish the consent screen or add the user as a test user.

Why isn’t the Sign in with Google button appearing?

• Confirm all three environment variables are set correctly in .env.
• Confirm the cache was cleared with php /var/www/html/rconfig/artisan rconfig:clear-all.
• Check the Apache error logs for configuration issues.

If authentication starts but fails, verify the redirect URI matches exactly between Google and rConfig, confirm the OAuth consent screen is configured, and check that the OAuth client is not restricted or disabled.

What’s next

• SSO Overview explains how Single Sign-On works across rConfig V8 Core.
• Manage users and approvals covers enabling SSO access and assigning roles.
• Configure Microsoft SSO sets up Single Sign-On with Microsoft Entra ID instead.