Enable SSO - Google
Objective
This document provides instructions on how to configure Google SSO integration to F5® Distributed Cloud Services for your enterprise account. For an overview of F5® Distributed Cloud Console, see About.
Note: SSO setup requires you to be of the tenant owner type user. Navigate to General > IAM > Users. Select on the Show/hide column, select the Type field, and select Apply to display the Type column. For the tenant owner, the Type column displays Tenant Owner and others, it displays User.
Prerequisites
The following prerequisites apply:
- A valid Enterprise account.
- Note: If you do not have an account, see Getting Started with Console.
- Google Cloud Account with Admin Access
- Note: This can be an existing G-Suite account.
- For OIDC specifications and supported configuration values, see the OIDC reference guide for IdP administrators.
Configuration Steps
Step 1: Create project in Google Developer Console.
-
Log into Google Developer Console with your administrator access.
-
Select Create Project.
Figure: GCP IAM and Admin View
-
Enter a project name.
-
Set a project ID using the EDIT button as per your preference.
-
Select Create.
Figure: Create a new project
Step 2: Start OAuth consent settings.
-
Select - menu icon to right of Google Cloud Platform in upper-left corner.
-
Select APIs & Services in pop-out menu.
-
Select OAuth consent screen.
-
Select Internal.
-
Select Create button.
Figure: API Credentials
Step 3: Fill in OAuth consent screen details.
Step 4: Create OAuth credentials.
-
Open Credentials tab.
-
Select OAuth client ID under Create credentials button.
-
Create OAuth client ID and client secret.
Figure: Credentials Tab
Note: Leave Authorized redirect URIs field as blank, this can be provided once the URI is obtained from F5 Distributed Cloud Console SSO Portal.
Step 5: Copy the generated credentials.
Once credentials are created a Client ID and Client Secret are generated which are required to set SSO. Copy the same to be provided in F5® Distributed Cloud Console.
Step 6: Start SSO setup in the F5 Distributed Cloud Console.
Features can be viewed, and managed in multiple services.
This example shows SSO setup in Administration.
- Open F5 Distributed Cloud Console home page, select Administration box.
Note: Home page is role based, and your home page may look different due to your role customization. Select All Workspaces drop-down menu to discover all options. Customize Settings: Administration > Personal Management > My Account > Edit work domain & skills button > Advanced box > check Work Domain boxes > Save changes button.
Figure: Homepage
Note: Confirm Namespace feature is in correct namespace, drop-down selector located in upper-left corner. Not available in all services.
- Select Tenant Settings in left column menu > select Tenant Options.
Note: If options are not showing available select Advanced nav options visible Show link in bottom left corner. Select Hide to minimize options from Advanced nav options mode if needed.
- Select Set up SSO button.
Figure: Set up SSO
-
Select Google in Select Service Provider in pop-up window.
-
Select Continue button.
Step 7: Set OAuth Credentials and Hosted Domain.
Default Scopes: OpenID Connect (OIDC) introduces the concept of "scopes" from OAuth 2.0. A scope is a way to limit the amount of information and access given to an application. When a client application wants to access resources on behalf of a user, it requests specific scopes. These scopes inform the user of the type of access the application is requesting during the authorization process.
F5 Distributed Cloud recommends default scopes of openid profile email NOT openidprofileemail.
Note: Multiple scope values are used by creating a space delimited, because it is the OIDC standard specification by IETF although we do handle automatic validation/modification.
- Provide Client ID and Client Secret obtained from previous steps.
Note: Recommended default scopes: openid profile email. Multiple scope values are used by creating a Space Delimited during SSO setup in F5 console.
- Enter Default Scopes.
Note: Any entered value will be combined with preset value: openid profile email NOT openidprofileemail. Input spaces between words to include multiple scope values. To avoid additional steps with form Update Account Information, confirm Client ID contains First Name (family_name), Last Name (given_name), Email. OIDC standard specification by IETF - automatic validation/modification is supported on console, but not suggested in this form.
Figure: Default Scopes
-
Enter domain in Hosted Domain box.
-
Select Save and Continue.
Note: This example uses ves.io as the domain.
Figure: Client ID and Client Secret
Note: The Hosted Domain is the domain where your accounts are hosted and only accounts of that domain are listed. You can also enter
*for this field to use any hosted account.
Step 8: Copy Redirect URL.
- Copy the displayed Redirect URL.
Note: This is used in OAuth client configuration in later steps.
- Select Done.
Figure: Well Known URL
Step 9: Add authorized domain in Google Developer Console for your OAuth settings.
-
Log back into the Google Developer Console.
-
Select API & Services section.
-
select on OAuth consent screen.
-
Select EDIT APP.
-
Under Authorized domains > add f5.com as the domain.
Figure: Add Authorized Domain
Step 10: Add Redirect URL in credentials page.
-
Select Credentials.
-
Edit the OAuth 2.0 Client ID to add authorized redirect URI (obtained in Step 8).
-
Select Save button.
Figure: Configure Redirect URI
Step 11: Log out of F5 Distributed Cloud Console. Subsequent logins get serviced through Google.
Log out of the F5 Distributed Cloud Console.
Note: The subsequent logins get serviced through Google.
Edit SSO Configuration
You can modify an existing Single Sign-On (SSO) configuration to update credentials and secrets without removing the configuration. This eliminates the need to delete and recreate the SSO setup during routine secret rotation cycles. This allows you to rotate secrets faster with less risk, no tenant downtime, and no security gaps.