Connecting Google to Keycloak — Two-Party Setup Guide
Client — manages the Google Cloud environment CultureSuite — manages the Keycloak environment
Step 1: Request the Redirect URI from CultureSuite
Step 2: Create the OAuth Client in Google Cloud
The Client sets up the OAuth credentials using the URI received from CultureSuite.
- Go to console.cloud.google.com and create a new Project (e.g. Keycloak).
- Navigate to APIs & Services → Credentials.
- If prompted, configure the OAuth Consent Screen — fill in the required fields and save.
- Click Create Credentials → OAuth client ID, select Web application and give it a name.
- Under Authorized Redirect URIs, paste the Redirect URI received from CultureSuite.
- Click Create.
- Copy the generated Client ID and Client Secret from the confirmation popup.
📤 Client sends to CultureSuite: the Client ID and the Client Secret.
Step 3: CultureSuite configures the Google Identity Provider in Keycloak
Step 4: Verify the Integration
- Open the CMS login page
- Confirm that Sign in with Google appears as a login option.
- The first time you log in, you are shown a message. This means your log in was succesfull, but you don’t have a CMS role yet (admin or user).
- If you are the first (admin), please contact CultureSuite so we can set your admin role.
- After that, you can configure roles for all your colleagues via the CMS users module after their first login.
The SSO button can replace the familiar username + password fields. So make sure all your CMS users have a Google account to access the new SSO.
If you still want to be able to also log in the “classic” way via a password and email, we can keep that option available too.
Information Exchange Summary
# | From | To | What |
1 | CultureSuite | Client | Keycloak Redirect URI |
2 | Client | CultureSuite | Google Client ID + Client Secret |