Google Workspace Setup

Tip: To ease configuration, open Authentication and your Google API Console in separate tabs of your browser.

1. In Admin, go to Authentication and select Manage SSO settings.

2. Under Single sign-on, select Google Workspace.

3. Under Configure your connection, select Get started or Edit connection.

4. Enter the primary Google email domain to use with single sign-on (SSO) for your Blackbaud IDs.

5. In a separate browser tab, sign in to your Google API Console as the administrator for your Google Workspace connection.

6. Create a project or use an existing one on the domain.

   

   • For an existing project, select Select project, search for it, and select Open.

   • For a new project, select Create project, enter a name, browse to a folder location, and select Create.

7. To set up your consent screen, select Configure consent screen:

   1. Select whether to register internal or external users, and then select Create. In most cases, you want to select Internal.

   2. Configure the OAuth consent screen.

      1. Under App information, enter an app name to display when users sign in to Blackbaud solutions through Google and a support email.

      2. Under App domain, enter "blackbaud.com" as the authorized domain.

      3. Select Save and continue.

   3. Under Scopes, select Save and continue without specifying scopes.

   4. Under Test users, select Save and continue.

   5. Under Summary, review your selections and select Back to dashboard.

8. Select Credentials under APIs & Services, and then select Create credentials, OAuth client ID.

   

9. Create your application and its OAuth client ID.

   1. For the application type, select "Web application."

      

   2. Enter a unique name to identify the application.

   3. Under Authorized Javascript origins, enter "https://bbid.blackbaud.com" as Blackbaud's origin URI.

   4. Under Authorized redirect URIs, enter "https://bbid.blackbaud.com/login/callback" as Blackbaud's callback URL.

   5. Select Create.

   6. Under OAuth client created, note the client ID and client secret for your project, and select OK.

10. Back in Authentication, enter the client ID and secret for your project.

    Tip: To view the client ID and secret for your project in the Google API Console, select Credentials and select the project's name under OAuth 2.0 client IDs.

11. In your Google API Console, enable the Admin SDK API service.

    1. From your project, select Library.

    2. Search for and select Admin SDK API.

    3. Select Enable.

12. Return to Authentication, and select Finish.

To properly recognize and redirect users to your IdP when they sign in, identify which email domains your organization uses. For more information, see Claimed Email Domains.

After you set up your Google application and claim your email domains, test the connection to verify your organization can now use its IdP to sign in to Blackbaud solutions. For more information, see Test Mode.

After you set up your connection, you can turn on SSO through Google Workspace. When you turn on SSO, anyone who signs in to their Blackbaud ID with one of your claimed domains is redirected to your IdP. After they authenticate through your IdP, their Blackbaud ID:

• Automatically redirects to your organization's login for future sign-ins

  Tip: By default, users redirect to their Blackbaud ID profile when they sign in through your Google login. To instead open a different Blackbaud solution, edit the redirect. For more information, see Redirect Settings.

• Uses your IdP for password updates, lockouts, and similar authentication management

To complete the connection to your IdP, select Learn about connecting SSO and Connect with Google Workspace.

Note: After you enable SSO, resend any pending invitations sent before the connection to Google Workspace.

Warning: After you set up your connection, if you change a user's email address, you create a new Blackbaud ID with the new address and will need to re-invite them — at that Blackbaud ID — to their Blackbaud solutions.