GantryCD
Google Workspace
At a glance — a platform-wide Google provider, built once at boot from environment variables. Access maps from the Workspace hosted-domain (
hd) claim.
Configure
| Variable | Required | Notes |
|---|---|---|
GANTRYCD_SSO_GOOGLE_CLIENT_ID | Yes | OAuth client id |
GANTRYCD_SSO_GOOGLE_CLIENT_SECRET | Yes | OAuth client secret |
GANTRYCD_BACKEND_PUBLIC_BASE_URL | Yes | builds the callback URL |
GANTRYCD_SSO_GOOGLE_HOSTED_DOMAIN | No | pre-filters the account chooser (a UX hint only — never trusted for access) |
Register the single callback URL with the Google OAuth client, then restart.
Access rules
{"type": "google_hd", "domains": ["acme.com", "acme-eu.com"]}Org access keys off the hosted-domain (hd) claim. Personal gmail.com
accounts have no hd, so they can sign in but get no automatic org membership.
Troubleshooting
- Sign-in works but no org access — the user’s
hdmust match agoogle_hdrule; personal accounts never will. - Provider missing after a Google outage — discovery runs once at boot; if Google was briefly unreachable the provider is skipped rather than crashing the backend. Restart to register.