Skip to content
FIVEGUARDIAN5DOCUMENTATION
/
Español Open the panel
Administration

Identity providers

How sign-in works in FiveGuardian5 and how to set up Google as an identity provider without errors.

The embedded identity provider

FiveGuardian5 includes an embedded identity provider that handles sign-in for both the panel (https://twh.fiveguardian5.com) and the VPN window on devices. External providers can be connected to it, so users sign in with the account they already use at work.

Providers are managed under Settings › Identity Providers. The methods available to users depend on what is configured there: for example, Google.

Google as identity provider

With Google configured, users choose "Google" in the sign-in window and use their corporate Google Workspace account. They need no extra password and the organization controls accounts from a single place.

Setting up the Google OAuth client

Connecting Google requires an OAuth client created in Google Cloud Console by a Google Workspace administrator of the organization:

  1. In Google Cloud Console, create (or use) an organization project and configure the OAuth consent screen as internal.
  2. Create credentials of type OAuth client ID for a web application.
  3. Under Authorized redirect URIs, add exactly: https://twh.fiveguardian5.com/oauth2/callback
  4. Copy the client ID and client secret.
  5. In the panel, go to Settings › Identity Providers, add Google and paste the ID and secret.
  6. Test sign-in with a test account before announcing it to users.
If the redirect URI does not match exactly (including https, the path and no trailing slash), Google shows the error redirect_uri_mismatch and nobody can sign in with Google. This is the most common cause of failures when setting up this provider.
Store the client secret like a password. If you think it was exposed, generate a new one in Google Cloud Console and update it in the panel.

Sign-out

Google does not support remote logout. When a user signs out of FiveGuardian5, their Google session in the browser may remain open. To remove a person's access, suspend their account in Google Workspace and block or delete their user under Team › Users. See Users and access.

Two-step verification (MFA)

Two-step verification is enforced at the identity provider. With Google, it is configured in the Google Workspace admin console and then required from users at every sign-in. Requiring it is recommended for all accounts, especially administrators.

Changes to sign-in methods

Before adding, removing or changing a sign-in method, confirm that the method that will remain active works for all users and for the panel administrators. Coordinate this change with the FiveGuardian5 support team: a mistake can lock out every administrator.