Skip to content

Authentication — Google

Let users sign in to Forra via their Google Workspace account.

Approach

Forra provides a shared Google OAuth client that all organizations use. You therefore do not need to create your own OAuth client.

The client ID to use is provided by the Forra team. For reference, the one currently in use is:

556580214265-ha7af31eh2tgdm86u4bui1l95g0io33m.apps.googleusercontent.com

Contact the Forra team to confirm the exact value before configuring.

1. Configure Forra

In Tenant Admin → External Services tab → Authentication Providers section, open the Google card and enter:

  • Client ID: OAuth ID provided by Forra

Save.

2. Authorize the application on the Google side (if required)

If your Google Workspace organization restricts third-party application usage (a common setting in Workspace deployments), the Forra application must be explicitly marked as Trusted, otherwise users will see a Google error message preventing them from signing in.

Two ways to proceed in the Google Admin console (admin.google.com):

Preferred for a controlled rollout: no user is blocked and the authorization takes effect immediately.

  1. Security → Access and data control → API controls
  2. App access control → Manage Third-Party App Access
  3. Add app → OAuth App Name Or Client ID
  4. Paste the Forra client ID
  5. Select the relevant organizational units and set access to Trusted

Option B — Approve after a sign-in attempt

When a user tries to sign in to an unconfigured third-party app, the app appears in the admin console depending on the scenario:

  • Access blocked by default: the user can request access, and the app appears under Apps pending review.
  • Access allowed by default: the app appears in the Accessed apps list after a 24–48 hour delay.

In either case, the admin can then open the app and set access to Trusted without having to look up the client ID.

3. Test and clean up

Sign out and test the connection via Google. Once validated:

  • If an Auth0 or Microsoft configuration was used temporarily, remove its values from the same section so only Google remains.

Notes

  • Forra's Google OAuth client is configured on the Google side with the necessary Redirect URIs. If your instance uses a non-standard domain, contact the Forra team to have it added.