From 796d5d4b7ad1bd41c8a8c8cdd266debe1d6db856 Mon Sep 17 00:00:00 2001
From: DevelopmentCats <chris@dualriver.com>
Date: Tue, 12 Aug 2025 02:34:50 +0000
Subject: [PATCH 1/4] docs(oidc): add Google provider-specific guide and nav
 entry

Adds a concise guide for configuring Google as an OIDC provider, including refresh token params and icon/text hints. Updates docs nav to surface the page under OIDC Authentication.

Refs #13508.
---
 docs/admin/users/oidc-auth/google.md | 62 ++++++++++++++++++++++++++++
 docs/manifest.json                   |  5 +++
 2 files changed, 67 insertions(+)
 create mode 100644 docs/admin/users/oidc-auth/google.md

diff --git a/docs/admin/users/oidc-auth/google.md b/docs/admin/users/oidc-auth/google.md
new file mode 100644
index 0000000000000..a058d1c9b2ebd
--- /dev/null
+++ b/docs/admin/users/oidc-auth/google.md
@@ -0,0 +1,62 @@
+# Google authentication (OIDC)
+
+This guide shows how to configure Coder to authenticate users with Google using OpenID Connect (OIDC).
+
+## Prerequisites
+
+- A Google Cloud project with the OAuth consent screen configured
+- Permission to create OAuth 2.0 Client IDs in Google Cloud
+
+## Step 1: Create an OAuth client in Google Cloud
+
+1. Open Google Cloud Console → APIs & Services → Credentials → Create Credentials → OAuth client ID.
+2. Application type: Web application.
+3. Authorized redirect URIs: add your Coder callback URL:
+   - `https://coder.domain.com/api/v2/users/oidc/callback`
+4. Save and note the Client ID and Client secret.
+
+## Step 2: Configure Coder OIDC for Google
+
+Set the following environment variables on your Coder deployment and restart Coder:
+
+```env
+CODER_OIDC_ISSUER_URL=https://accounts.google.com
+CODER_OIDC_CLIENT_ID=<client id>
+CODER_OIDC_CLIENT_SECRET=<client secret>
+# Restrict to one or more email domains (comma-separated)
+CODER_OIDC_EMAIL_DOMAIN="example.com"
+# Standard OIDC scopes for Google
+CODER_OIDC_SCOPES=openid,profile,email
+# Optional: customize the login button
+CODER_OIDC_SIGN_IN_TEXT="Sign in with Google"
+CODER_OIDC_ICON_URL=/icon/google.svg
+```
+
+> [!NOTE]
+> The redirect URI must exactly match what you configured in Google Cloud.
+
+## Enable refresh tokens (recommended)
+
+Google uses auth URL parameters to issue refresh tokens. Configure:
+
+```env
+# Keep standard scopes
+CODER_OIDC_SCOPES=openid,profile,email
+# Add Google-specific auth URL params
+CODER_OIDC_AUTH_URL_PARAMS='{"access_type": "offline", "prompt": "consent"}'
+```
+
+After changing settings, users must log out and back in once to obtain refresh tokens.
+
+Learn more in [Configure OIDC refresh tokens](./refresh-tokens.md).
+
+## Troubleshooting
+
+- "invalid redirect_uri": ensure the redirect URI in Google Cloud matches `https://<your-coder-host>/api/v2/users/oidc/callback`.
+- Domain restriction: if users from unexpected domains can log in, verify `CODER_OIDC_EMAIL_DOMAIN`.
+- Claims: to inspect claims returned by Google, see guidance in the [OIDC overview](./index.md#oidc-claims).
+
+## See also
+
+- [OIDC overview](./index.md)
+- [Configure OIDC refresh tokens](./refresh-tokens.md)
diff --git a/docs/manifest.json b/docs/manifest.json
index ce03ef0ff2de1..bebf2fc6e54d8 100644
--- a/docs/manifest.json
+++ b/docs/manifest.json
@@ -416,6 +416,11 @@
 							"description": "Configure OpenID Connect authentication with identity providers like Okta or Active Directory",
 							"path": "./admin/users/oidc-auth/index.md",
 							"children": [
+            {
+              "title": "Google",
+              "description": "Configure Google as an OIDC provider",
+              "path": "./admin/users/oidc-auth/google.md"
+            },
 								{
 									"title": "Configure OIDC refresh tokens",
 									"description": "How to configure OIDC refresh tokens",

From 488cffd751cdcf8aa4fea82ee7ce2c3f4ae06bfa Mon Sep 17 00:00:00 2001
From: DevCats <christofer@coder.com>
Date: Tue, 12 Aug 2025 12:04:56 -0500
Subject: [PATCH 2/4] chore: update coder example url

Co-authored-by: Atif Ali <atif@coder.com>
---
 docs/admin/users/oidc-auth/google.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/admin/users/oidc-auth/google.md b/docs/admin/users/oidc-auth/google.md
index a058d1c9b2ebd..298497b27bebc 100644
--- a/docs/admin/users/oidc-auth/google.md
+++ b/docs/admin/users/oidc-auth/google.md
@@ -12,7 +12,7 @@ This guide shows how to configure Coder to authenticate users with Google using
 1. Open Google Cloud Console → APIs & Services → Credentials → Create Credentials → OAuth client ID.
 2. Application type: Web application.
 3. Authorized redirect URIs: add your Coder callback URL:
-   - `https://coder.domain.com/api/v2/users/oidc/callback`
+   - `https://coder.example.com/api/v2/users/oidc/callback`
 4. Save and note the Client ID and Client secret.
 
 ## Step 2: Configure Coder OIDC for Google

From fcf07b138ac3a91cf5afc576eb3e6a25d72bcbcf Mon Sep 17 00:00:00 2001
From: DevelopmentCats <christofer@coder.com>
Date: Tue, 12 Aug 2025 17:37:08 +0000
Subject: [PATCH 3/4] fix(docs): correct indentation in manifest

---
 docs/manifest.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/docs/manifest.json b/docs/manifest.json
index bebf2fc6e54d8..fcd1b647077d2 100644
--- a/docs/manifest.json
+++ b/docs/manifest.json
@@ -416,11 +416,11 @@
 							"description": "Configure OpenID Connect authentication with identity providers like Okta or Active Directory",
 							"path": "./admin/users/oidc-auth/index.md",
 							"children": [
-            {
-              "title": "Google",
-              "description": "Configure Google as an OIDC provider",
-              "path": "./admin/users/oidc-auth/google.md"
-            },
+            					{
+              						"title": "Google",
+              						"description": "Configure Google as an OIDC provider",
+              						"path": "./admin/users/oidc-auth/google.md"
+            					},
 								{
 									"title": "Configure OIDC refresh tokens",
 									"description": "How to configure OIDC refresh tokens",

From f0c7f94ca225248b3428ac08ebd0ede986b07f24 Mon Sep 17 00:00:00 2001
From: DevelopmentCats <christofer@coder.com>
Date: Tue, 12 Aug 2025 17:53:49 +0000
Subject: [PATCH 4/4] chore: make gen

---
 docs/manifest.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/docs/manifest.json b/docs/manifest.json
index fcd1b647077d2..6e943aa56f697 100644
--- a/docs/manifest.json
+++ b/docs/manifest.json
@@ -416,11 +416,11 @@
 							"description": "Configure OpenID Connect authentication with identity providers like Okta or Active Directory",
 							"path": "./admin/users/oidc-auth/index.md",
 							"children": [
-            					{
-              						"title": "Google",
-              						"description": "Configure Google as an OIDC provider",
-              						"path": "./admin/users/oidc-auth/google.md"
-            					},
+								{
+									"title": "Google",
+									"description": "Configure Google as an OIDC provider",
+									"path": "./admin/users/oidc-auth/google.md"
+								},
 								{
 									"title": "Configure OIDC refresh tokens",
 									"description": "How to configure OIDC refresh tokens",

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Transitional//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>
<html xmlns='http://www.w3.org/1999/xhtml'>
<head>
<title>pFad - Phonifier reborn</title>
<meta http-equiv='Content-Type' content='text/html; charset=utf-8' />
</head>
<body>
<h1>Pfad - The Proxy pFad of &#169; 2024 Garber Painting. All rights reserved.</h1>


<!-- Disclaimer -->
<p>Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.</p>
<br>
<p>Alternative Proxies:</p><p><a href="http://rainy.clevelandohioweatherforecast.com/php-proxy/index.php?q=https://patch-diff.githubusercontent.com/raw/coder/coder/pull/19309.patch" target="_blank">Alternative Proxy</a></p><p><a href="http://rainy.clevelandohioweatherforecast.com/pFad/index.php?u=https://patch-diff.githubusercontent.com/raw/coder/coder/pull/19309.patch" target="_blank">pFad Proxy</a></p><p><a href="http://rainy.clevelandohioweatherforecast.com/pFad/v3index.php?u=https://patch-diff.githubusercontent.com/raw/coder/coder/pull/19309.patch" target="_blank">pFad v3 Proxy</a></p><p><a href="http://rainy.clevelandohioweatherforecast.com/pFad/v4index.php?u=https://patch-diff.githubusercontent.com/raw/coder/coder/pull/19309.patch" target="_blank">pFad v4 Proxy</a></p></body>
</html>