OIDC Setup for NID FS on NCC and Google Workspace

Options
Zyxel_Richard
Zyxel_Richard Posts: 260 image  Zyxel Employee
Zyxel Certified Network Engineer Level 2 - WLAN Zyxel Certified Network Engineer Level 2 - Switch Zyxel Certified Network Engineer Level 2 - Nebula Zyxel Certified Network Engineer Level 2 - Security
edited June 16 in Org-wide settings

This article describes how to configure OpenID Connect (OIDC) on both Nebula Control Center (NCC) and Google Workspace. It enables administrators to integrate their existing user directory with the Nebula Identity Federation Service via OIDC, allowing users to leverage the service for additional network use cases such as SSID authentication and SSL VPN.

Note: Please ensure that the user's email address is set to allow successful authentication via OIDC

This guide focuses on the application registration process in Google Workspace and the collection of required information to configure a valid Identity Provider (IdP) profile in NCC.

Step 1: Copy the Redirect URL on NCC

  • In the “Add Identity Provider” dialog in NCC, copy the Redirect URL value for later use.
image-95ac9705bf1ab-2f82.png

Step 2: Register an Application in Google Workspace

  • Sign in to the Google Cloud Console.
  • Navigate to Google Cloud Console > APIs & Services > OAuth consent screen.
image-c8af4aa6464ba8-df3c.png

  • Follow the setup wizard to configure your application details and create a project.
image-92a9b088d6b1d8-927c.png image-56ece9bb3a2ec-ad29.png

  • Set the Audience to Internal to restrict access to users within your organization and ensure environment isolation.
image-f030f493da6ad8-5db9.png

  • Enter the required Contact Information, then click Create.
image-e512cc48ed1a7-5f16.png

  • Continue with the setup wizard to create your OAuth client:
    • Alternatively, navigate to Clients in the left-hand menu and click Create Client.
image-525b075c518fa-5377.png

  • In the dialog:
    • Select Web application as the application type.
    • Assign a recognizable name to the client.
image-bf103eb5daa3c-3fbc.png

  • Under Authorized redirect URIs, paste the Redirect URL copied from NCC.
image-639a13f6d5a7f8-7998.png

  • Click Create to complete the client setup.
  • After creation, copy and securely store the following values:
    • Client ID
    • Client Secret
image-6469f07e17559-cc90.png

Step 3: Configure the Identity Provider in NCC

  • Return to the “Add Identity Provider” dialog in NCC and enter the following details:
    • Issuer URL: https://accounts.google.com
    • Client ID: <Client ID>
    • Client Secret: <Client Secret>
  • Click Save to complete the Identity Provider configuration

image-1404c7dbced4e8-3883.png

Related content：Claim settings and usage on Google workspace and NCC.

Categories

EnglishTiếng ViệtРусскийไทย中文（台灣）