keycloak-scim/server_admin/topics/identity-broker/social/google.adoc

==== Google

There are a number of steps you have to complete to be able to login to Google.  First, go to the `Identity Providers` left menu item
and select `Google` from the `Add provider` drop down list.  This will bring you to the `Add identity provider` page.

.Add Identity Provider
image:../../../{{book.images}}/google-add-identity-provider.png[]

You can't click save yet, as you'll need to obtain a `Client ID` and `Client Secret` from Google.  One piece of data you'll need from this
page is the `Redirect URI`.  You'll have to provide that to Google when you register {{book.project.name}} as a client there, so
copy this URI to your clipboard.

To enable login with Google you first have to create a project and a client in the https://cloud.google.com/console/project[Google Developer Console].
Then you need to copy the client id and secret into the {{book.project.name}} Admin Console.

NOTE: Google often changes the look and feel of the Google Developer Console, so these directions might not always be up to date and the
      configuration steps might be slightly different.

Let's see first how to create a project with Google.

Log in to the link:https://cloud.google.com/console/project[Google Developer Console].

.Google Developer Console
image:../../../images/google-developer-console.png[]


Click the `Create Project` button.
Use any value for `Project name` and `Project ID` you want, then click the `Create` button.
Wait for the project to be created (this may take a while).  Once created you will be brought to the project's dashboard.

.Dashboard
image:../../../images/google-dashboard.png[]

To be able to retrieve the profiles of Google users, you need to turn on the Google+ APIs.  Select the `Enable and manage APIs`
and click the `Google+ API` link.

.APIs
image:../../../images/google-api-list.png[]

Click the `Enable` button on this page.  You will get a message that you must create the credentials of your project.
So click the `Go to Credentials` button.

.Go To Credentials
image:../../../images/google-go-to-credentials.png[]

You will then be brought to the credentials page.

NOTE:  If you logout in the middle of this, there is a menu in the top left hand corner.  Select `API Manager` and it
       will bring you to your desired screen.

You will then be asked to specify what credentials you need and what type of data you will be accessing.

.Add Credentials
image:../../../images/google-add-credentials.png[]

Select `Web server` and `User data` and click the `What credentials do I need?` button.

.Create OAuth ID
image:../../../images/google-create-oauth-id.png[]

Next you'll need to create an OAuth 2.0 client ID.  Specify the name you want for your client.  You'll also need to
copy and paste the `Redirect URI` from the {{book.project.name}} `Add Identity Provider` page into the
`Authorized redirect URIs` field.  After you do this, click the `Create client ID` button.

When users log into Google from {{book.project.name}} they will see a consent screen from Google which will ask the user
if {{book.project.name}} is allowed to view information about their user profile.  The next Google config screen asks
you for information about this screen.

Once you click `Done` you will be brought to the `Credentials` page.  Click on your new OAuth 2.0 Client ID to view
the settings of your new Google Client.

.Google Client Credentials
image:../../../images/google-client-credentials.png[]


You will need to obtain the client ID and secret from this page so you can enter them into the {{book.project.name}} `Add identity provider` page.
Go back to {{book.project.name}} and specify those items.

One config option to note on the `Add identity provider` page for Google is the `Default Scopes` field.
This field allows you to manually specify the scopes that users must authorize when authenticating with this provider.
For a complete list of scopes, please take a look at https://developers.google.com/oauthplayground/ . By default, {{book.project.name}}
uses the following scopes: `openid` `profile` `email`.