Overview
This document outlines the implementation of Single Sign-On (SSO) using Google Workspace. The goal is to simplify authentication, streamline onboarding, and ensure consistent role assignment across both platforms.
Objectives
Enable users to log in using “Login with Google”
Ensure secure authentication via Google Workspace
Maintain existing CRM accounts without duplication
Support automatic or selectable role assignment
Provide a scalable path for future user provisioning
Implementation Plan
Phase 1 – Authentication :
This phase focuses on enabling Google SSO strictly for authentication of existing users, without introducing automatic user creation.
Core Capabilities
1. Google SSO Login Enablement
Introduce “Login with Google” option on supported login pages
Redirect users to Google Workspace authentication flow
Authenticate users
2. User Validation Against CRM
After successful Google authentication, the system will:
Extract the email address from the Google account
Search for a matching user in the CRM
Matching criteria:
Exact email match
User must belong to the corresponding ORG
3. Access Control Enforcement
If a matching CRM user is found:
Access is granted
User is authenticated into the system
If no matching user is found:
Access is denied
No user record is created
User receives a controlled error message (e.g., “User not authorized”)
4. Account Linking (First-Time Login Only)
On the first successful login:
The system links the Google account to the CRM user
Stores Google’s unique user identifier (sub ID)
This ensures:
Persistent linkage independent of email changes
Secure and consistent authentication in future logins
SSO configuration is managed per organization (ORG level) and must be configured via Super Admin settings.