Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/nsg/sophos-firewall/23.0/Help/en-us/webhelp/onlinehelp/index.html?contextId=authentication-google-workspace

Google Workspace

You can integrate Google Workspace with Sophos Firewall as an OpenID Connect (OIDC) identity provider (IdP) for single sign-on (SSO) authentication across key firewall services. SSO authentication lets administrators access the web admin console and allows all users to access services, such as the captive portal and remote access VPN tunnels.

Sophos Firewall can also retrieve Google Workspace group membership information and use it to apply user and group-based policies and administrator access profiles.

The integration uses OAuth 2.0 and OpenID Connect (OIDC) to deliver reliable identity management.

To make Google Workspace work with the firewall, two separate consoles are used:

Where you can use Google Workspace SSO

You can configure Google Workspace SSO for the following services.

Web admin console

Firewall administrators can use SSO to access the web admin console. You can map their Google Workspace roles or groups to the firewall's administrator profiles through the server configuration in the firewall, ensuring identity‑based permissions.

User services

All users, including administrators, can use SSO to access some services in the firewall. Policies and firewall rules apply access permissions for these services.

The services that support Google Workspace SSO are as follows:

  • Captive portal: For users accessing web resources.

  • Remote access VPN: For users accessing network resources through VPN tunnels.

    • VPN portal
    • SSL VPN through the Sophos Connect client
    • IPsec VPN through the Sophos Connect client

Authentication workflow

The following workflow summarizes the authentication process:

  1. The user attempts to access a Sophos Firewall service.
  2. Sophos Firewall redirects the user to Google Workspace.
  3. The user signs in to Google Workspace.
  4. Google Workspace validates the user's credentials.
  5. Google Workspace returns the authentication response to Sophos Firewall.
  6. Sophos Firewall retrieves the user's group information.
  7. Sophos Firewall applies the appropriate user and group-based policies.

Configurations and troubleshooting