Overview

Sign in with a Google account or a Google Workspace domain.

Guide

1. In your wiki installation, go to Administration Authentication.
   1. Add a new Google strategy.
   2. Click Apply in order to generate the Authorization Callback URL.
   3. Copy the the Authorization Callback URL shown at the bottom (under the Configuration Reference section).
   4. Leave this page opened.
2. In a new tab, sign in to the Google Cloud console.
   1. In the project picker at the top, click New Project. If your organization uses Google Workspace, make sure to create the project inside your organization rather than under your personal account.
   2. Give it a name (e.g. My Wiki) and click Create.
   3. Ensure the newly created project is selected before continuing.
   4. Go to API & Services OAuth consent screen.
   5. Click the Get started button.
   6. Enter a App name (e.g. My Wiki) and a User support email. Click Next.
   7. Choose the audience and click Next:
      1. Internal: Only accounts in your Google Workspace organization can login.
      2. External: Any Google account can login. Note that you'll need to publish the app to allow any account to login. While in testing mode, only the list of users you specify can login.
   8. Fill in the contact information and click Next.
   9. Accept the terms and click Continue. Then click Create.
   10. Go to the Clients page and click Create client.
   11. Select Web Application as the application type, and give it a name (e.g. My Wiki).
   12. Under the Authorized redirect URIs section, click Add URI and paste the Authorization Callback URL you copied in step 1.
   13. Click Create.
   14. Copy the Client ID and the Client Secret.
3. Go back to the Wiki.js page from step 1.
   1. Paste the Client ID and Client Secret you copied in step 2.
   2. Set Enabled to on at the top.
   3. Click Apply.
4. For the desired wiki site, go to Login.
   1. Enable the Google strategy you just created.
   2. Click Apply.

Important

If you want any Google account authorized by the configuration above to be able to login, you need to enable Registration option on the Google strategy you created. Otherwise, only existing accounts with an email address that match the Google account will be allowed to login.

Configuration

Tip

To obtain the Authorization Callback URL, you must first click Apply on the newly added strategy (It won't be active until you check the Enabled checkbox). The endpoint URL will then be displayed at the bottom of the page under the Configuration Reference section.

Property	Description	Default Value
Client ID	From the OAuth 2.0 Client ID created in the Google Cloud console.
Client Secret	From the same OAuth 2.0 Client ID.
Restrict to Workspace Domain	A Workspace domain, e.g. example.com. Only accounts on it may sign in — checked here as well as asked for, since the parameter alone is a hint to Google rather than a guarantee.
Accept Unverified Addresses	Off by default. A Google account whose address is unverified proves nothing about the mailbox, and an account here is matched on the address.
Map Groups	Put the user in the wiki groups their Google Workspace groups name, on every login. Only groups that already exist here are matched — nothing is created. Workspace only, and it needs the Cloud Identity API enabled on the Google Cloud project this OAuth client belongs to.
Match Groups By	Which of the two things a Workspace group has is matched against the names of the groups here — the address, [email protected], or the display name, Engineering. The address is unique and survives a rename; the display name reads better, but two groups may share one and then both match.	Group address
Unassign from groups no longer present in Workspace	Off adds what Workspace names and takes nothing away, so a membership granted here survives. On makes Workspace the authority instead, and a group somebody is removed from there is taken away here — bar the groups this strategy auto-enrolls into, which are granted here to everyone it lets in.