Configure Google login for Discourse

[Discourse]

This guide explains how to set up Google login integration for your Discourse site by configuring OAuth2 credentials in the Google Cloud Console.

Required user level: Administrator

Overview

Google login allows users to sign in to your Discourse site using their Google accounts. This guide will walk you through:

1. Creating a Google Cloud project
2. Setting up OAuth consent
3. Configuring credentials
4. Enabling Google login in Discourse

Create a Google Cloud project

1. Navigate to https://console.developers.google.com
2. Click the project selection button in the top left
3. Click “New Project”

4. Enter a project name and optional location.
5. Click “Create”

If you see any errors after creating the project, refresh the page using Ctrl+F5.

Configure OAuth consent

1. Navigate back to https://console.developers.google.com and select your new project if it is not already slected.
2. Navigate to “OAuth consent screen” in the left panel. You can also use the top left Google Cloud menu to select “APIs & Services” → “Oauth consent screen”.

3. Click “Get Started”
4. Under “App Information” enter an app name and select a user-support email address.

5. Select “External” Audience

6. Next, enter a notifications email address
7. Finally, accept the API Services: User Data Policy and click “Create”

Set up credentials

1. Navigate to the “APIs & Services” → “Credentials” screen
2. Click “Create Credentials” and select “OAuth Client ID”

3. Configure the OAuth client:

• Select “Web application” as the Application Type and give it a Name
• In Authorized JavaScript Origins, add your site’s base URL (including https://)
• Add your callback URL under Authorized Redirect URIs: https://your-discourse-site.com/auth/google_oauth2/callback
• Click “Create”

Click on the OAuth 2.0 Client ID:

Copy the ClientID and Client Secret to add to your Discourse admin:

Configure Discourse settings

1. In your Discourse admin settings under “Login & authentication”

• Enable the setting enable google oauth2 logins
• Enter your google oauth2 client id
• Enter your google oauth2 client secret

Verify and publish

Test the integration by adding a user with a Google email address and confirming you can log in to Discourse using the “Log in with Google” option. If you are able to log in then the configuration is complete!

NOTE:

Previously there was one final step required - changing the Google Developer Project to production status. This no longer appears to be required. We are leaving these legacy notes here just in case.

To make the integration publicly available:

• Change the status to “In production”-
• Complete Google’s verification process
• Verify site ownership through Google Search Console

Additional configuration

Google OAuth2 prompt

The google oauth2 prompt setting controls the behavior of Google’s consent screen during login. Available options:

• (blank) — default Google behavior
• none — no consent or account selection screen shown
• consent — always show consent screen
• select_account — always prompt the user to select an account

Google Workspace (formerly G. Suite, Google Apps) login

To restrict login to specific Google Workspace domains:

1. In Discourse Admin -> Login & authentication, locate the google oauth2 hd site setting
2. Enter your Google Workspace domain

Google Workspace group sync

You can automatically sync Google Workspace groups with Discourse. This requires:

1. Enable the google oauth2 hd groups setting
2. Set google oauth2 hd to your Workspace domain
3. Enter a Workspace admin email in google oauth2 hd groups service account admin email
4. Paste your Google service account JSON credentials into google oauth2 hd groups service account json

The service account must have domain-wide delegation enabled and be granted the https://www.googleapis.com/auth/admin.directory.group.readonly scope. See Google’s documentation on domain-wide delegation for setup instructions.

Troubleshooting

If you experience login issues:

• Verify that HTTPS is properly configured
• Double-check all redirect URIs
• Ensure your site’s SSL certificate is valid
• Confirm that all required Google Cloud APIs are enabled
• Enable google oauth2 verbose logging to get detailed OAuth2 request/response logs

Related resources

• Using OAuth 2.0 for Web Server Applications  |  Authorization  |  Google for Developers
• Perform Google Search Console Verification with Discourse

Last edited by @southpaw 2025-03-11T02:06:51Z

Check document

Perform check on document:

[Deenius (Daniel Jurnik)]

안타깝게도 지침에 따라 진행해도 로그인이 되지 않습니다.

로그인을 작동시키기 위해 리다이렉트 URL 형식을 두 가지 모두 추가해야 했습니다.

https://forum.example.com//auth/google_oauth2/callback http:///forum.example.comauth/google_oauth2/callback

하지만 현재는 앱 공개 제출이 불가능합니다. Google은 HTTPS 형식의 주소만 요구하기 때문입니다.

이 문제를 해결하는 방법에 대한 조언이 있을까요?

[pfaffman (Jay Pfaffman)]

표준 설치 환경이 아니라서 force_https를 활성화해야 하는 것 같습니다.

[Deenius (Daniel Jurnik)]

공식 설치 가이드를 따랐습니다. HTTPS 강제 사용이 활성화되어 있습니다.

수정: 이상하긴 한데, 이제 갑자기 작동하기 시작했습니다! 최소 열 번은 시도해 봤는데, 그때는 작동하지 않았습니다.

절차가 정확히 같았기 때문에 이유를 설명할 수 없습니다. 구글 측에서 뭔가 변경된 건 아닐까요?

[pfaffman (Jay Pfaffman)]

http로 google에 접근한다는 건 말이 안 돼.

[patrickemin]

안녕하세요, 감사합니다. 오늘 해당 절차를 설정했고 잘 작동하고 있습니다. 제 것이지만 다른 Google 계정으로 테스트해 보았습니다. 다만 작은 질문이 하나 있습니다. PC에서 이 다른 Google 계정으로 등록을 시도했는데, 액세스 키 옵션만 표시되었습니다. 스마트폰과 통신하려면 블루투스를 활성화해야 했습니다. 그런데 그 모든 것이 전혀 작동하지 않았습니다. 제가 실제로 하고 싶었던 것은 Google 연결 버튼을 클릭한 후, 액세스 키를 사용하지 않고 단순히 양식을 입력하는 것만으로 절차를 완료하는 것이었습니다. 저는 PC를 사용 중이며, 반드시 액세스 키나 지문을 가지고 있지는 않습니다. 스마트폰이 아닌 상태에서 이 절차를 사용하고 Google로 등록하려면 어떻게 해야 하나요? 감사합니다.