Google OAuth2 Authentication
note
This functionality is available starting from version 0.0.39. Make sure to upgrade before you use this.
To enable Google OAuth2 you must register your application with Google. Google will generate a client ID and secret key for you to use.
#
Create Google OAuth keysFirst, you need to create a Google OAuth Client ID:
- Go to https://console.cloud.google.com/apis/credentials.
- Click "Create Credentials", then click "OAuth Client ID" in the drop-down menu
- If this is your first time creating a client ID, you can also configure your consent screen by clicking Consent Screen. (The following procedure explains how to set up the Consent screen.) You won't be prompted to configure the consent screen after you do it the first time.
- Enter the following:
- Application Type: Web Application
- Name: Pyroscope
- Authorized Redirect URLs: https://pyroscope.mycompany.com/auth/google/callback
- Replace https://pyroscope.mycompany.com with the URL of your Pyroscope instance.
- Click Create
- Copy the Client ID and Client Secret from the "OAuth Client" modal
#
Enable Google OAuth in PyroscopeSpecify the Client ID and Secret in the Pyroscope configuration file. For example:
auth: # Specifies which role will be granted to a newly signed up user. # Supported roles: Admin, ReadOnly. Defaults to ReadOnly. # The parameter affects all authentication providers. signup-default-role: Admin google: enabled: true client-id: CLIENT_ID client-secret: CLIENT_SECRET allowed-domains: - mycompany.com - myorganization.org
note
If you decided to enable the internal authentication provider and allow users to signup via the
auth.internal.signup-enabled
option, we strongly recommend you to set auth.signup-default-role
to ReadOnly
(the default value).
See the server configuration page for more details on the Pyroscope configuration file.
Restart the Pyroscope server. You should now see a Google login button on the login page. You can now login with your Google accounts.